Thank you. Hello everyone, this is Jan from Istanbul, Turkey and I am at Sarkand today and we will be talking about the playing with electricity and red teaming in power distribution companies or hacking in the power distribution companies. Before getting started, I would like to thank the ICS Village team having us. It's a really great opportunity to meet you all. We really like to part of the community activities all over the world. We also have some community activities in Turkey as well, so it's really great to be meeting you all over here. Basically, we have one hour with you and basically we have three parts of our presentation. The first part is overview.  Actually, thanks to Sarkand, our simulation lab had some nerve issues. We changed our hardware like four times the last three days. It worked at the end of the day and we did videos for this presentation to avoid any problems. We will have some videos and we will talk about it. All right, so let's do it. Sarkand, please go ahead and introduce yourself please. Thank you, Jean. First of all, good afternoon for the American site spectator and maybe good night or good evening for the European and Asian sites spectator. First of all, I'd like to thank you for giving us the opportunity in this beautiful organization and I'd like to express my pleasure being there. Now I will give information about myself. I am Sarkand Tamal. I am an electric and electronic engineer. I have seven years experience about industrial control systems, systems based on electric distribution, transmission, and power generation. For the last one year of my career, I'm focused on the cybersecurity systems and also focused on the industrial control system cybersecurity topics. Thank you, Jean. We can go on now presentation. I am also an electronic engineer and I have more than 80 years cybersecurity background and the last five years I mostly concentrated on critical infrastructure and I say SCADA cybersecurity. At the moment, we're both working for cyber-wise for critical infrastructure cybersecurity at the moment and today, as we mentioned, we will discuss electricity subsector and power distribution, red teaming, and cybersecurity. All right. We want to start with why electricity matters actually. It's not just for us, but for all the rest of the world. It's the backbone of all critical infrastructure. When it fails, it directly affects the data life or modern life fundamentals. For example, it affects health sector, transport sector, transportation, and finance sector, and so on. Once it fails, it directly affects people and public safety and it's really backbone of the critical infrastructure. So we want to take that part and we wanted to build a presentation to point. So we will be discussing about the red teaming in power distribution companies, but before it, we need to understand the electricity architecture in process-wise. Basically, it has three parts. We have power generation, we have transmission lines, and then we have a power distribution part. Most of the time, power plants and power generation located in the out-of-the-city centers. That means we need to carry electricity long way off kilometers. It means we require the transmission lines. And finally, that means we need power up-down operations. Once we are over from the transmission lines, we came up with the power distribution. Actually, it is the last line of the customer touch. I mean, if something fails in power distribution part, it directly affects customer and our business. To be honest, the distribution companies and electricity distribution process is not too much complicated when we compare the power plants or the petrochemical industry. So it is easy to attack and also it is the defense. Serkan, would you like to add something? At some point in that presentation, today we tell you the distribution. But I would like to be aware of this point. The transmission layer is a critical part of the electricity architecture because it is a bridge between power generation and power distribution. And it is the backbone of the electricity architecture. Today's topics are distribution electricity, but transmission is very, very critical in the cybersecurity perspective. And actually, it depends over the countries or over the regions. Sometimes it is operated by the government. Sometimes it is operated by private companies. It really depends on the region and countries perspective. But I really agree with you that this transmission line is also the core of the electricity architecture. Thank you. So let's dive into the power or electricity distribution infrastructure. First of all, it's a really great example of the SCADA because you have people, which means the supervisory element of the SCADA. And you have remote locations. As you can see on the screen, there are lots of different substations connected via different type of communication media to your control center or emergency control center. So what we said, it's a great example of the SCADA application because you get data from all over the different, different, the remote located substation. And sometimes you control over the remote substations. So on the other hand, you have remote offices like payment offices, headquarters, government agencies to report for or you have direct integration. For example, in Turkey, renewable power plants has to report the nearest power distribution company for the regulation. Basically, what we can say, there are lots of remote locations we have that we need to control. And that means we need different types of communication media. In distribution companies, we really need to take care of the communication media security as a part of the defense mechanism. On the other hand, sometimes some companies or some governments or some countries has a smart meter application, which means smart meters has direct effected electricity. They open and close the electricity via metering control center through the smart meters. Why I'm telling you this because it will affect our red teaming scenarios and understanding the infrastructure. What we need to understand from this slide, we need the loss of high level of connectivity. There are different types of communication media, and we have lots of different type of substation and equipments. And the rest of it, we have lots of different type of integration. All right, I'm gone. All right, I will give a brief information and pass to the second stage. We discussed about the electricity architecture, and then we discussed about the power distribution architecture. Now, we will discuss about the CK architecture. It's also distributed in the server side. But before jumping into it, we need to understand there's a need of a high level of connectivity in a such a power distribution company. Sometimes we need to connect the outreach management system, ERP application, call center, and so on. Maybe Sir, I can give some example about that. Yes, we mentioned about the previous presentation that we said that distribution, like the distribution touch the customs. So this means that the distribution company, so