Os yw'r gweithio gynllun 2003, dwi'n cael ei gwaith ymlaen i Sydney Ayrport, ond rydyn ni wedi cael ei gwaith ddraethau sydd gennym fflaenau EDS, ac eisiau'r ymdweithio'r cymdeithasau ymddangos i ddweud i'r cyffredin gyda'r ddweud eich cyfaint o'r ddweud ei fod yn y bryd, yw'n ddweud i'r troli, ac mae'n ddweud i'r ddweud. Mae'n dweud eich ddweud o'r ddweud o'r ddweud o'r ddweud eich ddweud, ond rydw i rhaid i ni gweld ei ddweud i'r ddataeth mewn hanes. Ond ond roedd iawn o fewnhyn o'r Cymru, mynd i yn rhi'n mynd i'w gweithio. I am hynny y dyfodol wedi gwneud hynny. Daeth y laptop am y cossfarnol i uneddiad sy'n ddweud. Rhyw hwn yn fawr y ddweud i'ch hanes eich dweud yn cysylltu i'r ddweud. Ac y gallwn yn ddigon ni'n sylfaenol i'r ddweud, rydym ni'n rhan o receiptio o'r cyfansiwys ysgolol, a'r newid ydydd yn rhoi�도 gyda cyfnodau cyfanc yr oedd gan helpu a gwybod ymylwyr a'r biwydden nhw, yw'r cyflolau i'r bai gellyts ac maen nhw'n bwnt i amser yng nghymru, ac ydych chi'n gwrs iawn i chi'n sefydlu ar gwrs maen a'r cyflwydau a'i gwybod i'r bai gwsiannol gynghig yng Nghymru. Weithio ydych chi'n gennym ni a yw'n gŵr? Dwi'n ddwy i'r gŵr Martin. I'm a security consultant and I work with a company called MWR Info Security in the UK. I originally approached this subject as a penetration tester as I was asked to actually examine some systems running some IBM networking technologies. Having then found some interesting results on the test, I decided to do a bit more research on it. I do not have a background in IBM computing, I've only been in this subject for about five or six months. From the time I've spent investigating these technologies, I've actually come to the conclusion that there's probably two different types of issues that we're looking at here. These technologies are old and there's probably a lot of administrators that have learned security issues with their systems over the years and might not necessarily have written them down. And there's also going to be vulnerabilities out there purely because people haven't looked at aspects of the technology in a new way, haven't applied modern techniques to looking at them. So who's the intended audience of this talk? Well I think each of the four categories here will actually get something out of this talk. Security managers, if all you know about is IP and your IP networks, you may find that there's some interesting things I'm going to talk about. It's always important to understand how your network works, not just how the bits that are using IP work. If you're a pen tester like me when I came to first investigate this subject, there's not a great deal of information out there on this kind of thing. And so hopefully you'll learn something about it today. If you're a network or a security architect, you can only design a secure network if you know where the risks arise from and hopefully you'll learn some of those today as well. And if you're a mainframe operator, my experience is that the guys running the mainframes don't necessarily talk too much to the network guys, don't talk too much to the desktop guys. And therefore this talk aims to combine a few of these different issues and hopefully if you work with mainframes day in, day out you may learn a couple of things. The only real background you need is a basic understanding of networking and some common network architectures. So what is IBM networking? I'm sure IBM have their own definition for what it is. For the purpose of this presentation, it's as follows. It's a collection of protocols and networking technologies that allow IBM mainframes, AS 400s and user terminals to communicate with each other. That's literally the premise that I've taken at IBM networking to be when actually coming up with this presentation. The main protocol we're going to be interested in is called Systems Network Architecture, SNA. However this is the IP age and IBM certainly has lots of support for IP and in today's modern networks there will be both IP and SNA. So why look at IBM networking? Well if you've got a mainframe within your business, within your organisation, it normally contains your most critical data. And if it contains critical data then it's pretty good to make sure it's secure. Aspects of this technology might be old but they're still deployed in a large number of high value environments. We're talking about finance here, retail, defence, government. And it's also good to look at protocols, compare different vulnerabilities across technologies, see how we can learn lessons across all these different technologies, look at issues in IP and see if they manifest themselves in SNA. Look at SNA and see if we can find anything that we can then take back to the world of IP and other protocols. And in general IBM networking is not mentioned in security textbooks. If you open up hacky exposed you won't find a great deal about it. So let's do some technical background into SNA and some of the other protocols and technologies that we're going to be attacking today. A brief history of SNA, originally announced back in 1974, although the actual dates in question are hotly disputed still, it was really intended as a way of unifying different IBM technologies. Before this date different systems used to communicate with each other in different ways. And so SNA was an attempt to really try and tie together the ways of accessing systems in a way to make IT simpler. Traditionally a master-slave model, it was the mainframe responsible for everything. Everything else took its lead from the mainframe. Everything had to be configured. You had to get the IT guys in to set everything up. There wasn't a case of just plugging a laptop in and starting working. The architecture was designed with physical links in mind that were semi-secure. We're talking about point-to-point links. We're talking about pieces of equipment that were locked away from users. There weren't simply network cables on desks that people could plug into. It was a long time before the widespread adoption of land technologies. In the 1980s came peer-to-peer networking, APPN. This in itself is a vast topic and something that I won't really be talking much about today. There's certainly an awful lot of potential security issues lurking in there. Now as the PC continued to develop, more responsibility was offloaded from traditional hardware components and moved on to the PC. And in today's modern networks IP and SNA exist alongside each other in a number of different ways. What will come to find out is that the integration of these old technologies with the new ways of working is one reason why certain vulnerabilities can actually be exposed. So any talk of a protocol won't be complete without the OSI model. There it is. And if we look at SNA, it pretty much lines up against the components of that. Again we could stand there and debate exactly how each of those layers correlates with each other but we haven't really got time to talk about that today. Now if you're used to IP, the whole concept of an SNA session may come as a little bit of a shock to start with. If you're used to IBM networking then you might be used to diagrams like this. On the right hand side we have the mainframe. On the far right hand side of the mainframe we have the application subsystems that sit within it. Job entry system is jazz and time sharing option is TSO. And front-ending this we have VTAN, virtual telecommunications access method. This is the way that the application subsystems will actually interact with the network. And VTAN will also be responsible for controlling our network protocols. On the left hand side we have a user terminal. In today's modern world this will be a PC. Back in the old days this could be some form of cluster controller. A couple of items of terminology just to take care of first. You see PU and LU. Now these stand for physical unit and logical unit. There isn't really time to go into full detail of what exactly these terms mean but a quick overview of them is that a physical unit is essentially a physical piece of kit. It's a piece of hardware that is capable of communicating over the network. A logical unit then is more of an application running on that system. The old applications that used to run on the old green screen terminals essentially you can consider one of those as a logical unit. You can however have multiple logical units within a physical unit and that's where things start to get a bit complicated. So we're not going to go into this in too much detail. Now standing in front of the main frame is what's known as a front end processor. It used to be a piece of dedicated hardware that used to handle network path control. Used to be responsible for routing within the SNA environment. Now when we establish an SNA communication there are three different sessions that are going to be established. The first of these is going to be what's known as the SSCP to PU session. This is the system services control point talking to the physical unit. This is responsible for actually forming a network route to the physical device making sure that it's up. The next session is the SSCP to LU session. This is essentially where VTAM presents the user with the log on screen. And that session is responsible for passing the user credentials back across to the main frame. VTAM is then responsible for talking to the individual application subsystems to log you on to the application that you actually want access to. Assuming a successful authentication we then have a logical unit setup. In this case we have a session actually established to TSO within the main frame. Now all of these sessions it will exist at the same time. This is slightly different to the world of IP. So let's look at some basic architectures and network setups that we could find employing SNA. The first one of these is a basic SNA network that we might have found back in the 1980s. This is a very simplified version but we have the main frame on the right hand side. We have our user terminals on the left hand side. Essentially we used to take our terminals and plug them into the cluster controller node. This usually used to be via a piece of coax. Our cluster controller node was then connected to our communications controller node. Our front end processor sat in front of the main frame. And this used to be via a point to point link. Usually SDLC protocol was used at the link layer to manage this communication. And as I mentioned we need to define all our nodes within the main frame, within VTAN before they're going to work. Once IP came along people wanted to run SNA across their IP networks. And they had to come up with some novel ideas in order to do this. One of the first ideas to be for people to use was what's known as an SNA gateway. This is basically a device that is capable of translating IP traffic and turning it into SNA. The users of our applications run basically a client application on their PC. This will then communicate with the SNA gateway. It's usually a proprietary TCP protocol. The most common example is Microsoft's SNA server, now known as host integration server. Microsoft's SNA gateway, if you have a look at it out the box, has a number of interesting features. Or at least I think that's what Microsoft designed them as anyway. Where you can actually pull off the configuration of that SNA gateway without providing any authentication. If you can compromise the SNA gateway there are various ways that you may be able to then start attacking the main frame. But again these are subjects for another day. And in our SNA gateway example we still then have SNA traffic passing from the gateway to the main frame. Another way of actually communicating with the main frame using SNA is actually to bridge