Okay. So I'm Jan Horn from Google Project Zero, and I'm presenting slides that were prepared together with Paul Kochar, Daniel Genken, and Yuval Jarom. And I'm speaking on Spectrum Meltdown, how you can leak data out of speculative execution. This work involves a lot of other researchers. So for Meltdown, there were Werner Haas and Thomas Presser from Cybers Technology, Daniel Groß, Moritz Lebsch, Stefan Mangardt, Michael Schwarz, Anders Vogt was credited by the other researchers for early contributions of ideas, and Mike Hamburg from Rambos was also involved. Okay. So, basic outline, I'm first going to present shared concepts for the attack variants, then I'm going to give an overview over the three variants and then explain, give a little overview of how each of the variants works. Okay. So, basic recap, there are covert channels in modern CPUs, and in particular I'm going to look at the cache-based covert channel, which is that basically the pattern of memory accesses you perform affects the state of the data cache, and then subsequent data, subsequent memory accesses have timing that depends on the data cache state. So this means that by measuring the timings of memory accesses, you can get information about the memory addresses that were accessed previously.  And here I'm just going to be talking about sudden reload, because that's the simplest one. Normally this is used as a side channel to attack things like cryptographic implantations and leaky and stuff, but here it makes more sense to conceptualize it as a covert channel. I should note that there are other covert channels, so if you want to mitigate these issues, just mitigating the cache-based covert channel probably won't cut it. Okay. So, okay, the cars are working pretty well. Okay. Basically, what are speculative execution out of order execution branch prediction pipeline and what does that mean? So basically the idea is that the processor can execute instructions in parallel and even in a different order than they are in the machine code, and that the processor can also predict branches before the target of a branch is known. So in this code example, you can in the first line see two accesses to a foo array. And if you look at the machine code, it looks as if the CPU would first load the value of the first value foo array at index one and then load the value of foo array at index two. But memory accesses can have quite some high latency, and so the processor can perform these two memory accesses in parallel more or less so that the total execution time of this first line goes down. Then next we can see that there's a branch where depending on the result of the expression in the first line, we're going to either execute line two or line four. And again, there could be high latencies both in line one and line two. And so the processor can predict that we're going to be executing line two even before the condition in line one has been evaluated. And then the processor can go ahead and even do the third memory access in parallel together with the first two memory accesses just to make things even quicker. Okay. So of course, this can go wrong because we can predict that we're going to take to execute the one line and actually we're going to have to execute the other one. So that's mis-speculation. This can be caused not just by incorrect prediction of branches, but also by exceptions that occur in the middle of a series of instructions. So for example, if one instruction causes a page fault and you've already started executing the subsequent instructions, you're going to have to discard the changes made by those instructions. So this is implemented by preserving the old register states while executing instructions speculatively so you can roll back the state of registers and memory writes are buffered inside the processor core and not written back to memory until the CPU is sure that they should actually be executed so that you don't have to go back to the memory and undo changes to memory or stuff like that. But importantly, changes to the data cache are not restored because the data cache is not something that you really see architecturally when you write a normal program and actually keeping stuff in the cache helps make things run faster. So cache modifications are not restored. And this means that you get a cover channel out of mis-speculation. So if you have either a branch that's mis-predicted or instruction that actually falls and the CPU continues executing down here on the left side to the predicted target, then you have these transient instructions that will be rolled back later. But from inside these transient instructions, you can send on a cache-based cover channel. And then when the CPU has rolled back your transient instructions and starts executing with architectural control flow, the stuff that's actually supposed to happen according to the documentation, then you can start doing timings there and using those to read from the cache-based cover channel. So this means you get a cover channel out of these transient instructions and can leak data to which you have access in these transient instructions. Okay, so a quick overview of the three variants. The naming is a bit confusing because there are multiple people supplying names. So we have the first two variants that are named Aspector and the third variant that is named Meltdown. And the first variant can more or less be characterized as bypassing bounce checks and primarily affects things like interoperators and jits, although that's not necessarily all you can do with it. The second variant is an injection of branch targets and primarily affects things like kernels and hypervisors, but again theoretically also other things. And Meltdown just affects operating system kernels and software that architecturally behaves like an operating system kernel. Okay, so let's start looking at the first variant. So here we have a conditional branch where we have this attacker-controlled X that is highlighted in red that is compared to an array size and only if the X is below the array size we actually do an access. So if you look at this architecturally, it all looks fine. If X is too big, we just don't execute the second line. But if you look at this with the knowledge of the speculation that processes do and this branch prediction, then you can see that if an attacker first trains the branch prediction to assume that X will be smaller than this array size, and then an attacker makes sure that the cache line that contains the size of the array is evicted to main memory so that when the processor tries to evaluate the condition of the first line, it has to go back to main memory and wait for the memory access to finish and so on before it can actually resolve the branch in the first line. Then an attacker can use that to cause the second line to be executed as transient instructions and then you can see that here in these transient instructions, you will have an out-of-bounds memory access into the first array. So you read memory, but it's out-of-bounds and belongs to something completely else in your process. Then you multiply that with 256 and use it as an index into a second array from what you read. So this means that every distinct value that could be at this out-of-bounds position out-of-bounds from array one maps to a different cache line that is used for the access to array two, which means that later, you can leak exactly what the value was by measuring which cache line in array two becomes fast. Okay, so in practice, where's this relevant? So one interesting example are JavaScript sandboxes. So JavaScript code runs in a sandbox that tries to enforce memory safety. So you're not permitted to just read arbitrary pointer dereference. You're not permitted to read arbitrary memory, not permitted to dereference pointers, and you can't just access arrays out-of-bounds and so on. But the browser runs a JavaScript from untrusted websites. So we can try to use JavaScript to create a construct like the one we saw on the last slide. The JavaScript engine will have to either interpret code or compile it and will insert bounce checks and things like that to ensure that there are safety memory, safety, so on. But with the speculative execution, we can potentially bypass the safety checks and access memory that actually should not be accessible to us. So here's a code