many customers works into like customers management, outreach management, VFMs, other stuff, so many stuff for the customers. Reason of that, the distribution systems must be and have to be integrated IT software applications, like John mentioned, that's OMS. OMS, like VFM, like the other companies, third-party softwares. Because of that, the distribution system is a little different from the transmission and power generation system. And also the distribution network, so many substations. This means that's so many data, so many connection station. So we need the power rule systems. We have to separate this load to separate server, like application server, like communication server, like data server, like backup server, and so on, like HMI server. So distribution systems a little bit distributed and separated structure. It's very similar to IT environment, actually. You have some type of application servers, communication servers. It do some kind of load balancing and it requires really great integration of IT application or business application. Sometimes it's part of SCADA applications, like we call it outreach management system or call centers. They are directly talking or integrating with our SCADA application. Because once you have a blackout or kind of the blackout or shock on the electricity, you will get some calls, you need to reach out to customers, you need to get some data from SCADA. So it's really integrated with IT applications, sometimes cloud applications. And on the other hand, you have entrusted parties like vendors, remote offices, other type of control centers or government agencies. So sometimes it's done via the firewall, sometimes directly connected to your industrial equipments. It really depends on the customer strategy or sometimes they are not really aware of what kind of communication channels they have. But what we need to remember through here, our SCADA architecture is distributed as a server roles. And it's like an IT application and it has integration with the business side. And also it talks with the substation through our communication media. So I will leave the comments to Sarkam about substation because he's expertise lots of years ago. We have talked about the substation architecture. The substation architecture is a distribution substation process. We have some main devices for the process we use. The first one is RETU. RETU is a telecontroller which connects field devices to SCADA systems. We think that the data concentrative or data transfer devices are too. Energizer is an energy meter which gets information from the CT and VT transformer from electric sites information and translating the digital sites and give and directly send this information to SCADA systems. Protection relay is a critical equipment in the distribution and also transmission and also generation as you know that. Protection relay is the first IED device, first electronic device connected physical electric system. It is a bridge cyber and physical world. The reason of that protection is the most critical parts and most critical device in the distribution systems. As many as in cyber security perspective if you want to shut down the electricity you have to control the protection relay. But maybe you can attack the RETU, maybe attack the SCADA systems. It's just blocked our monitoring from the field sites. But if you want to control electricity, shutdown electricity or re-energized electricity you have to control protection relay. The fourth device is the smart meter. Smart meter as you know that's for billing purposes and maybe low voltage site for customer sites, shutdown electricity or re-energized electricity. This last two devices is physical device. The first one is low-volt circuit breaker. It is controlled electricity line. And the last one is the medium voltage criticals means circuit breaker also inside these criticals. It's controlled electricity line, networks. Next slide please. I think, yeah, yes. Yes, we have line IED device, protection light device. I would like to say it's again because it is very critical. Protection device has two parts, one of the hardware, the other is the software. The hardware sites they have unlock inputs, unlock output, digital input, digital output and the other cellular internet interface. Voltage and current information takes with unlock input modules and also control unlock system like set points, power, like set about the frequency, let's say about the voltage, you have to set unlock output. And digital input and digital output is mostly critical because digital input comes from basically circuit breaker position, isolated position, the other information about the physical systems. And digital output is control the circuit breakers means that you control the electricity. Because of that in the scalar systems and most of the communication protocols or animal direction or cyber security perspective, we focus on the digital output signal. In the beginning of this device, they have serial interface because in that time more Ethernet IP rolled. And today's most of device has Ethernet interface and it's gains advantage of the Ethernet IP rolled. But it is some cause of the site effect from cyber security, this gains of advantages. I will tell about later. In the software sites communication protocols, communication protocols means that industrial communication protocol like Modbus, like Probus, like IC-104, DMP-3, the other. This helps communicate with R2 or communicate with the SCADA systems to send information to the upper level. Logic functions control like circuit breaker or other blocking materials functions, logic functions, and configuration interface. This is the critical part of the AID device. As I mentioned that they have Ethernet interface. Most of AID device nowadays use web service interface for configuration software or configuration interface. This is the sustainability about systems as the big point of this AID device nowadays. Thank you Serkan. Actually, we always get afraid or get freaked about touch such intelligent electronic devices. Because as you mentioned, one part is physical that controls electricity and one part is cyber. It's R2 or SCADA applications. It's like the last line of the physical and cyber breach. Once you control it, you control the electricity, you can control it through the R2 or you can directly send commands to the AID or you can trigger some SCADA application set points and it will directly affect the intelligent electronic devices. But once you're planning a red teaming or pentesting activity, you need to be aware of such a devices can affect the electricity and you need to be really careful what you are playing with. All right, so now we can discuss about red teaming app watch and red teaming scenarios. Before jumping into the details, I wanted to discuss how much red is that because since it's a critical infrastructure, since it's a last line of the custom touch, can we be really free to be really red teaming? In that case, most of the asset owners and most of the cybersecurity companies get afraid to avoid the