our traffic across our local network. Back in the days of token ring networks this could actually be done using LLC at the link layer. Now this used to run into some problems because if we started having one link somewhere on our network we were basically sending all the link layer control traffic across that one link and all our user data was not getting the bandwidth that it needed. If we actually did source root bridging we could actually use the RIF flag associated with token ring to actually root the traffic between rings on the network. However this again imposed the limit. Seven hops is possible to fit into the RIF field. So with all these problems we needed a better solution. In the 90s one was devised. It's known as data link switching. In this instance all our users actually ran SNA over LLC on their local subnet. Now this was bridged to a DLSW router. For example each remote office or each floor in an office could have their own network bridge and their own DLSW router. DLSW could then be used to encapsulate the SNA data in IP and actually transfer it across an IP network. Either that will be an internal one or if we are being particularly foolish we could do that across the internet. However as network administrators like to save time and effort what they like to do is actually set up the router in front of the main frame in what's known as promiscuous mode and we'll talk about this in a little bit more detail. What this essentially allows you to do is connect up new offices to the DLSW infrastructure and not have to change the configuration of the router. And of course there's IP. IBM mainframes have had IP support for a long time now. This is again one method we can actually use to actually talk to the mainframe. Users will typically run a terminal emulation application.  We can then run IP protocols across our network. TM3270 which is essentially telnet with formatting. We could either run FTP we could run SSH we can run any IP services at the mainframe support. But let's move back to talk about DLSW. And let's look at it in a bit more detail. It was originally designed by IBM and they released details of it in 1993 in an RFC. It's essentially used for packet switching. It can be used to encapsulate SNA on native net BIOS frames in the IP protocol. And also provides local termination at the link layer to actually reduce our bandwidth utilization. A number of improvements were made to the protocol and again these were released in 1995. Cisco then took the protocol and actually added some of their own extensions to it named it DLSW plus. These extensions essentially formed version two of the protocol and this was documented in 1997 in a further RFC. And version two of the protocol is the one that's most widely used today. As you can see by the dates this isn't modern technology but it's still being used by a large number of organizations in a large number of high value situations. So let's take a quick look at a DLSW packet. Essentially it's made up of two portions, the DLSW header and the DLSW data. As you can see here there's a basic ethereal screenshot showing a very simple DLSW packet. If you can make it out you might see the remote DLC value, the remote DLC PID. These are actually used to track DLSW circuits which we'll come on to talk about in a little bit. Also in the header we can see what type of packet this is. This seems to be a capabilities exchange packet and again we'll talk about this in a little bit more detail. Now I haven't got much time to talk about the DLSW protocol in much detail. If you look on the presentation on your DEFCON CD you'll actually find a few more slides talking about the format of the data that's actually used within the protocol. You can also go back to the RFCs and have a look that I'll provide you with some more information. So I talked about DLSW circuits so let's look at what those are and how they're established. When we're initially setting up the DLSW communication we'll actually do what's known as a capability exchange. I'll actually come on to look at that in more detail in a little while. But once you've established capabilities or you've exchanged capabilities you essentially have a TCP connection between DLSW capable routers. On top of this TCP connection we can then establish circuits. These circuits are essentially SNA sessions that are actually being used to communicate between individual hosts in the mainframe. Now multiple circuits can exist over that TCP connection and that TCP connection won't drop even if there isn't an active circuit. So let's just look briefly at the actual establishment of the DLSW circuit. The diagram here we have a user terminal on the left and the mainframe on the right. And in between them we have two DLSW capable routers. So the first thing that happens is our user terminal sends out what's normally an LLC test frame. It's essentially a ping at the actual link layer. Upon receiving this packet the first router will actually look in its cache to see whether it's had any traffic from this host before. If it hasn't it will then send out what's known as a can you reach message to each DLSW router it's aware of. The aim of this is to try and locate the DLSW router through which it communicates to the intended destination. If the MAC address isn't known by our remote router it's then sent out onto its local network bridge. And if it hits its target it will get a response back. The router will then send an icon reach packet back to the original router saying I know where this guy is and you can actually use me to establish a circuit. Then that packet is sent back to the user. So essentially in this process we establish what's known as a DLSW circuit. The remainder of the SNA communication can now pass over this circuit so we can encapsulate our SNA traffic in IP. And we can terminate this circuit as well. It's usually 15 minutes after the last activity that this circuit will be torn down. We can also send a whole data link packet if we want to tear down this immediately. So now given a brief overview of some of the protocols we're going to be attacking. Let's look at some ways we can actually attack our environments and try and gain access to some systems. Let's first look at the objectives. Why is an attacker going to actually be interested in these environments? Well first of all the data on the mainframe. It will usually be finance data, intelligence data, data that's of importance to competitors. Processing power of the mainframe. There's an awful lot of processing there and wouldn't be cool to run our own processes on it. And let's face it, if we can own an IBM mainframe then that's pretty cool. So what are we actually going to need to gain access to the mainframe? We're either going to need access to a log on service and some valid credentials. Or we're going to need to find a vulnerability or poor configuration in the mainframe. Now the easiest one of those is actually by gaining access to a log in service and finding some credentials. That way we don't have to discover any zero days, we don't have to start writing some ninja code to actually execute arbitrary code on the host. Let's just find some credentials and log on. So we've talked about DLSW environments and as any attacker will know the best thing to do first is to find out some information about the environment you're within. If we look at all the textbooks telling us how to set up a DLSW environment they'll tell us at least one of the routers is going to be in what's known as promiscuous mode. In none of the documentation does it tell us how dangerous promiscuous mode really could be. So let's look at what we can actually learn from a promiscuous mode router. And to learn something from the router we need to do what's known as a capability exchange. Here are we at the bottom as router A and there's router B or promiscuous mode router that we want to exchange capabilities with. So the first thing we do is open a TCP communication on port 2065. If the route is in promiscuous mode and supports the DLSW it will immediately open a TCP connection back to us. Once that connection has been established we can then send a request packet up to the target router containing a list of our capabilities. If the target router likes our capabilities it will send back a response saying yeah I can talk to you. The router will then send you its capabilities. And at which point if we send a response back saying yes I support those capabilities we've exchanged capabilities and are actually able to communicate with the remote router using DLSW. Now if we're using version 1 of the protocol we find that both of these TCP sessions usually stay connected. However with version 2 one of these connections is usually torn down. So as I've said once capabilities have been exchanged we can then start initialising some DLSW circuits. But let's not get ahead of ourselves. The information that was actually given to us in the capability exchange is pretty useful. What it will return to us potentially is MAC addresses of systems that it's been configured to communicate with. It will return as net BIOS names of systems that it's been set up to communicate with. It will actually return as the version string of the router. It will also let us know if there's any service access point filtering going on. Maybe the remote router is filtering IPX maybe it's filtering net BIOS. And in the capability exchange the router will actually tell us this information. Additionally it will also provide us information about whether it supports multicasting for DLSW. Whether it has support for peer groups. It also tells us information about pacing and the amount of data that it can accept. So how can we obtain this capability exchange information? On the DEFCON CD there's a small python script that you can use to obtain this information. You'll need to use the bitvector package to actually run it. You've actually written it as extension to Skapey. The reason being that eventually I'm going to release some DLSW classes which means you can easily build your own DLSW packets. At the moment the tool actually has some static arrays in them containing the DLSW data. But once I've got a bit further with the DLSW classes then I'll certainly release them and then you'll be able to use this tool as a true extension to Skapey. Alternatively if you have a DLSW router you can simply use this to start communicating with the system. The only problem is you can't control as many of the parameters as you can do if you use your own packet definitions. So here's a quick look at some sample output from the tool. As we can see it returns us some information concerning MAC addresses, net bias information. It also returns the vendor of the device which we can see in this case is Cisco. If you find some DLSW routers out there I'd certainly encourage having a play around with the tool and seeing what it can tell you. So now we've found out some information and our next objective is to actually reach the mainframe. It might not be running on IP stacks so if we're sat out on the internet how can we actually access it? In our security model if an attacker actually gains access to our logon screen have they breached our security model? As we've just discussed we now have a DLSW tunnel that we can use because of a promiscuous mode router. That means we have a method of encapsulating our SNA data in IP meaning we can communicate across an IP network which means if you've placed your DLSW router on the internet maybe someone can get to your mainframe from the internet now. So if we want to actually communicate using SNA with the mainframe we need to know a little bit about how an SNA session is set up and we'll specifically talk about how that