example of how that looks in JavaScript. You can see that it more or less looks like the code we saw previously. So you again have this pattern of a comparison, then a first array access mapping and then mapping to a position in a second array. But there are some differences. So again, we have this index that will be in-bounds to train the branch prediction and then out-of-bounds to actually read out-of-bounds memory. We again have an array length to which we're comparing where we want the length to not be in the processor cache when we're actually doing the attack so that the processor transiently executes lines two, three, and four before the condition line one has been resolved. One thing to note here is that, of course, the JavaScript JIT engine will itself make sure that we are not accessing things out-of-bounds, but we don't want the code that the JIT engine is going to generate if it thinks it has to generate this check for us. So we do the check ourselves. We do the actual memory out-of-bounds read. Both in line two and in line three, you can see these all zeros. They're just tricks to make the JavaScript optimizer generate more optimal code so that the attack works better. Here you can see that we are ending the value that we read with a constant. This serves to show to the JIT engine that there's a maximum bound on this value and the JIT engine does not have to insert its own bounce checks that might make things slower for us. Again, we have this multiplication to map the value to a lot of different cache lines depending on what the value is, and we access the table into which we're going to leak the data. And last, because this is a JavaScript engine, and JavaScript engines love to optimize things away, we're going to have to provide some output where the JIT engine can't prove that it won't be used. So that's what the local junk variable is for. Okay, so variant two. The basic idea here is we have branch prediction in the processor, and this branch prediction can both predict the conditional jumps that we've seen before, but it can also predict indirect calls, so calls to instructions where the target instruction pointer is coming, for example, from a location memory or so. And this branch prediction uses a table called the branch target buffer, and at least on an Intel Haswell processor, it seems to be indexed and tagged by a partial virtual address and a fingerprint of recent branch history. Now, the thing about branch prediction is, as we've seen, it's expected to sometimes be wrong, and this means that unlike in the case of, for example, a data cache that always has to return correct information, a branch predictor can be designed, the branch target buffer can be designed so that it can sometimes return invalid data. You just shouldn't do it too often because then you heard performance. So the branch target buffer is therefore not always uniquely tagged, and for example, many branch target buffer implementations, like in the Intel Haswell processor, do not tag by security domain, like for example, whether you're in the kernel or in user space or whether you're inside or outside of VM. So that was prior research that used this to break address-based layout randomization across security domains. So you can, for example, have two processes running in user space, and then the victim process just runs some code that has branches in it, and then the attacker code does timing of some branches and can use that to infer things about the state of the branch target buffer, which reveals where the code is located in the victim context. Then you can also do that from inside a virtualization guest to figure out where the hypervisor is located in host memory. And the new thing here is that you can also do this the other way around. So instead of using the branch target buffer to leak data from the victim to the attacker, you can use it to inject branches from the attacker to the victim. So if you can insert entries into the branch target buffer, you can cause the target context to start executing transient instructions in some implementations completely controlled address. Yeah, so I wrote a pock for this against the KVM hypervisor. So this is just a very rough overview, but basically the idea is first you start by breaking the hypervisor ASLR using the branch target buffer leak of address information as shown in prior research. Then you try to misdirect the first indirect branch that occurs after a guest exit. So when you switch from the guest back into hypervisor context and you flash the cache line that contains the memory operand to the indirect call, such that the indirect call takes a couple of hundred cycles to resolve, during which you can get a transient execution at an arbitrary address. Now one thing that helps with the attack here is that the state of the virtualization guest, the register state of the virtualization guest becomes the register state of the hypervisor when you switch from the guest to the hypervisor. All the general purpose registers state the same. Then of course the hypervisor is going to start using these registers itself, which will clobber most of them, but at least in some kernel builds you can see that at the time of the first indirect call, you still have control over like four registers, which you can use to get more control over what the code you're misdirecting execution to in the hypervisor will actually end up doing. Also, guest memory is mapped in the hypervisor. So while the hypervisor and the guest don't share their virtual address space, the hypervisor has a separate mapping of all the pages that you have in the guest. So this means that if you can figure out where this mapping in the hypervisor is, you can place guest control data in memory in the hypervisor and then reference this memory from the instructions that you're transiently executing to get even more control over the execution in the hypervisor. And one particular thing you can do with that in the case of KVM is that there's this EBPF bytecode interpreter in the hypervisor, which basically allows you to supply, which basically has this function that you see at the bottom of the screen called BPFProgram. And as a second argument, it takes an array of instructions in some bytecode format and it will then run those instructions. So with this code gadget that you see above that, you can first get control of the second argument register RSI using the register R9, which you already control. And then you can use your control over the register R8 and over memory to provide the destination of the call. So then that lets you run arbitrary bytecode in the hypervisor during transient execution. Then you can use the bytecode to read a memory and leak the data into the cache and then leak the data out of the cache in the guest. Okay, so now meltdown or variant three. So here on the right-hand side, you can see a depiction of the virtual memory layout roughly of a user space process. And you can see that the address space, the virtual address space of the user space and the kernel space is shared, at least on, for example, X86. So while the user space does not actually have permissions to access the kernel mappings, the kernel mappings are present in the same page tables that user space is using and that's a bit in the page table that says whether you're supposed to be able to access some memory from user space or just from kernel space. And now we're just going to use this more or less the same pattern that we were already using for variant one, where we start by dereferencing some pointer. But importantly, in this case, the pointer points, as you can see on the right side, into kernel space, specifically in this mapping of all physical memory that calls tend to have. And we just try to do this read. Obviously, this instruction will not be able to architecturally execute completely because, well, this is a call memory and we can't just architecturally access call memory. But it turns out that in, on at least some processors, you can continue execution in transient instructions after such a reference to call memory and the value that the read is returning is accessible from the following transient instructions. So again, we take this value, we map it to values that are sparser so that each different value maps to a different cache line use it to access this array two to leak the data