is set up at the link wire. Now the first information we're going to need is the MAC address of the mainframe. Once we know that we can send our LLC test frame. If we get the MAC address right it will respond back to us. We can then send an LLC XID frame and exchange identifier packet. Again all we need for this packet is a MAC address of the mainframe. Now we get to the stage where we need to actually exchange an XID. This is actually used so the mainframe can tell that we actually configured to use its services. And quite fortunately if we get the information in our SNA XID packet wrong the mainframe can actually return us some information that tells us how we've got it wrong. It can also tell us some information about how we then need to change our communication to talk to it properly. Now assuming we get this information right the mainframe will return what's known as a SAVME packet. Set asynchronous balanced mode. We can then acknowledge this packet and the mainframe then proceeds to send and activate physical unit packet. And this is essentially how an SNA session is set up at the link wire. And if you remember back to the different sessions this is the first session we talked about when communicating with the mainframe. We can now move on to the SSCP to LU communication. So how can we find out some of this information that we need to actually start talking to the mainframe? Well for a start the capabilities exchange can actually provide us with a lot of information. In our LLC packet we obviously need some service access point types. And the capabilities exchange will tell us which ones are supported by the remote system. If we're lucky it'll also tell us the MAC address of the mainframe. If not then more often than not the MAC address will actually be in a token ring format. And so the first four digits will be 40000. If we then need to perform a brute force attack to find the MAC address this actually reduces our actual scope of brute forcing. We talked about the mainframe returning information in the XID exchange that can be of use to us. If you look here at this ether real capture we can actually see a control vectors used to tell us where in our SNA XID packet we made our mistake. It can also return information such as the control point name, the network ID and the node ID. Again we can use these to start to put together our SNA XID. So just to summarize what we're going to need to communicate with the mainframe. We're going to need the MAC address and there's lots of different ways we can get that information. Again we might need a CP name and a network ID. Again there are a number of ways we can start to obtain this information. And when we talk about social engineering is this the kind of information that's protected in your environment? Usually it's not. So if we're going to start talking SNA we need some tools to actually start communicating. Now there are some commercial tools out there that enable us to do this. PCOM and RUMBER are two examples. We can also use some homemade scripts and this is a game where a tool like Scapey comes in very handy. If we can come up with some SNA and some DLSW packet definitions we can actually start putting together some useful payloads to actually start testing our systems. So now we have all the information we need to actually get a log on screen up on our mainframe. So we've achieved half of our objective. Even if our mainframe is not running an IP interface thanks to DLSW and thanks to some of the information that's returning the capabilities exchange we can actually bring up the log on screen. Now all that we need is some log on credentials. So we need to find a way of getting them. Well firstly let's talk about memory padding issues. These are vulnerabilities that have been around for a long time now. Ethernet frame padding. Etherleak in Windows network card drivers. Microsoft Windows net bias information leakage. Even recently there was an information disclosure in MySQL and onmas handshake. And this all arises from reading from uninitialised memory when we're padding packets. And this is very useful when we're looking at SNA traffic. So let's look at SNA leak. Usually in our network environment packets on the local network are bridged up to the DLSW router. So if we have Etherleak on that router we can actually start using some of the older vulnerabilities to start getting some information out. So if our routers haven't been patched what we'll find is they actually leak information from other DLSW circuits that have been established through them. You might just find someone's password in your packet. So let's look at why that happens. The reason is that SNA packets can be less than the minimum Ethernet frame size which is 46 bytes. If we take the LLC header, the transmission header and request response headers which are part of the SNA packet they only come to 27 bytes. If we look at an instruction within SNA for example start data transfer this is only a single byte instruction. So the rest of that Ethernet frame core and back to us will be padded. If we can generate lots of small packets from the target we can start to get lots of leaked data core and back to us. Again, escapee is a brilliant tool for doing this, for setting up some little scripts to basically start communications with the main frame. And then to get some packets back that have padding involved. So what you need to do is write some SNA classes. I may well be releasing some of them if you speak to me nicely afterwards I may even be able to give you a copy of some of them. And one thing that's vitally important when you're talking about communicating with the main frame. Most of the data will be EBSIDIC encoded. So if you start seeing data that looks a little bit strange try decoding it you might actually find something useful in there. So we're still on the quest for our login credentials. What happens if the router is patched against the Ethernet frame padding vulnerabilities? Well if we can actually gain access to the router we might just be able to sniff the traffic. At this point it's worth noting that SNA actually has support for encryption built into it natively. And it's had that for a long time. However speaking to people that have written SNA stacks they certainly haven't actually implemented this feature of the protocol. Therefore a large number of people running SNA will be doing so in clear text. So if we can find a way of sniffing traffic we're going to be able to get hold of the credentials that we need. But don't complicate things. If the routers that the traffic is passing through are vulnerable then take advantage. When you're examining the routers if you see ports 2065 and 2067 the router more than likely is actually running DLSW. And in the course of the research I've been doing I've actually found out some interesting little things to do with DLSW on some common routers. And let's remember that in our mainframe environment it's usually high availability. Even small amounts of downtime can have huge financial implications. An investigating actually discovered one denial of service that will actually need investigating further. Not actually had time to come up with a full advisory for this and simply haven't had the time to investigate exactly why this is being caused. But if we're able to exchange capabilities with a Cisco router and pass it some parameters it's not expecting we can actually get that router to reload. Now if we actually look in the DLSW packets there's actually a parameter called peer type. And if we start playing around with that value then we start finding these conditions actually occur. I'll certainly be releasing full details of this vulnerability but I'll certainly be passing those to Cisco first. So let's find out some other ways of actually getting hold of these logon credentials. I've come up with two scenarios. One of which is a local attack. As we'll see it's very dependent on how the architecture is set up. This is very common on internal networks that are using SNA and then a DLSW environment to pass that traffic across an IP network. So our assumption obviously is that our SNA traffic is using LLC2 at the link layer on our local subnet. This attack will actually now allow us to intercept that network traffic if the systems communicating with it are plugged into the same switch. Now initially that might not sound too great after all we're all used to sniffing traffic on a local subnet. But when we're talking about SNA there are a few little things we need to think about first. And let's look at the basic network setup that we're talking about here. On the left hand side we can see our user workstation that's communicating using LLC2 up to the DLSW router. Then the data is encapsulated as that goes across the IP network. And we're sat on the same LAN as them. So we need to be able to intercept that LLC traffic. If there's other ways of attacking the switch that we're plugged into then by all means use them. Cam table overflows or any other vulnerabilities that enable us to sniff traffic are perfectly valid. If the workstation itself is not well protected again we can attack that. Always take the easiest path. However if these aren't possible we can't revert to our spoofing the same way we would do if we were talking about IP. So what about using port stealing? That might be one way of getting this to work. But if you're not familiar with port stealing it was essentially a technique that was demonstrated a few years ago when it was back and essentially involved stealing a target MAC address on a switch. Now obviously if we steal the target's MAC address and do nothing else it's a pretty effective denial of service. But what we don't want to do is actually cause a denial of service. We want to keep passing data to that target system so we can sniff it. Port stealing was basically documented as a way that we could use to bypass static art. Potentially it could work in this scenario. The problem is the way these attacks have been described. We actually need IP to be running on our target system because we need to use a spoofed art packet to give the target its port back on the switch. In this scenario therefore there's only going to be a half-duplex attack possible i.e. from the traffic passing from the mainframe back to our target workstation because we're going to assume that that is running an IP stack. The likelihood is that the mainframe is not going to be, it will not have an IP address that's associated with its MAC address and therefore we can't use port stealing to get the traffic passing from the user to the mainframe and after all it's in this direction which the user credentials will be passing. So this is where DLSW can help us. If we actually set up a system on the local subnet with the MAC address of the mainframe we're trying to intercept traffic to we can then use our laptop to establish a DLSW connection to the remote DLSW router. In this way we're essentially tunneling the LLC traffic over IP and we're avoiding the problems that would otherwise be associated with stealing the port on the switch. As I've said all the data we receive we encapsulate and pass over to the remote router. We can now sit on that local subnet and intercept all the credentials that are passing between our target and the mainframe. So that's essentially what our diagram looks like now. The traffic has been redirected to us and then we're passing that back across as DLSW traffic to our remote router. But that's a local attack. Let's look at doing this remotely because that would be really cool. Now this attack is dependent on the architecture. It depends on the way that the DLSW systems have actually been configured. But if we find that the people setting up our DLSW network have not done it correctly they may will have put more than one router into promiscuous mode. Our DLSW environment will still operate in this scenario. However we have exposed ourselves to an excessive amount of risk. So in this attack we're still assuming that our SNA traffic is actually using DLSW to traverse the IP network. We also need to find two routers that are in promiscuous mode.  So let's look at how things look beforehand. We can see the user again on their local subnet and a promiscuous mode router at either end of the IP network. We're then connected to that same IP network whether it be a WAN or whether it be across the internet. Again if there's an easier way of getting hold of the data let's use it. If we're set directly between those routers whether IP traffic is passing let's just sniff that traffic. But if not if we're off somewhere else where we can't actually sniff that data what we can do is actually open a DLSW connection to the router at either end. Now to do this our IP address must either be defined in the DLSW configuration or as I've mentioned both routers must be in promiscuous mode. Now if a circuit has already been established between the two hosts we want to intercept traffic for then this technique won't work. However as mentioned previously the circuit will drop after about 15 minutes. So what do we actually need to do to actually affect this attack? Well first of all we need to exchange capabilities with routers at either end of this DLSW tunnel that we're attacking. If we are actually the only one who's advertising MAC addresses in our capabilities exchange then we will automatically be intercepting the data and the reason is this. If a DLSW router in the capabilities exchange sees a MAC address that is configured if a request comes in to send data to that MAC address the can you reach packet that we talked about before will only be sent to the system who has advertised that MAC address in its capabilities. I mean if our network administrators have not actually defined the MAC address of their mainframe in their DLSW router we can simply advertise that MAC address in our capabilities exchange and then when the can you reach packet is passed on to the DLSW environment that packet will only come to us. Meaning that we can then send back an icon reach packet and essentially establish a DLSW circuit. In more complicated environments where we're using peer groups there's also possibilities that we could become a new border peer. Now this is very architecture dependent and there really isn't time to go into this today. Also something to be aware of is that you can actually send gratuitous icon reach packets. The routers don't actually think to themselves did I actually send the can you reach packet and by sending icon reach packet you will actually enter that MAC address into its cache. This won't actually override the capability exchange information but it's actually telling the router that we actually know where that MAC address is. So let's look at a quick diagram of how this looks now. As we can see we've advertised the mainframe's MAC address in our capabilities exchange with the promiscuous mode router at the user's end. We can then simply establish another DLSW tunnel with the promiscuous mode router in front of the mainframe. We can then establish another DLSW circuit with that router. Now the traffic will be re-routed down the two legs of our DLSW tunnels rather than across the original path meaning that we can intercept all the traffic. Just once like caveat to this, if the administrators have actually defined the mainframe's MAC address in the configuration on the router essentially we come down to a race condition. The promiscuous mode router in front of the user terminal will send the can you reach packet to both us and to the legitimate system but if we can get our icon reach packet back first we're the one with which the DLSW circuit will be established and again the attack can proceed. So essentially now we've come up with a number of ways that we can actually achieve our objectives. We've actually been able to communicate with the mainframe, access a logon service and we've found some ways of being able to gain access to login credentials. I'm sure you can imagine how dangerous that is if we've actually intercepted the communication of administrative logon to TSO. So how can we protect against some of this stuff? First of all there's some technical recommendations and as you can probably imagine the fairly obvious one is don't use promiscuous mode. Even if we have to define 15 IP addresses within our router configuration that's certainly a lot more favourable than people messing with our DLSW environment. As we've also seen, explicitly defining the MAC addresses of the mainframe in the capabilities data is also good. Also if we can actually use path costs, use the lowest possible path costs which means that if the router ever has a choice as to which path it's going to take when it's establishing a circuit it's always going to pick with a legitimate one. And then we need to start looking at ACLs to start protecting port 2065 and the other ports associated with DLSW. Whether that be filtering on firewalls or whether it be router ACLs. And again, try and protect the information that's passing across our network. Cisco actually had a paper on their website about how to use IPsec to protect DLSW traffic passing between their routers. Again, take every precaution you can. And that comes down to using end-to-end encryption for the data. Now we might find that if we're using SNA this isn't possible. So this is where we need to start looking at the actual requirements for our network looking at the sensitivity of the data and understanding the implications of the protocols we're using. If we need encrypted data why not use SSL and SSH support on the mainframe? Why continue to use the older protocols? You may need to continue using these SNA applications. It may not be cost-effective to migrate them and therefore IP might not be a solution. But it's always important to understand the risk you're exposed to. Again, just because these are high-value environments it doesn't mean we shouldn't patch things. Particularly the routers. We've already seen how old vulnerabilities to do with Ethernet padding has enabled us to sniff the credentials out of the actual padding in the packets. If we're using an SNA gateway we need to make sure that's hardened. Out the box Microsoft's host integration server is not the most secure system and we can certainly pull off a lot of information about its configuration. And let's look at the recommendations at a high level as well. This is where it comes down to looking at what you're using on your network. Understand the strengths and weaknesses of the protocols. Do they support host authentication? Can you use encryption with them? Are traffic redirection attacks possible? We've obviously demonstrated some traffic redirection attacks with SNA here. But remember, up spoofing again is another attack against IP. So understand which vulnerabilities apply to which protocols and understand how to best protect your network. Then deploy an architecture that actually meets the requirements. Make sure that you can maintain who has actual accessibility to the services on your systems. Make sure that patching can go ahead without causing disruption to users. Keep monitoring for suspicious activity. And make sure that your sensitive data remains private. And when you're getting these environments tested, make sure the testing's thorough. If you have pen testers that come in that just know about IP and you ask them to start looking at your SNA traffic, then they may start to panic a little bit. Make sure that you ask these guys some questions before you hire them. Make sure they understand the technology. Make sure they can communicate to you the risks that you're exposed to. And most importantly of all, make sure everyone within the company is talking to each other. Make sure the mainframe guys talk to the network guys. Make sure they talk to the desktop team, because if they don't, then there's going to be vulnerabilities that are exposed. If you want a security function, use your influence to actually bring these guys together and actually be proactive in making sure that security is being improved. So after all this, are we safe? Or maybe not. There's a whole lot more to be done here. There's lots of SNA stacks out there. I've certainly not got access to a mainframe and therefore I can't test these at the moment. I'm sure that once you start delving into the actual handling of the SNA protocol itself, we're going to find some vulnerabilities. Maybe someone wants to write a DLSW stack for Linux or for BSD. That would be really cool and would certainly help us if we're actually pen testing these systems. SNA type of service handling. I haven't even touched on that. Again, that's another area to look at. Something else I've talked about, host integration server. Network for SAA, which I do not believe is supported anymore. Basically, SNA gateway systems. There's a lot more work that can be done to actually determine any vulnerabilities in those systems. Again, peer-to-peer networking, APPN and APPC. Essentially, we have an entire method of communicating using peer-to-peer protocols between systems on our networks. There's a huge scope for attacks in these areas. Coupled in with that is then secure configuration of VTAM, making sure there are no unused definitions in there. Again, we need to look at how to actually investigate those configurations and make sure they're in line with best practice. As an overall summary, we really need to make sure that the topology and construction of the network are known to us and what the risks are actually exposed through that. As we've demonstrated today, there are weaknesses in the technologies that are used to access mainframes. Make sure you understand what they are and then put measures in place to mitigate against the risks. It's good information security practice. Now, a request for help. I don't have access to a mainframe at this point. Hopefully there's a few people that do. If anyone does and fancy getting involved with some of this research, then please let me know. I'd love to talk to people that actually run these mainframes on a day-to-day basis, that actually run these networks and are facing these challenges. As I've said, there's lots more work to do and I'd certainly love to work with other people in this subject. So certainly give me a shout if you're interested in doing this. Now, references and further reading. When I was actually investigating these technologies, it was made somewhat more difficult by the fact that a lot of the books that are out there on SNA are no longer in print. But if you search around, you can certainly find them. If you go back to the RFCs, you can find out some more information. Cisco have a lot of information on their website about DLSW and also about how Cisco routers can be used in SNA environments. So that's it for me. Any questions that anybody has? It's on. You mentioned in the presentation that SNA has inbuilt encryption capability. Do you know why people aren't using it? I believe that, I mean, the information I've had is basically from some guys that used to write SNA stacks themselves. And they just said that the applications that people were running for which they were commissioned to write these stacks simply didn't want to make use of it. And that was pretty much what their answers were. Other than that, as I said, I've not got a background in IBM so other than that, unfortunately I'm not sure. Thank you. Okay, thank you very much.