into the cache. Then execution of this will be terminated because we accessed a call memory, but at this point it's too late and we can use architectural attack code to leak the data back out of the cache of this array two and figure out what the value was. So it's not entirely clear yet what's going on in the variant three attack. So there seems to be some race condition involved in a privilege check in the processor and that's a pretty straightforward result that you can leak some cache data from the kernel. So in particular from the L1 data cache also, but the TU guards, people have also figured out that you can read uncached data. It's just not entirely clear yet what influences how well that attack works precisely. One last thing you saw in this slide that we were doing this dereference of a kernel address and I said that this is not going to architecturally execute the processor will raise a page fault because we are accessing an address we're not supposed to be able to access. So there are three ways you can deal with that because normally the kernel will just then terminate your program when you get the page fault, but you can use a signal handler so you can just tell the operating system, hey, when I get a page fault, I would like to continue execution. Obviously that's a very noisy approach, but it works. The second way is to use the TSX instructions that you have on some processors where you can before you do the actual access to a kernel pointer, you can tell the processor that if something bad happens, it should just roll back the execution state and do something different for you. Or the last option is to put a mispredicted branch in front of the faulting instruction so that even the faulting instruction itself is just running as a transient instruction and not actually being executed architecturally. Okay, so basically in conclusion, there are COVID channels in CPUs and they're useful for more than just transferring secrets between trust domains that are supposed to be isolated from each other. And while most security issues are correctness issues, not all security issues are correctness issues. Okay, here are some references. First to the various research papers and blog posts about this issue and then some prior research that I mentioned in this talk. Yeah, and I'm done. Okay. Okay. So we actually have plenty of time for questions so I would invite people to come and take the mic if there's something you'd like to ask. And if you're planning on speaking in the, my goodness, the line is forming over here for the lightning talk session. Okay, let me lead off the questioning by asking Jan a little bit about the, as much as you can say, about the disclosure process that was followed here and how the different groups were interacting with each other throughout this process. I think that's an interesting part of the story which you haven't really touched on in your presentation. Yeah, okay. So we, Project Zero reported this issue to Intel, AMD and ARM at the start of June last year. And I haven't, I didn't hear from the other researchers until sometime later in the year when Intel contacted me and said that they'd been contacted by other security researchers. Okay. So you're playing that one with a straight bat. I think it's in, but that's fine. There's questions from the mic, Matt Watson. So I would just like to ask, are there, you didn't really talk about case coherency where if you have a multi-processor system, are these transient instructions going to generate changes in the cache of other processors as well? You mean, so you mean whether they're going to have effects with, for example, a cache line that was exclusive becomes a shared cache line. I would think so, but I'm not sure whether I've actually tested that. Okay. This is a pretty significant attack and quite hard to mitigate. I was wondering if you think that this is the kind of thing that as vendors develop patches and patches get rolled out, is it just the kind of thing that gets simply solved or do you think it's pretty much the end of civilization as we know it? Well, I think, and so variant one is pretty, seems to be pretty easy to mitigate. It looks so from what I've conceived from the process of vendors, it looks like the Kaiser patches that are now called KPDI that Daniel Goose and other researchers developed are going to solve that pretty well. The other variants I'm not so sure about. Hi, thank you for your talk. Nevertheless, that's a cool question. What was you and your colleagues reaction when you first stumbled across the spectrum meltdown? Good question. I was like half a year ago, so I'm not entirely sure anymore. I think it was a relatively gradual thing. So it wasn't as if we had suddenly stumbled over the whole thing at once. So you only, with time, you saw what it means. Only with time, it became clear what it means. Okay, and how has your life been affected by the media leaks in the recent week? Like, has it changed? I don't really want to comment on that. Okay, thank you. So speaking of media leaks, it's very unclear in some of the media articles that have been written exactly which processes are vulnerable to which variants of the attack. So as far as I can tell, everything works on Intel. But what about the arm? Do all three variants work on arms as well and stuff like that? So ARM actually published a website where the table clearly says that specific processes, which specific processes are vulnerable to which specific variant? Okay, thank you. What does this mean for trusted execution environments such as Intel's SGX? Do you have any thoughts on that? I've been wondering about that, but I didn't really look into it. So I can comment on that. Yeah, there is something going around on Twitter, but I have no idea. Do you have any thoughts on how these flaws existed for, I presume, a couple of years and then all of a sudden two or three different research groups sort of all stumbled across them within some short time interval? Seems sort of interesting, like. So it seems to me that the topic of cash attacks has been coming up in the last years quite frequently. So this thing that there are cash side channels that you can use to perform such attacks. So for me personally, it's something that I've become more aware of in the last couple of years, I think, and without that, I probably wouldn't have stumbled over it. I'm not sure whether that's true for the other researchers. I think Paul Kochar in particular probably has a lot of experience with that prior. You alluded to this being one of a class of side channel attacks. Do you have any further pointers to what areas of research are likely to be fruitful there? So I haven't really looked into that much, but there are some papers where you can see, for example, things on where not just the cash timing, but also the timing of DRAM accesses differs based on previous memory accesses. And you could also try to, I think Paul Kochar pointed out that you could try to time the length of the transient execution instead of trying to, afterwards trying to leak things from the cash. And there's also some research, I think, from Sophie Dantuan about leaking between hyperthreads information about which execution units are being used by the other hyperthreads because hyperthreads share the execution units. And so there's some scheduling going on. And so that means that you can leak through the behavior of how the CPU schedules things out of order, what the other threat is doing on a relatively coarse level. Okay, I think there's no more questions. One more up here. A great point at which we should end. Oh, sorry. Questions upstairs, where? Okay, go ahead. Surprise. So paradigmatic attacks like this tend to generate hasty fixes that are broken pretty quickly thereafter when the next paper season comes around. What do you think, especially for something like this, vendors can do to make sure that their fixes address more generally the underlying problem rather than sort of paper over the existing attacks? Well, I mean, that's on the process of vendors. They are the only ones who are really in the position to be able to completely review what the computer is doing. And so I don't think that's something I could, for example, particularly help with. Thank you. Okay, I think that's a great place to stop. So let's thank the speaker again. Thank you very much.