It's a tradition that was introduced to us by everyone's favorite friends. It's called Friendsgiving. And now the idea of celebrating Thanksgiving with friends is spreading like wildfire here at BU. The sensation of Friendsgiving has spread around BU because everybody makes such good friends here that it's like their family and Thanksgiving is the time to be with your family and share it with those you love. I personally love my family and like having a Thanksgiving with my family. But to be totally honest, the actual meal was kind of anticlimactic because I had already had a Thanksgiving meal and it's just as delicious here and the company is just as good and the drinks are flowing just as heavily. So it's a great alternative. Friendsgiving might sound like an ambitious alternative to mom's home cooked meal, but a team effort and multiple contributions inevitably lead to an impressive array of food. There was dessert like apple crisp and a pumpkin bread pudding, I believe it was. And there was also cranberry sauce and turkey, mashed potatoes and squash, green beans, butternut squash, a salad, stuffing, that was pretty much it. It exceeds everyone's expectations every time. It's been very successful, somehow the turkey comes out and it's cooked and it's not undercooked and it's not dry, even though none of us have cooked a turkey before in our lives. And the stuffing, the mashed potatoes, the squash, the desserts, they're literally everything on the plate this year was a home run. This unique holiday tradition gives students the opportunity to truly acknowledge the friends they have chosen as their family here at BU and it's safe to say that everyone is thankful for a second Thanksgiving meal. Thanksgiving is nice because you do realize how thankful you are to have family, but especially at school when you're away from your family all the time, you have to take the time to appreciate your friends who are your family at school. So friendsgiving is a perfect combination of doing that. All you need is a kitchen and a few good friends. Reporting for BU News Service, I'm Monica Aktar.


ast um having a partial closure of the street that would keep it open to local flow at certain times and it would might be nice to see both of those flushed out um and you know have have another conversation like this where people could actually give feedback on specific proposals as opposed to these general concepts sorry did you say potentially come up with um some options or like a couple of plans is that what you're saying right two I mean you know at least two options at least that's what I'm hearing I would cluster the two the discussion into one of two groups um you know obviously leaving it alone doesn't require a plan um but there's two plans really on the table and it might be nice to have those flushed out and then have a final discussion about this oh just point out to you there is a third possibility would you be simply to uh allow the parking lots along Minden like we're doing everywhere else and still have lane traffic and access waiting so so that's also you know I think we probably you know there's really the way it is there's two parking lots only there's two partial closure do full closure or maybe time closures uh so I think there's probably several choices right I wouldn't see the full closure as really an option other than you know with with some timing element because of the deliveries and and parking issues that we discussed right well when I am when I say full closure I mean assuming we can accommodate I think the church street gets resisted at times so right um Lauren um yeah I like the idea of having options and um it would also be really helpful I think to get a sense you know raised earlier maybe by Andrew like what is the vibrancy what is this gonna look like um and we've heard from you know from certain people I'd be curious how many folks think they would you know describe it like it's and the pain that we're in the drain and out every day you know when the businesses are going to do this what might it look like they think they would take advantage of this outer space would um sweet Melissa's and um lane industry and plan to put tables out if we do this or is this you know for the park conversation that we're very much like let's let them decide where and how they want to take advantage some more flexibility um we anticipate that if we did this people wouldn't want to take advantage are we creating something I like the idea and I would love to move forward with it but that was just a piece I didn't hear tonight and it'll be helpful to know this and yeah you said you had talked to a couple of them so maybe people have answers to um to some of the the the interest in taking advantage of this kind of opportunity go ahead I just gonna um maybe it's just like missing all in person so much but if we did less out those three ideas uh would it be possible maybe just have a socially distant walk down the street before we need to get over this on Wednesday I just felt like you know uh when Jack and I went down it made it a lot more real just like seeing the spaces and how how everything would fit so I think it might help guide our decision if that was a possibility just do a quick walk for some time before Wednesday yeah I'm just cautious this was another one that you know we'll shoot for next Wednesday but I'm guessing I think it's gonna be tough I'd also invite um Bill certainly but any counselors who wanted to come to a business association meeting or we wanted to hold a special meeting for for a mainly street specific businesses uh and I know it can get treated with your council meeting stuff but maybe one of you can come in or three of you can come well theoretically would you be meeting with them next Wednesday anyway yeah we have two now weekly meetings on Wednesday mornings one for restaurants and food service and one for everyone else so I'm trying to navigate Connor's request there um I mean so so um if uh so Dan if you wanted to have or shop some options around to just like the street or state street related businesses um uh really let us know when that's happening um and then um Connor do you want to kind of lead it to you to uh uh if you find a time that you think might work for a walk you know we can maybe warn it and have it be a no no agenda sort of meeting does that make sense I think we can probably do this like socially distance right yeah I mean so realistically the only item that we on the agenda next week would be mass honestly speaking I mean we might get the other stuff but so we could maybe at six and walk down the line to see if we'd be time to get back to you there fair enough sorry I gotta I oh yeah go ahead I mean I mean just just to be on the same side we could all bring our mask in case in case yeah keep this seat six feet it might not be practical you might try but it might not be successful I would strongly recommend that yeah yeah you'd strongly recommend wearing masks it's a good example yeah yeah 100% sorry my internet is becoming kind of uh slow so I'm sort of losing good pieces of people um so Bill were you suggesting that that could be in conjunction with next week's meeting it just seemed like a time that everyone had already set aside so yeah yeah okay um meeting first going out after all the eating is a lot of traditions well we can still do it I think we're probably good takeout so well uh I was gonna take you to debate masks but it starts at 6 30 and it's June 3rd and I guess it will still be light after that it's over yes um I don't know what's up you can do before or after you can start at 6 you do like to do them in the back except that people want to go to their homes yeah yeah I guess I'm not that worried about it maybe let's let's just meet at 6 30 we'll talk about masks and whenever we're done we'll we'll head down there um the way we have to make sure that people have time available ahead of time okay um all right so we were talking about the possibility of making a motion to yeah I'll make a motion um that redirects the staff to develop um option plans for uh closing Langdon streets um along the lines that were discussed this evening um giving the council options I'll second okay any further discussion um and there's no no one from the public who wants to make any further comment Cameron I don't see anyone okay okay um all right uh so all in favor please say aye opposed okay all right so um great that carries so we will follow up with that uh at hopefully our maybe not next week but hopefully the next regular meeting um so I just want to be fresh at the time it's 9 30 and we have yet to go through the city reopening plan um as well as the ordinances our chapter 13 ordinances as well as five home far away I'm anticipating that we will probably not get to at least one of those things not two so um uh how much more is left in the city reopening plan I know there's that chart with a lot of like the phase one stuff I assume did you want to go through that more in detail or what's your what's your thought on on that well it's up to y'all and sort of if you felt like you were able to review it in any um uh real way we could also put because it's um COVID-19 related if you want to wait to go over it until next week we have the special meeting that will also be fine if you don't want to go through this in detail but what it really is is asking um for your approval for how we want to start reopening our facilities and our services once we get our our staff to pass you back in July so if you want to take more time to look at it or want me to go through right now that that's I I'm either way um jack go ahead and this all uh notice we're starting July 1st right that's our proposal so that's something that I think we could put off during our next meeting we want to do that speaking of our next meeting sunset on june 3rd scheduled for 8 29 p.m so perfect um Donna question would this stay in place if we end up financially not being able to bring back everybody that's so um that it does address that um it says that our current plans have our employees who have been for a load recurring life first um but that is subject to budget needs and employees returning may be delayed until July 30th so the date of our phase one reopening plan will have to depend on the return of staff but the city's goal is to have it by July 1st and if our budget goals so it is dependent on on staff being there so July 1 July 30 okay I did read that in the sheet but I'm still left with if we're asked to approve this before we really know what our financial ability is seems so awkward well maybe that's another reason to um delay on that um topic um so I think it makes sense to put that off from now and I see that um Dan Dickerson as well as Alec Elworth are online and um I'm guessing that they were waiting for um either chapter 13 or five home far away probably chapter 13 um uh the ordinances um Alec or or Dan um any thoughts on what you're sticking around for chapter 13 chapter 13 that's what about and um Alec I assume you have some thoughts on that as well uh yeah either or both whatever you get to okay well we've got um about half an hour before I'd like to be done um I as our people okay with continuing on with um chapter 13 okay I'm seeing it's not this is great uh all right especially since this is one that we have um put off a couple times so this is a second reading um and it includes a lot of um what's has it changed from first reading uh either bill or camera and you want to um talk about this at all yeah I think um although we're going to quickly balance it too I think park folks you all have looked at it a couple times made your changes have shown and we actually delayed the last time I requested park's mission because they wanted to go through and mix medicine they're suggested they've been provided we staffed and have any concerns with them and so they're here drafted for you um your comments as well as staffs say the only thing that um okay um I would ask park to do one yeah yeah yeah um Alec or Dan would you like to make comments on the chain potential changes to this chapter I'll go ahead and go um do you should I share my screen so you can see the the parks with the language or do you all open in front of you um I've got to open unless yours is different from what was posted online um no it's not okay then I think you're gonna assume that we've that we've got it but you can really reference the different parts and we'll try to follow you okay okay um so I think big big picture you know we saw an opportunity considering the fact that um this language hadn't been changed since 1992 uh crafts a park ordinance that was inclusive of all the parks that we now have and in month earlier um so currently you know the ordinance only pertains to Howard Park and Summer Street Park um we have a lot more than that now so I think that the number one goal for the park's commission was to craft the ordinance in a way that you know we ensure that um the provisions that we want there uh relate to all the parts not just two of them um so that was the big picture thinking but we did see some opportunity to add things that weren't there that you know uh we thought weren't overly controversial they were pretty um they made a lot of sense within the context of parks and so we're hopeful that you know ultimately the city council supports them um but I'll just walk through it quickly um you know in and I'll go through the the portions of red but relating to the curfew um we wanted to be 9 p.m. dusk and and 6 a.m. we're done just so that you know during the summer um when there's more light people could could use the parks uh more readily um and oh sorry I'll go back um we decided to rewrite section 13-500 as a section that pertains to all parts of month earlier and then further down you'll see where we think about Hubbard North Branch and Summer Street um so going down for fires um Hubbard Park already had a fire provision so we just said it must um you know reference elsewhere or authorized self-refires were created in the parks um for picking or ensuring the plants um we wanted to add Fun Guy um because I think Alec might have said that that's been a problem in the park in the past um and then we wanted to add that you know people could take plants that's authorized by the parks and tree staff because we obviously want people to take uh bases when when their um events are volunteer groups that are there to do so um and we want to say and then additionally we wanted to make it okay to pick fruit so I'm going to tend to drink the plant um we don't want people to do some plants um any plants and less authorized by Park Street staff uh we don't want people uh messing with wildlife we don't want people smoking in parks this is the one area that we thought could draw some I guess concerns just because I know a year or two ago there was discussion about something like that downtown um but we we thought it was important that uh people not be allowed to smoke parks and I jumped in and asked question um on the on the smoking provision to you um did you write that so as to uh can include vaping do you think device containing tobacco or tobacco product meaning vapes vaping? um I think so um but the I drafted this I modeled after some existing language in in city code that actually paints to park but the issue that I was concerned about and sorry and it references state law when it defines uh tobacco tobacco product tobacco substitute and then we added um regulated drug uh oh actually there is one addition that isn't in this language and that's um stem sort of email that dill sent asking um I think he was sort of hinting at whether we wanted to ban marijuana usage and I think that state law already would ban it because um if you could only use on your own property um but I wasn't clearly sure and so I had suggested adding regulated drugs since marijuana falls under that so that way it's clear that I think you don't want people you're right that was what I was asking and I think the real issue was what's the you know what's the public need is we just don't like the smell of cigarette smoke we don't mind you know is it smell is it the fire risk is it the health risk so you know we should be consistent with everything that falls within that category wasn't picking on certain substances as much as what are we trying to accomplish um I mean I think I won't speak to the entire park's mission on this but I think for me it's everything you just listed I think it's fire risk um I think there should be um a public space where people don't have to potentially um smell you know tobacco or marijuana smoke um you know I think people go to parks by and large to recreate and so when you're inhaling smoke it sort of diminishes the the positive impact of recreating um so I you know personally I'm not opposed to people smoking if they want to do it they can do it um I just I don't want to be in parks any parks or a place where um if there's going to be one place in the city where um people don't have to worry about that I think the number one place is parks and I'm sorry uh counselor I forgot what your question was and I don't know if I answered yet oh you wanted to definition of weather bathing um I think it's captured because I think you know in my time working for the legislature this definition has been employed with and so I think that they've they captured it but I'm not a hundred percent sure thanks um so let's see going down and then this is the other potential pot topic and I think it's probably more for us than for city council but I think it also impacts council and this is relating to domestic animals uh we just wanted to make it clear that when people bring their dogs into parks that if there are any park out there didn't cover well actually if there are any park they should be following the the city dog word that's known if they're in public they should also be following and in compliance with the uh they can go to find us so if the dogs are off leash they should be under you know their owners control um so and then we we didn't want any other domestic animals to be brought into parks um so we we don't as much as we love cats and and ferrets and other creatures we we didn't want people walking them through the parks um going down Hubbard so they're um I'll run back up really quickly uh the sections pertaining to firearms, destruction, littering, disturbing peace um I think all three of those currently fall under Hubbard and under summer street and so we thought it would just be useful to move them up and have them pertain to all parks without changing them so you had another question? Yes um it with domestic animals uh does anyone ride horses in the parks in Hubbard park and we just voted that not that I've ever seen but I would defer to Alcon hat maybe he knows I never encountered a horse in any in any of the parks and I'm not sure it's a domesticated animal um yeah it was two two one ounce for me okay thanks in the in the um animal control ordinance there is a definition for domestic animal and I'm pretty sure we're just following that um but in any case I you know given the nature of a lot of the trails in our parks um you know what they are generally and how we're just now beginning to experiment with um with a lot of non-biking in the north ranch park uh I would say I would be just inclined to allow horses and in the parks just because the moves um get impacted trails especially during wet periods um but it's certainly you know I think if somebody we're interested in that in the future it's certainly certainly conversation that we have as a park submission um but at this time I'm not inclined to allow it um so going down to Hubbard park um there's uh so we as far as allowing vehicles um or motor vehicles beyond park roads um we wanted to allow for the law enforcement and emergency services to to access parts of the park as needed if they needed to ride in you know an AT or something to get to someone I will say there's one substance change that you will not see and there's there was um under the motor vehicle regulations that's a provision pertaining to snowmobiles and that people wouldn't be allowed to snowmobile on Hubbard park except on trails authorized or as authorized by park submission we decided to remove that we don't people snowmobile in Hubbard um but you will see further down where we've inserted a provision for North Branch that we've put that back in because um I think there is one trail in North Branch that is so used as a secondary fast access trail or or primary um and then yeah that's really it we've we added North Branch as a separate section um you know one thing that we talked about suggesting was uh you know multi-use trail language but we thought at this time because we're just now experimenting with it it's better if the park's mission has some flexibility to to write our own rules and that if it becomes a problem then you know we can consider the code as um you know another alternative but that's where we landed on that um and sorry that was long but thank you for your consideration yeah thank you thanks for sticking around through all this um park is in the park park is in the park that's an underdog I don't know it's a new new territory there um so I have one question which I think is probably the question for Alec um I think at one point I feel like that we had talked about having a provision for um either aging trees or highly sensitive trees um and that's not in here that's fine I don't want to hold