Welcome traders to another Ticknell earnings report preview with me Patrimonally before jumping to today's report It's important that we adhere to the risk disclaimer Material provided is for information purposes only and should not be considered as investment advice Views information opinions expressed in this recording are solely mine And they're not indicative or representative of those held by Ticknell UK or Ticknell Europe limited Okay, let's jump into today's report We're looking at Peloton due to release before the open in New York today looking for earnings per share of 83 cents on revenue of 976.12 million Would highlight that there is a whisper number on the street that the EPS could print as high as 92 cents per share obviously Peloton was one of the hottest names in the Fitness during the pandemic with more than 6.2 million members peloton stock was one of the brightest spots in the Coronavirus stock market rally share saw a gain of one 440% in 2020 but after reaching a peak in January 2021 Peloton stock has been on a steep downhill ride and The future of the company remains uncertain in the wake of layoffs and reported takeover rumors By out buzz recently has seen shares become a little bit more volatile Peloton generates most of its revenue through sales of bikes and treadmills which range of price from $1,895 to $4,295 the all-access membership for its owners Of its expensive equipment runs at $39 a month a digital membership with no access to the bike or tread classes is 1299 a month, but to determine peloton starting by right now. It's really key to analyze the Potential changes that are coming in peloton's plans With respect to pricing structure for the equipment and the subscription program the company will increase the cost of subscriptions for peloton Interactive platform starting in June those monthly memberships will jump from $39 to $44 The increase in the connected fitness app follows a cut in price for peloton's bikes and treadmill equipment peloton bikes will now cost 1445 instead of the 1745 the treadmill will retail for 2695 instead of the 2845 level analysts say the price changes could lower the barrier of entry for peloton equipment and Stabilize the company's earnings over the long term So let's take a look at what we can glean from the statistical training patterns for peloton Peloton shares have moved lower in the immediate aftermark of earnings seven out of ten previous reports on average the stock moved down 3.2% in the first day of trading after the company's reported earnings based on the previous ten earnings Releases peloton is more likely to trade lower one day after earnings from average loss of 3.2 Cent on average the stock has moved lower by 1.1 percent one week after earnings In terms of what the options market is pricing from a volatility perspective Options traders are pricing in a 23.9 percent move on earnings stocks average a 12.7 percent move in recent quarters from a flow and sentiment perspective is noteworthy that April the 21st there was some notable buying 1267 contracts of the $35 call bullish expiring Friday September 16th this year options order flow sentiment in general has also been published investor sentiment going into the company's earnings release Has 19 percent expecting an earnings beat the company's guidance was revenue of 950 million Consent assessments are for earnings to decline year-over-year by 2666% with revenue decreasing by 22.67 percent Short interest has decreased by 13.2% since the company's last earnings release While the stock has actually drifted lower by 48% from its open following its prior earnings release to be 72.6% below its 200 day moving average of $57.23 So let's take a look at the charts now and see where they might be some technical trading opportunities It's noteworthy that obviously we have witnessed the very steep decline here And we are printing new all-time lows in the stock But this is being accompanied by a potential wedge pattern developing here So I'm looking for any pop down into the $12 level much for bullish reversal patterns to engage on the long side Look for us to trade up through the descending wedge Resistance into the high volume mode at $26.20 and then I'm looking for that move up through that $35 call level and get a retest these prior highs here at $39.79 however, if the earnings come in weak and The market responds negatively any move through $10.00. I would be short the stock looking for a move down to test the $5.76 to $5.47 level as the next downside objective As always traders plan the trade trade the plan and most importantly manage your risk until next time. Thanks very much


Rhaid i chi gael nhw, rydw i'n sefydlu ein cyfnodau o fïrch a'r rhaid i'ch gael y ddweud yn ôl o'r ddweud cyfrannu a'r roedd o'r gyflosol y hollurodd. Yr unig ymddangas ymddangas ymddangos ymddangos ymddangos, a'r ystafell ymddangos ymddangos ymddangos ymddangos ymddangos ymddangos ymddangos yn y reuferwyr John Murdock, Sain John's Kirkwest Perth a Sain Leonard's in the Fields Perth. d telephone Gwyrddon, ddarlon ddechrau, dîr helaid i gael eich sydd. I send for my congregations every good wish for what you do for our country. We pray for peace. We live in very tense times. None more so than during this abominable situation in Ukraine. Each day last week, St John's here in Perth was opened for public and private prayer o Ukraine. We remember you and all who lead us at Holyrood and Westminster in our prayers together with Her Majesty the Queen every Sunday. At this time of international tension, the hearts and minds of many incline to the wisdom of those who in past days, in other scenarios, have spoken to the soul. Reading recently the 272 words of President Lincoln in his two-minute Gettysburg address on 19 November 1863, I was in awe how much we need to hear him again. His address concluded with, under God, government of the people, by the people, for the people shall not perish from the earth. Government, of course, is there to lead us in the best ways. One of Lincoln's successors, Franklin Roosevelt, when he talked of four essential freedoms, could be speaking to every man and woman in any century about our collective wish to live in those best ways, living in a world of peace and freedom, the fruit of best leadership, indeed best fruit of leadership. In a different context, the same was expressed by Pope Benedict in his 2010 visit to the United Kingdom, remarking to trainee teachers in Trichunum, what sort of world do you want to live in and what sort of person do you wish to be? Perhaps Benedict was echoing Roosevelt's four freedoms, freedom of speech and expression, freedom of every person to worship God in his, her, own way, freedom from want, freedom from fear. My prayer and hope is that, under God, we too can strive for those freedoms, continuing to look beyond our shores especially to the needs of those far less fortunate and that in our own country we look to the solid ground of faith, hope and love. May you who lead us be encouraged to keep on keeping on. Thank you in this Olympic year for taking the torch of the leadership baton forwards, but first and foremost, let us continue to hold the Ukrainian people in our hearts. Thank you so very much for inviting me to be with you. May God bless you all. Thank you, Reverend Mardog.


I can assure you I've no intention of going through all those slides and some of them are just information in many ways and what I really want to do today is both underline, I think the message that we have had already this morning, which is the collective endeavour that this is. This is about what energy might be at the heart of so much of the climate change agenda. It is an endeavour in a global sense, in a national sense and in a European sense that requires all aspects of the economy, all aspects of society to pull together as one. And in terms of energy, in terms of the national collective endeavour around energy, just to maybe remind us all that we do intend to produce new energy policy framework by the end of the year. And in the context of policy certainty, such a statement of direction is hugely important. It would also mark the momentous, indeed in some ways, catastrophic changes since 2007 and is a good moment at which to embark on setting some of those new directions. Now, I've just thrown up those. Those are no surprises to anyone in this room. But just in terms of where we're at, 2010, the gross final energy used for renewable energy was 5.5%. Now that's getting, you know, this is where we need to be. There have been significant developments, but it's still a huge challenge, particularly around the heating and I'll come back to transport. Electricity, 15% in stall capacity, and I think Finton, correct me if I'm wrong, but on Christmas Day we had around 42% wind on the system all day, which was, if nothing else, a remarkable indication of the oil island grid study, which noted 42%. Anyway, one of the things that I just thought it should be worth touching on today, and it's as much to kind of provoke a bit of discussion as anything else, is are Europe's legally binding targets paying off in the renewable energy sphere? And maybe just to start with reminding ourselves that Ireland's energy policy is set firmly in the European Union and in the global and international context, we have had over the last five years an array of seminal strategy and policy documents from the European Commission. We have had successive