this up I just want to flag that as something that I'm that I'm still interested in anyways like how are we protecting um uh sensitive aging trees moving forward yeah um there is an urban forest management plan coming your way you know relatively in your future so stay tuned for that and and there'll be some things things about those trees in there and and maybe you know maybe ordinances is not the right place for that and it's in a in a plan that works that's great um okay any other questions Connor I think I don't want to go first uh Lauren um just on in this section um age for wildlife I I think it's fine I was just curious I feel like there's like pretty commonly used language and wildlife law um mostly about threatened or endangered species but that you know just pulling up the definition of how they describe like pursuing shooting hunting killing is just like more descriptive and acts that create risk to injury um like placing setting dry for using this to take animals just just a series of thinking of I think you capture the sentiment and it's it's fine but sometimes we try to be consistent with other state laws or practices when we're using our language so if you put if there's any thought around the words that you chose um actually there there was we added a few words over the course of our discussion our last meeting about this language um so release was new antagonize was new um you know we we tried to capture everything that someone could possibly do that would negatively impact wildlife but you know I uh this was this whole thing was something that I've together at late one night last week and so there were some places where I knew that there was a law elsewhere or something included elsewhere if there are other places that I honestly had no idea so I would happily defer you know if there was better language of living wildlife um I would have include that or have it be included or have it be considered but I you know I was just trying to do the best I could getting every starting yeah totally appreciate that and I think it does get at like the only thing that you sometimes see in other wildlife statues are kind of intense you don't have to actually injure it um and you know antagonize kind of gets at that but like doing something like setting a trap that if nothing's injured or killed under this I don't know that you have captured it um or um what was the other piece of it um possibly less um yeah I think I think everything else is pretty well covered um you know I think they just are a little bit more descriptive and what they mean by antagonize so things that people might not you know is that is that a more subjective word to some people like I was just interacting with what do you mean antagonize we were having fun together do you I mean Lauren do you have any specific language I said send the languages from our own Fish and Wildlife Department um I don't know that's perfect and then really I'm not happy to move this forward as I think they did a good job getting the the intent that I can send a council in case it feels like there's anything we're fleshing out a little it's helpful it's sort of it raises the question for for me like we pass this now or is there another reading and what I hear you saying is um that we should pass it and then if there's you know we can forward some language and if if there's revisions we can include this in the next iteration of revisions is that is that sort of what I am I hearing you correctly yeah yeah I'd be happy with that I can send it around and we could always make a tweak in the future if we felt like there's something missing unless uh unless there's other suggestions that people have that we could bond together with another revision um but I wasn't hearing any necessarily yet um any thoughts on that Miller Cameron it's fine with me I think you know yeah we can always tweak that the only thing I'm going to suggest is that whatever you decide you want smoking you're clear about that even in that to the language that you want and I just know that you know the part of the firearms is existing language but I'm reasonably certain I believe we checked with the city's towns that the city actually would not be authorized to prevent the carry or display of the firearms can regulate this charge so you know we don't want to have any authority to do anything with it or just take those out so maybe there are three three things the language about and antagonizing part of the firearms and then and clarifying the firearm thing the smoking thing I think if you just want to can you do that right now that's easy just an amendment now with the antagonizing that's what I'm going to say I don't think I'm there on the smoking and I use the bar almost every day I have asthma and it's somewhat like repelling to me that's all of the trails but if I apply the same logic that I applied when a lot of us made the decision not the band smoking downtown I'm sort of coming to the same place is this you know like sometimes people thought it was a leaders best case you know when that issue came up other people said it was a little further and in the time to get sort of the homeless population out of our downtown areas because they were smoking in storefronts and everything so when I look at Hubbard Park I know like we actually have a lot of homeless population who lives up there and because it's being interpreted as a way to keep them out of there when already they have no place to go so my comfort level just isn't there yet even though personally I probably agree with this I think I might be critical to my last decision uh Donna I'm sorry I thought we already had no smoking in the parks and the whole no-smoking discussion has happened for the last two three years Connor totally unrelated to homelessness and individual smoking so I think one is just a health decision to say is a healthy example like wearing your seat belts that we don't have smoking in public places as much as possible almost strictly our parks and like our playgrounds so I I feel it's important we keep that message of not having smoking in our parks if if I may um there there is language in the code um pertaining to smoking but I brought it up as an issue um to the parks commission in that uh it's basically the same language except um it notes that uh I thought so it says no person shall smoke or hold or possess any lighted cigar cigarette pipe or device in tobacco or tobacco product or tobacco substitute within or on any park field or recreational area owned by the city which is conspicuously posted with signage for hitting smoking and the area that concerned about this is it sort of reads like if it's not if there's not signage then smoke away and you know and if the intent was for there to be a smoking ban then I think it should just be an outright ban and not have this sort of confusing language at the end and so there is language in the code um you know I don't know if the intent is that smoking ban period in parks and fields or if it really does pertain only areas where there's signage but we want to build on that just say uh no smoking so there's language in code if you chose to not accept what we propose I don't think you leave the end of the world um but you know we thought that we should just make it clear I actually like your new language and expansion I just want to mention that it had existed previously thank you for the clarification Dan um uh go ahead Dan sure I I think I agree with Donna on the smoking issue but I don't have much much to add I would my preference would be to pull out some of the language about the firearms to the extent that we can't enforce it only because I get it invites us a challenge to have that um forceful language in um and I had one question I had two questions one um how do we define dusk and dawn um if those are the new alternates and I presume we're not looking to you know please somebody who gets there five minutes before but it does strike me that both terms are somewhat more nebulous than the very fixed hours that are in existence now um could could you sunset and sunrise those are theoretically definable points yeah I think those might be slightly more fixed points but I think you know I'm also not I'm not opposed to that idea I just think that those are difficult to pin down you know it's that at that you know one man's dusk is another man's uh nighttime um I just wonder if if and I don't mean to hold it up on this but it does seem like something that could be fought over if the purpose is to sort of keep people out from more broad times which is you know somebody's there at midnight or somebody's there you know at 1am um but it does it does strike me that it could have sunrise or sunset might be a slightly more more assignable time because those are as somebody pointed out those are times that are actually set by a clock well and actually um I just want to point out that the language as it is right now says not between the hours of 9pm or dusk each day whichever is later and 9pm will always be later because the the latest the day goes as the equinox not the equinox the solstice in june and the the solstice is the sunset is 838 um so that's yeah I mean either it's dusk which is nebulous or sunset which is 838 um and yeah I don't know I've looked up the uh the sunrise yet um but anyway it's a little so um yeah is there anything further on that Dan and then Jack why just I guess I'd ask Alec or or or Bill if this is an issue that that you guys have are wishing to address or having that little flexibility you know that that someone would be there it's why like after uh after the sun goes down is is okay um and that's what you're trying to gain and Alec from the parks yeah if it's not an issue for it to be like in my mind okay I and I'm I'm perfectly fine with that sorry I mean to cut you off Dan if you were um you know the only thing I think broadly as far as the curfew the big concern from you was you know if people are in the parks when it's dark it makes it more difficult if there's an accident makes it more difficult for someone to get to that individual um so that's the idea I guess behind the curfew and you know the dusk and daunting was in addition to a late game how it was just with the intent to you know during the summer when days are generally longer to give people more time to access the parks um you know we didn't really have a great way of of sort of broadening the 9 a.m. to 6 a.m. without saying you know except during the summer it might be 10 a.m. to 5 a.m. but so we were trying to simplify without being too I don't know without being unclear I wouldn't be heartbroken if this was moved to sort of move this far you know I know it's late and you guys don't want to be talking about this any longer um but that was