endorsements by the European Council of the need to put energy policy at the heart of both economic policy and climate change, and we will have the new communication on renewable energy from the commission later this year, which I would envisage will be an item for a much interesting discussion during the Irish presidency in the first half of 2013. And we have the current work on the energy efficiency directive, which our Danish colleagues currently in the presidency are moving ambitiously ahead, building on, I have to say, the very excellent work done by the Polish presidency towards the end of last year. And I would say that energy efficiency, which is part of the session to follow with my esteemed colleague Brian Motherway leading off, energy efficiency is the most fundamental part of all of this, and we haven't even begun in global terms to realise the potential in that sphere. The door to two degrees is closing. The International Energy Agency has made that quite clear in its most recent energy outlook. If we don't take the kind of actions that we need to take now, investment will be locked down, and the kind of challenges that previous speakers and colleagues outlined earlier today will be pretty much impossible. So, in terms of renewable energy and the Irish context, the point I want to make is that we are not doing something that books a trend anywhere else, and Geraldine Tallin spoke this morning about the low carbon investments in the US, in China, in Korea and India. We've still made good progress, but we still have a very long way to go in terms of realising the potential that renewable energy offers. And just on the targets issue, there are a number of schools of thought that would dismiss targets as a means of achieving anything, but I think the commission's own analysis is that 62% of Europe's energy generation investment in 2009 being in renewables is a big contrast to where we were at in 2004 and 2005. And I think the general sort of consensus that by 2020 could be 37% of the electricity mix, a doubling of consumption between 2005 and 2020. If that all happens, then I am unashamedly of the view that targets do work, and targets set a political benchmark. They set us something to achieve. One of the big debates in the European Union over the last seven years has been whether there should be an energy efficiency target, and that's maybe something that probably would come up in the next session as to whether a binding target in energy efficiency would indeed be the way to go. The current direction is very much binding measures as opposed to a target. But I think I believe targets work. They are a means to an end. They're not an end in themselves. The policy context in which we're doing all of this is as much about economic policy. It's about sustainable development policy. It's about climate change, and it is also about competitiveness, which brings us back to the point that Eamon Ryan raised this morning. Low-carbon economy renewable energy is about competitiveness as much as everything else. The European ambition is Ireland's ambition, and it is also Ireland's opportunity. People have spoken this morning about some of the unique characteristics and profile of our greenhouse gas emissions. We have another blessedly unique characteristic, which is the abundance of our renewable energy resources, whether it is wind, offshore, onshore, ocean, biomass, which was touched on this morning where the potential is really only beginning to develop. I believe in targets, and I believe that the increased coordination of energy policy across Europe is something which will continue to motivate and deliver change in the interests of this country. I know that Neil Walker actually raised this point earlier on, and I had just been thinking about this and throwing up the slide. Just as much for people to be thinking about this, because there is a debate going on, and there are two very opposed schools of thought in terms of whether renewable energy incentives are actually in some way interfering with cap and trade, with the price of carbon and so on. Basically, there would be a school of thought that says, don't do it. In this regard, I'd commend you all to pay very close attention to the research work that goes on in the International Energy Agency, which has done quite a bit of work on this particular issue and on a whole range of others. This is some of the research work, not the obvious set pieces every year, but IEA is the heart of the evidence-based approach for all that we do in policy, for all the members of the IEA and in many ways supporting the European Union. There is the view that CO2 prices alone will deliver, but some of colleagues might want to comment on that later on in terms of whether the discussion we had this morning on Paul Harris' analysis points to whether the CO2 mechanism can deliver right now. There are, as we know, very many drivers of renewable energy deployment policy. There's energy security, there's energy access, there's the balance of payments, there's environmental, there's jobs, competitiveness, economic opportunity, and investment opportunity. At a moment when this country needs that investment, I think it is behoved on us all to ensure that we create those conditions that are conducive to investment in the renewable energy sector, in the green tech sector, because this is an opportunity. And when people tell me that the cost of renewable energy incentives, that this is of concern, and there are plenty of those who will debate that point. First of all, I firmly believe that renewable energy deployment now, and this is part of the IEA analysis as well, unlocks longer term climate change mitigation and reduces longer term costs. We need to take the longer term perspective when it comes to investment in renewable energy. Let me throw another figure at you. In 2010, 66 billion dollars was spent worldwide on renewable energy incentives. In the same year, somewhat in excess of 400 billion was spent on fossil fuel subsidies. Now, I think that sums how something in its own right, so keep that in your heads. Now, delivering on Ireland's 2020 targets, there are, I must be frank, any number of challenges still, we certainly have not got it entirely right. But I would hope that a number of, if you like, statements, and certainly when Minister Abbott addressed IEA and indeed the IWEA at the recent conference, he would have noted that the government doesn't tend to produce renewable energy strategy in the very near term. A sort of a co-trailer, if you like, for the energy policy framework later in the year. So, we do need that policy certainty about direction. We need predictable, transparent support frameworks. We need the refits to be predictable. We need them to be commensurate with what is the support required for the individual technologies. We need regulatory certainty, supporting renewable energy, and indeed all kinds of generation in the long-term interest of consumers. And I appreciate that the Commission for Energy Regulation has to do God's work most of the time. And I'm always in admiration of the difficult and increasingly difficult and complex decisions that have to be made by SIR, by the SEM committee. And it's not getting any easier, and perhaps the point we've got to in terms of development means that the decisions are becoming ever harder, and that is of itself a big challenge. Cost-effective timely investment in grid. That is a priority, not just, may I say, for renewable energy development in the regions, but for regional economic development. And I think it's important that business and those concerned about economic regeneration and renewal get that message out, that investing in transmission is about enabling FDI in the regions, about ensuring the robust highways, if you like, for economic development. And absolutely critical for moving large amounts of renewable energy from west to east, from south to north. So we need that infrastructure, and that message needs to keep going forth. Big challenge is around coherence between environmental and renewable energy objectives and planning and permitting procedures. But the coherence on this one is something that the European Commission itself increasingly recognises and kind of struggles with. And I think, without exception, every jurisdiction struggles with it, that there is a kind of a conundrum there in terms of how do we balance the two. And I do believe that it's something that at a national level we need to invest more time and effort in trying to resolve. Paul McKiernan talked about bioenergy, as did Gerard Barden and Kearon. What we need there is a coherent strategy, and that's something that we have been working towards and saying for some considerable time. But we need to get coherence into the supply issues, the demand issues, the environment within which we will have these cyclical ups and downs in terms of food versus energy crops and so on. But there is, if I was to see one thing that is really missing, a bioenergy strategy is something that we are working very actively to deliver. And I would hope working with our colleagues in agriculture and I swear that that can be forthcoming fairly soon. I'll just briefly skip on to maybe some of those are all, and there are other ones of course that is by no means an exclusive list. As I say, it is a collective endeavour and I think one of the things that we do need more of and we would take responsibility for needing to deliver more of that across government is the fully integrated approach across departments, agencies, the regulator, air grid, ESP networks and others, working with the industry to tackle the roadblocks that do exist in terms of delivering onshore wind. That do exist in terms of tapping the potential for biomass. And we do intend to relaunch their renewable energy development group, which became a very, very large forum, which is one of the things we're kind of working on to reduce that. We need to be best in the world in terms of integrating wind onto the system and I think the work of air grid demonstrates that we can be. And I would just note that, successively from the United States, we've had Dr Stephen Chew, who's Secretary for Energy and Nobel Laureate. We've had Dr Christina Johnson, who was Undersecretary for two years. And most recently we had Nancy Pelosi and a delegation of congressmen and women, including Congressman Markey, who has a long standing interest in Irish matters and indeed Aiman Ryan had met him in Washington a couple of years ago. And they were hugely impressed and Stephen Chew was hugely impressed. And I think what air grid has done, and if you look at air grid's annual renewables report, it really does bring it home. Air grid's achievement and the kind of cutting edge work that goes on in UCD under Professor Marco Malley underlines that we can indeed be best in the world at integrating wind. We will deliver these to West Interconnector to schedule in September and that first piece of interconnection is critical to going towards 2020 and indeed beyond. We have the challenges of single entry market design and regulatory decisions in the context of UK reform and how do we accommodate, if you like, wind into that regulatory environment. And we have the role of state companies in terms of what it can bring, both in biomass terms and also in terms of wind, whether it sites, JVs, projects in their own right. Now, I'm just going to quiz down to one last slide and conclude, Chair. I mean, these are all very familiar to you. Okay, just to note that one in the context of the debate today. And also, again, to note that when we hear the challenges in transport and agriculture, it does tend to come back to energy to supply the solutions and energy policy as such alone cannot supply all the solutions. But nonetheless, and if I may note there that biofuels and EVs, I again make no apology for believing that the electrification of transport is going to be a key and faster than we think part of the solution to the oil intensive use in the transport sector. And I'd put money on it if anyone's on for that. Finally, and again, it's that proposal of that. You know, I'm a historian by training, so if you go back into time, there are endless apocalyptic predictions about society and what's going to happen and so on. And inevitably, inevitably, the human race shows that standing creativity and resilience and coming up with the solutions. And I firmly believe that technology will deliver, but it must be allied with visionary leadership and that, I think, and resolute leadership. And that is what the energy climate change agenda needs above all at international level, at European level, and here at home. And just finally, I want to make another point, which is there are 1.4 billion people in the world who do not have access to electricity. And renewable energy is part of the solution for them. They also tend to live in regions who are likely to be the most horribly exposed to the catastrophe of climate change. Sustainable energy, distributed energy is part of the solution for those. And we must remember that climate change and sustainable energy is in that context as much a social justice issue as it is an economic issue. Thank you very much.


It started out by our constructing a St. Joseph altar that was in the works, at least in the plans, and we had been hoping to have this altar dedicated to St. Joseph as the completion of our Abbey Church that was constructed and completed and dedicated in 2018, during St. Romina's lifetime. And so it's the custom in many places to have the founders of a community to be buried in the motherhouse chapel. So we thought it would be fitting to assume her and bring her to the altar of St. Joseph, which was originally going to be behind the high altar. Well, we called various people, we called a priest from the Diocese of Newark, the Irish Diocese of Newark, who said, you know, he works in cemetery and that at this point we should expect only bones when we exhume her, but he said, as far as re-entering Sister Romina, that we really need to just see what we had. Now, Father knew Sister Romina, so he was somewhat hoping that we might find an ingruptible, but you know, this is the kind of thing you don't even dare to hope for. But on the other hand, when Sister Romina did pass away and she was lying in state, she became more and more beautiful the more time went by, so that by the time we actually closed the coffin over, we closed the coffin lid, she was actually smiling beautifully, which she, you know, was, it was a smile that was gradually growing the more she was being, the more people were paying their respects to her. So that was kind of our first inkling that something special was happening, because there didn't seem to be any sort of decomposition taking place just while we were keeping vigils. So at any rate, we started digging on the face of Our Lady Good Council, April 26th, and it took us two days to re-dig the grave. It took longer to re-dig it than to dig it the first time because we had to be much more careful getting around the coffin. So when we discovered the coffin, we were surprised to see that it was very much intact. In fact, the coffin had swerved just ever so slightly to avoid the pouring of the concrete pudding, which would have really destroyed the coffin if it were just a few inches tilted in one direction. So the sisters very carefully dug the dirt around the coffin, and we hoisted it up, and Mother Ava said to all the sisters to kind of go to one side, you know, because we wanted to be respectful of Sister Wilminga's remains. And so as we began to clear away the dirt, we saw there's a very, very large crack all the way down the coffin, and it seemed like the crack was widest right around the area of her face. So that was something we were a bit sad about because we thought, okay, maybe it's worse than we thought. But as we were trying to clear away the dirt, I said to Mother Ava, maybe try looking at the feet first. So she took a flashlight and she's shown the flashlight into the crack, and she screamed. I have never heard her scream like that. I don't think I ever, well, she screamed at the top of her lungs and said, I see a foot. And so she handed me the flashlight, and I looked in and sure enough, there was a foot just as full and beautiful as the day we buried her. You could even see the brand name of the sock, you could see Haines written on the socked foot. And so when we actually did exhume her, we unscrewed the coffin lid. At first, we were hesitant. We weren't sure if she was in her after not because a great deal of mold had covered her face. But we could see those feet very clearly. In fact, sisters were going up and pinching her toe, and it just felt like a real live toe. It was squishy. And then as we were clearing away more, we said, oh, we'll have to see what's under the mold. Mother Ava said, well, mold doesn't grow on bone, mold grows on living substance. So there must be something under there. So this is something, I think we were a little bit having read Joan Carol Cruz's book, The Incorruptibles, which was a tremendous help for us, by the way, because there aren't really any books out there about Incorruptibles. So it was a great help to us to have these historical references of Incorruptibles. And so it took about two weeks to clean Sister Romina. You have the impression that you just bring them up in there. It's like sleeping beauty. Everything's completely intact. But there are other damages that are done in the grave, especially the mold layer. But it wasn't until we brought her back to the convent with the coffin lid open. We were singing and processing as we went, that we realized everything else in the coffin was gone. So we had poster board, we had tape, we had satin lining all the way around the coffin. All of that was completely gone, completely disintegrated. And yet everything touching her was intact.  