that was the intent was just during the summer to give people a little more time yeah and I'm really fine with that ambiguity um as long as your company you guys are comfortable with it I don't have an issue um and then I'll add another small question but I'm just gonna wave it off so we can move along uh Jack and Donna I'll just point out that uh although the drafters may not have been aware of this dawn and dusk and twilight actually do have defined that defined meanings uh civil dawn civil twilight occurs when the sun is less than six degrees below the horizon in the morning civil twilight begins when the sun is six degrees below the horizon and ends the sunrise in the evening it begins the sunset and ends when the sun is reaches six degrees below the horizon civil dawn is the moment when the geometric center of the sun is six degrees below the horizon in the morning civil dusk is the moment when the geometric the center of the sun is six trees below the horizon of the evening. So for any given date, one could actually look up the time of a civil twilight, civil donor, civil dusk. I don't know if that, people went honestly with those terms of forces just sunrise and sunset, but I don't really think they're at a use. I'd be happy if there was a reference added to the language to whatever resource you just read from. Before you go down, I just want to note that I feel like I'm hearing a number of potential things to be cleaned up about this and I think we're going to need to make a decision as to whether we want to approve this now and then talk out further visions or have a third reading potentially. Or not at all. Dona. I was going to propose we have a third reading and that we get language from Lauren, language from this and some other things and tidy it up before we pass it. Second. As long as we're in that mode, I just noted that in section 13 319, it still includes Jack's name and Dan's name. To be forever memorialized. I was hoping to get into the ordinance. Lauren. It is two other really minor things in 13 318. Unnecessary apostrophe and trees. The other one was like slightly more substantive though. There's still a specific in 13. Like a specific date and or day of the week and time for meeting. And I thought we had that. We would just say like. The only monthly or something like we don't need to put that in. Okay, so just flagging that still in there. Yeah. We agreed to just make it more flexible for them. You can call. Okay. So I think we're going to have a motion for third reading. I did because I feel like there's a lot of edits we need to send into our staff and get it cleaned up. And I think it was seconded. Yep. Okay. Any further discussion. Okay. Please say aye. Aye. Okay. And. Okay. And. Okay. Okay. Okay. Okay. Okay. Okay. Okay. I did because I feel like there's a lot of evidence we need to send into our staff and get it cleaned up. And I think it was seconded. Yep. Okay. Okay. So we'll have some more language there. I think it being 10 o'clock, we are going to put off the five home for my discussion again. I apologize. So I can, I can quickly report. In the anticipation of this meeting, I did receive communication from Karen Freeman. I'm not. I was in the conversation board. And, you know, I actually hoping we can get all the stakeholders together before tonight's meeting. This was yesterday, but we have a meeting next Tuesday with. The more controller the corners. Everyone. Preservation trust. Okay. Okay. Okay. Okay. Okay. And then bring back those results to the council. And. Not have us to take position yet. Great. That makes sense. Okay. Yeah. I talked to your. Jamie. I was going to talk to the general office bill. You may want to look him in on that. He's, he's part of the general office for the nonprofits. And he was already aware of the situation and. And. Suggested that he wanted to be a part of any sort of global conversation. Okay. What's the last name. Okay. Okay. Okay. Okay. Okay. Great. Council reports. Order that we would have gotten. Donna. Where are we in person? Well, I want to start off with, I really want breaks. It's not only my ladder, but I need to get up and walk the city. So long in this chair, which is not nearly as comfortable as my council chamber chair. So please. Break in no matter what. You even forgot the break that you were going to do. I know. I know. But. And also just. I want to buy capital calls at the end of the day. And there was the whole share of family out putting out their Park. Putting the flowers out. It's looking good. So thank you all for supporting that. Great. Super. Connor. I hope they had it together. We both got an email out there, but. Talk artists projects. People like our spaces for some talk drawings in town. It's like a really, really cool project. I think. Is there someone on the wedding?  But, uh, So that would be cool too. Right now. That's it for me. J. Yep. Just a reminder. For everyone that Saturday is. New day for.  And thanks. For making it happen. And also to the folks at public works. For being flexible. And, uh, Supporting that effort. Despite the delay. Thanks. Great. Uh, Dan. Yeah, I had a couple of feedback from constituents. About some, some noise. Apparently there was a motorcycle incident. Where they were revving up their engines. And so, um, Obviously this is something that the. Single incident is not going to be able to be police, but I think we have to, we have to be aware, especially with people who have been cooped up and may not have. Um, Areas to go that we're probably going to see a rise of, uh, Complaint. Neighbors or people coming through neighborhoods. Um, As everybody sort of gets out of their winter hibernation. We're probably going to see a rise of, uh, Complaints between neighbors or people coming through. Neighborhoods. Um, as everybody sort of gets out of their winter hibernation. Party. Party annual. Okay. Um, Jack. I'll pass. Lauren. Um, I was hoping to, uh, throw out there was, I would love to maybe one of the upcoming meetings, um, update from John on what's happening with our, John Odom with our elections, knowing that they're looking different this year. There's a lot of conversations. John did a great job on, uh, PPR, uh, talking about some of the issues and how, um, I'm feeling is addressing it. So just something to be great to have all of us kind of, I don't understand what that's going to look like. And if we're going to need, you know, what accommodations that the city and looking for volunteers and maybe different ages and stuff, but, um, Nice job, John. And look forward to talking more. And then that's it for me. Great. And I assume since John turned off his video, there's nothing to say about that right now. Um, Yeah, I mean, it's, there's what the state's going to do. That's already sort of a plan underway. We'll see how it shakes out. Legislatures is taking control of the reins on that. There's also something that we might do separately. So John, is it fair to say that this is a topic worth discussing? Um, And out of your meeting. Yeah. Um, I mean, it's, there's what the state's going to do. That's already sort of a plan underway. We'll see how it shakes out. It looks like legislatures is taking control of the reins on that. There's also something that we might do separately. So it's probably worth talking about. Great. So we'll put that on future agenda item. Um, for myself, I just want to let people know that, uh, we, uh, With the energy information ordinance group. Uh, found a grant that was pretty large and we're hoping to have the application ready to go. Uh, for, um, Tomorrow, actually. Um, but with that in mind, this is something that potentially could be brought enough that we could be looking at, um, funding of even like a position. Yeah. Even that could potentially help with, uh, Energy planning for the city. So, um, we're going to try to, um, Work that into the, into the grant for tomorrow. I just want to be aware of that. And hopefully, um, There's no objections. Um, but if you do have objections, let me know. Um, but we're going to work to get that outdoor tomorrow. Um, and then we'll see. So. Any, any comments on that? Okay. Great. Um, And it is also, I should say to, to support, um, potential implementation of any, um, Uh, energy information ordinance. So, um, That's, that's also very much a part of it. So, um, All right. Uh, anything from John. Yeah. Okay. Uh, Bill. I didn't really think. I have a quick, I get a session. Also thank D. B. W.  For getting the answers up the high school seniors on. It's great. It's wonderful to be able to honor us. 2020. And, uh, I had a reason to go through several towns over the weekend. To see how they honored their graduates. And there were many different ways, but none is. Not fully understood downtown. So this is definitely the most impressive. Yeah. Uh, great. Um, All right. So that concludes our regular business. And we do have an executive session. Um, on the agenda. Um, Bill, I still assume you would still like to do that. Yeah. Yeah. Okay. Uh, Jack. Pursuant to one. Section three 13. Okay. I move that we go into a second session. To discuss, uh, The employment or appointment of a public. Officer or employee. There'll be no action coming out of it. Second. Uh, Favorite. Hi. Hi. Hi. Lauren. Did you have a question? Are we clear that we're adjourning the public meeting? Did we do that? No. Great. Okay. So then we'll hop off this call and get on to the session call. And for everyone else with the public on the hall, I'm going to assist it for everyone. Thank you. Thanks.


Hello, my name is Jeff Mann and I teach economic geography and political economy at Simon Fraser University in Vancouver, British Columbia And I want to invite you to attend and engage with INET's new climate debate series. At the climate debates we'll be discussing a whole variety of really important issues, the role of economics in addressing climate change, the role, if any, of green finance, so-called green finance, international arrangements and institutions that might help us address or not help us address the issues, the relationship between US and China over climate and climate change, climate justice and just transition, an enormous range of issues will be addressed. And the importance of these questions can hardly be overstated. Massive climate-induced disruption is already underway in many parts of the world and accelerating across the globe. We desperately need collective mechanisms and processes to adapt, to mitigate or to address climate change in any way at all, urgently, we need these institutions. To register to attend the climate justice conference, go to ineteconomics.org for more information and please join us. I really encourage you to listen in and this debate is promised to be an excellent event.