Her habit was completely perfect. There was not even a thread out of place. In fact, we lifted her cappulla and you could still see the threads hanging down from the day we had cut it to fit it around her in the coffin. And it was that much attack, not a thread out of place. And there were three different kinds of material. We have the synthetic, we have the cotton, and then we have the wool. All of them were completely intact. Whereas the synthetic, the satin lining was completely gone. So you would have her veil and then right next to it was the satin. There's nothing left of the satin, but her very thin material of the her veil was perfect. I mean, ours are in worse shape than hers was. And it had been in the grave for four years at that point without a single thread disrupted. But it's interesting because we had tied a linen band around her jaw to keep the mouth closed. And that had actually started to disintegrate, which we thought was interesting because it was almost like the signs of her death were gone. So the coffin lining and that new linen piece of cloth that was right next to her bulgur. So bulgur is like our wimple. So the new linen was rotting, but the used wimple was perfect. So even things like that, we said it's so beautiful that what she had in life, what spoke of her life in Christ was all intact. Whereas those those elements of death were gone. And so that I think is one of the most beautiful things about the findings from Mia's ingrub body is that what speaks to us of Christ and our life in Christ and the resurrection and her belonging to Christ, all of that is so present even down to the very gossamer thin ribbon that was going around her profession candle, completely intact. And so we were we were absolutely thrilled. We were so we were so happy, especially was as they cleared away the mold and you could just see her face. And she she had just a little bit of a tooth showing just a little bit in a smile, almost like an I told you so expression. So it was really really beautiful. First of all, to see her again, but then to see this beautiful sign of our belief in the resurrection of the dead, that we had someone who resisted all of the effects of the fall with regard to death. So as to speak to us of the life that is to come. And that was her whole life. It was speaking of the life that is to come. And now we have that. I don't want to say living example, because of course she's going to her reward, but we have we have the sign of her life with us to remind us of the life that is to come. Father Carney, I want to get your impression of that. But but first, I have to follow up with you, sister. What sort of impact did that have at the time and has that had on your fellow sisters? You're at the at the Ivy. Oh, it's it's been beautiful. Well, first of all, it's such a rare blessing. And I think we didn't realize that until after it happened that there's I've heard there's only 200 recognized incorruptibles in the Catholic Church, and that's an extremely small number. But just to have our own among them now is really, I think, such a beautiful thing. And it's something Mother Havas said, she wanted to put up a sign in our church for us to say, sisters, don't forget, we get to pray the divine office each day to sing the praises of God in the same churches as an as an incorruptible, who is our founders. And I think that's something as crowds come in and they see Sister Wilmina lying there in her full habit. And we kept her in that same habit. That's something I don't think everyone realizes when they come to see her when they come to venerate her. These are these are the clothes that we found her in these were these are her incorrupt habit pieces that that she's she's still displayed in that perfect habit. And so going there and praying the divine office with everyone who comes, they can see that here's Sister Wilmina. This is our founders. And she's left us this legacy in this prayer that we continue day and night in the church. And then God willing, we'll move from this life of prayer to the life of glory that she has and that she represents to us. And you see it even in the faces of people who come, they look at us and they look at her and they look at her and they look at us and you think this is exactly the way it should be that our life would be tending toward heaven and be a sign of heaven. Just as Sister Wilmina is only we're still left on this earth and she's she's already gone to her reward and God willing she's pulling us behind her. So that's that's what I think is that's what goes through our minds when we see her and just to have her back in the church again is such a great blessing for all of us.


Hello everyone, this is Wes Lambert speaking with you today talking about creating a Velociraptor collector. If you haven't heard of Velociraptor already, it is an excellent in-point visibility tool used for host monitoring, host forensics, lots of lots of different different ways that can be used threat hunting, just a great tool overall for that. So we're going to be talking about how to create that dedicated offline collector so that we can go over two in-points and then collect those forensic artifacts that we're looking to collect. Okay, so without further ado we'll go ahead and get started with that. And just a brief overview here, we'll talk about why we might want to create an offline collector and then we're just going to go through the various steps of creating that collector and then getting the data that we're looking for. So typically we'll create an offline collector whenever, well it could be a couple situations. So we might have isolated networks, networks that we don't have access to from our Velociraptor server that we maintain on a dedicated host. So maybe agents wouldn't be able to communicate with that server per se. Or maybe we can't install local services on those boxes or we don't have the ability to, you know, we don't want to. Or maybe we have customer environments where we don't have architecture, we don't have Velociraptor stood up and we don't have a client server kind of architecture. This is where we would come in and create this offline collector and then we can give it to our incident responders and then have them go run that on the machines in our isolated networks or in those customer environments. So this is usually the main reason why we would want to create this type of collector. Now as far as actually creating the collector, there's going to be a few different steps that we have to go through. So a lot of this is documented very heavily and very well on the Velociraptor doc site here. If you go to, it'll be under triage and acquisition here and then scrolling down to offline collections right here. There's a great section on how we can do that here and I'm going to walk through some of this right now. So we have a Velociraptor server stood up here, just basically one client joined to the server. It's named as VRPRD and what we're going to do here is create that offline collector. So to do that, we're going to click over here on the stack right here, this icon right here and we're going to click what looks like this paper airplane right here and what this is going to do is take us to a wizard that will allow us to collect the artifacts we want to collect, specify what we're looking for and be able to package that up into a single binary to ship off over to our hosts. Now this particular box that I'm looking to target is going to be a Linux host. So I'm going to choose Linux artifacts here, just a few different ones such as the APT sources, packages, maybe I would like some net stat information, see maybe some bash history and a ps list as well. So I've selected all of those and now I can configure the different parameters for that collection if I would like to for each individual artifact. Now going from there, the collection specific configuration which is going to be the overarching collection of these artifacts is going to be right here and this is where we're going to specify our target OS, I want to specify some other details to really guide our collector to where we want to be. So in this instance, since I'm targeting a Linux endpoint, I'm going to choose the Linux option here and I'm not going to specify a password here, but we could if we would like to. There are various report templates that you can create or you can use the default report template. Right now we're not going to generate a report with that, we're just going to keep it the default right here. And then also there are a couple different options here of ways that we can specify our collection or I'm sorry the in format of our collection. So we can just have it be a zip archive that's dumped locally on disk for the particular endpoint. We can shoot it up to a Google cloud bucket or an AWS bucket which is really useful, especially if you're again in that customer environment and you want to be able to send that data back to a central location where you can pick it up and process it after the fact. And then also SFTP is another option that we have here, but for the time being we're going to choose the default zip archive option here. If we wanted to change our binary that we actually use our base binary, we could change that here. This velocity raptor Linux configuration right here. We're not going to do that right now. And then there's some other details here that we could fill out, including the output format of the results. So we could see that maybe we want the results in JSON or maybe we want the results in CSV and JSON for post processing later. Maybe we have some other tools that we want to import that data into and it's only CSV compliant. That's another way that we can specify that format there and be able to post process that data with additional tools. Another helpful thing that we have here is this prefix and what this output prefix is going to do is kind of like what the name suggests is it's going to prefix the name of the collection file with whatever we specify here. So I'm just going to choose BTB 2022 to add that prefix to the collection. And then I can specify some additional resources here in this next tab, but I'm not going to this time. I think all of these defaults will work well for what we're looking to do. And then we can review the different details of the collection that we're creating here. We just scroll down. This is the actual VQL or Velociraptor query language that we'll see here. So if we go over here and click launch, it's going to take a minute. It's going to go through and check and see what kind of collector it needs to build. It's going to go through those steps. And then after that, you'll see the status changes for the server details create collector artifact. And now we see that it's completed. So we can see the results here, basically just some summary details, some hash information for that binary and then also the virtual file store path for that. And if we scroll up, we can see the log and we can see what it did during that collector build and see if there were any issues there. And then we can go to the uploaded files here. This is where we're going to actually download the collector binary. And then we can put that on that endpoint. So what we're going to do here is just click to download this here and we'll see it's downloading. We'll wait for that to finish downloading here in just a second. Let's take just a minute. And then once that's downloaded, we'll SAP that up to our target endpoint. Just a very simple way to copy that there. So I'm going to go to the terminal here, span this just a bit. And I'm actually going to get a tab here. And I'm going to SAP and downloads. Collector say, we'll say, which one was that? Here, it should be this one right here. Collective velocity, the zero, six, five and limits. And we'll just copy that up to our endpoints. Obviously, if you're in an enterprise or in some other type of environment, you might have a better way that you do this, whether it's through PowerShell or through some other deployment machine or mechanism. That's certainly another way to do that. I'm just going to copy this up here to that home directory. And this is going to be our server that we're actually looking to investigate here. We're actually looking to kick off this collector binary on this host. And this host name secret sauce here. Maybe there's some interesting things here that an attacker has gone looking for it. And we're trying to find evidence of that here. So we'll check to see if our collector binary is here. And we do see that it's right here, collective velocity after these zero, six, five, Linux and B64. Okay. And all we have to do here really is just actually have to actually make it executable. And then we'll just do we'll execute the collector here. We need to do this from with elevated permissions. So we're using sudo here. And we just hit enter. And it just goes off and does its thing. And as you can see, this was super fast. We can see kind of up here what artifacts we were going through. These are not very heavy. These will not take very long. But if we're using some more intensive artifacts or we're taking longer to do things, you'll see that it may take a little bit longer here to finish this particular collection and output this. So you see the end report right here, essentially at the end of it. And then if we do an LS here, we'll see the zip file that it created. And you'll see it's prepended with our BTB 2022 collection and then the host name right here. So that's our resultant collection zip file. And if we were to unzip that, we would see all the contents, you know, in this case, Jason formatted the artifacts that we collected. But we want to do something else here. We want to take this and then import this into our server. So what we can do, aside from just going off and reviewing these results, one by one or in some other fashion, post-processing with other tools, we can actually take these and somewhat kind of sneakern at these back into the server, even though we don't have that client-server relationship, that traditional reporting back to the server kind of thing. So what we'll do here is we'll actually S&P this over to the Velociraptor server that we have here. I'll move this over so we can see that. If I remember the EIP address, just put that in the, put that in the home directory here. All right. Whoops. Okay. So we've got to do a sudo on that. All right, cool. So we just needed those ad-bin privs so we could copy that over from the machine. Now, again, you know, typically, if you have a different way that you post-process these results, you might have this already sending to AWS or to GCP. So you might not be doing this manually. So maybe less of a step necessarily for you to have to do that. So we'll go over to this VR PRD server, which is our Velociraptor server here. And let's do a quick listing here. And we'll see that we have the BTB 2022 collection here. Now, one thing that we have to do before we try to import this into the server and review the results is we'll actually want to change the permissions on this file just in case, just to make sure that the Velociraptor server here can have permissions to import this into the data store. So we've done that here. And we'll see Velociraptor, Velociraptor. Okay. We're good there. All right. So now, so far, we've created that collector binary. We've run the collection super fast. You know, we had specified our different Linux artifacts. And now we're going to go import this and do the GUI. So I'm going to minimize this here. And what we can do here is from the server artifact screen, we can search for imports. Here it is import collection. This is the one we want right here. And we can see right here that it's an automated free. I'm sorry. It basically takes a zip archive and then imports it into the server. So we can configure it here and leave the client ID to auto because we'll let it just generate a random client ID. But one thing that we can do just to help differentiate this, or to tag it with a particular name, because again, these are kind of disparate collections. The server has not previously known about this particular box or these results. So I'm going to call this secret sauce for the host name of the box that we we ran that collection on. And then we're just going to specify the path on disk to that collection. And let's get back and grab that file name real quick. Just copy this a little bit easier here. Now, one reason that we don't have an import straight from the UI is because a lot of these artifacts are these collections can be very large, especially if on Windows, maybe you're running the Cape files target artifacts, and maybe you're collecting a ton of different stuff, kind of different things from that host. It can be gigabytes and gigabytes and gigabytes. So it can be really big. So we don't want to force that to the UI. We just let the server pick that up in the file system like so. Now, if we wanted to specify any of this stuff, we could do that here. I'm going to leave it as the defaults. And I'm going to launch this. And it should take just a second here. And we'll see that finished. We can see the log here that it was creating a new client, essentially importing that zip file. And then we can see these different file names essentially that were in that collector binary different JSON files, which we could have reviewed manually, but I wanted to import it into the server to make it easier. And now this is a cool thing. If we actually go over here now to the clients, we'll see that this client isn't necessarily connected, right? Because it's not in that client server architecture. But it does register as a client and we can review the results just like if we had it connected to the server. So if we go over here to the collected screen, we'll see all of those artifacts that we selected to collect as collected underneath this client that was imported. And now we can go back and we can review these different pull it up here. We can review the different results for each one of these artifacts here. And then if I had any files uploaded, we could do the same thing for those. But we can review this stuff. What makes it really awesome is like as if it was connected already to the server. So it's a really, really great way to be able to take that data and import it back into the server and have that same kind of post-processing capability. Maybe even post-process it in a notebook like we do with our other data and bring that back in and just get at what we're looking for. So it helps us that much more as an analyst or as an incident responder if we're able to do that very quickly and very efficiently. So this is definitely a great way to do that. All right. So I'm going to skip through these already, these steps. But as far as the demo and as far as just showing you guys how to create this collector binary, that's really it. It's very simple. It's very quick to be able to create this binary. If you wanted to configure it for AWS, all you would have to do is throw in those bucket details for S3 and it would be good to go and be uploading there. But please, if you have any questions or feedback, please feel free to follow Velocidex. That's the handle for Velociraptor, the folks behind it. If you have any questions of me, please let me know at the real W Lambert or just shout out to Blue Team Village and let us know if you enjoyed this. And if you want to dig in more and really go through the documentation, there is a link here, that offline collections page that I referred to. And again, that is really going to be a great place to go. Aside from this video, it really lays out the different steps that you'll need to keep going with this. So again, please feel free to reach out if you need, have any feedback or any questions. And until then, happy hunting and have a great day. And you're good.