consequences of that thing happening. I may say that nobody does directly red teaming, maybe it's like light pink teaming, let's say, because we really need to be aware of that the public safety and process safety is much more important than your color activity. So you really need to take care of the process, you really need to take care of the public safety because we always think in that way, if we shut down electricity for the hospital and if we kill someone in that hospital because of no electricity. So it really has a great boundary for us to do our tests or pentesting activities or red teaming activities in a controlled way. So it's not really red, light pink maybe, but to understand each other in a better way, I want to express that part as well. So I would like to mention about the course steps. We divided into five main steps, actually we discussed about the first two of them, to understand the process, understand the architecture. Once you do any red teaming activity in any kind of ICS infrastructure, in that case we are talking about power distribution. We gave brief information about electricity architecture, distribution architecture, SCADA architecture and substation architecture. And we thought that power distribution companies process is not too much complicated. We have very limited type of signals compared to power plants and petrochemicals. So it's a really easy process to ease the attack and use the defense. Now we need to define our landscape and then we will try to create some kind of scenarios to directly develop for red teaming activity usage.  I don't want to talk about the IT based or getting into the IT and then jumping into OT kind of red teaming activities or landscape, but once you are talking about the power distribution red teaming, we wanted to give you brief landscape information that what you need to know, what you are going to face and how it will affect your planning. So basically we have eight categories that we will discuss today. The first one is protocols. There are different types of protocols you will see in the field, in the distribution companies. Basically in SCADA parts, I mean the wide area network, you will see ISC104 and TMP3 and substation level. You will see different types of protocols, sometimes schools, MMS, and so on. And upper level and supervisory level, you will see soft pass and the control level, you will see Modbus, TCP, R2, even sometimes serif protocol.  It's still PLC, but it's different term. We will discuss it today as well. And then we said that communication media is very important. If you get into the communication media somehow, let's say you get into the APM network based on GSM or you get into the RF signals, you then directly interact with substations, interact with R2s and interact with control center equipments and emergency control center equipments. So communication media is also too much important for us to rectify planning. On the other hand, you need to be aware of the third part integration. There are different types of integration. It depends on the country and region and the regulation. You see some of them in our list. And also as a set owner, you have some kind of remote locations or local locations, like control center, energy control center, material control center, headquarter, payment offices or communication center for like RF towers. So asset owner locations also matters to us. On the other hand, substation is very important for us because it is remote located and physical and cyber control is very limited compared to control center or emergency control center or headquarter. In that case, you will be facing with industry protocols on industrial devices and you may apply some kind of hopping attacks. What I mean by that, you once you get into the specific remote substation, you can jump over the other substation. You can jump over the control center or emergency control center. You may create some fake signals. It's like coming from the old remote substation and so on. So it's very great endpoint and great defense point for us. But I should stress out that in substation, we have some physical controls. For example, if someone opens the door or if someone opens the cabinet, if someone is moving in the substation, it creates some alerts and sends signals over the one or four of the control center. So we still have some type of controls that we need to be aware of when we plan associate activities or when we plan red teaming activities. On the other hand, technology, I'm sure that all the villagers have a proper knowledge of them. I don't want to express each of them because it's like the IT-wise pentesting or red teaming because it's server network devices and some kind of field devices. So I don't want to go each of them. And on the other hand, we have people. For example, in Turkey, we have a specific revelation for assessment in the power generation and distribution companies. And it requires social engineering activities for the energy people, let's say the asset owner people. Sometimes we see that some red teaming activities hit the vendor engineers or OT partner engineering company engineers. So people's segment is also really very different types of mechanisms they have. For example, in Turkey, we need to do physical pentesting. We need to do phone calling. We need to do email-based social engineering. It's all written down by the regulation. And also yet another landscape for us, the industrial process, and we will discuss it yet in another conference because since it is the less signals and it's less complicated in the power distribution and power industry, the industrial process vulnerabilities may affect public safety directly. So we avoid to mention the entry points of process vulnerabilities, but we can discuss it later for another industries on the following days. All right. So I hope we understood the process. We understood the architecture and defined some kind of landscape. Again, it may change the region, country, and regulation, but we need to understand the basics of the distribution. So we need to create some kind of scenarios. In this presentation, we created three types of scenarios. We have created a specific table for that. I will discuss it through them. It's again not IT-based red teaming or pentesting. We try to create some kind of directly affect on electricity-based scenarios. So in the scenario, we have a chance to work with our IoT team leader and hardware security leader with Fatih Kairan. Actually, he developed this scenario and applied it in the field. Once upon a time, we were in the distribution company and came up with the idea that we figured out somehow the smart meters were controlling the city's electricity, which means if we could find a way to send a proper comment to smart meters, it will directly shut down the electricity. In that case, the smart meters were talking through the power line communication, so we created our scenario based on this. So to understand the team mates to each other in a better way, we create such a table to define our success criterias, difficulty factors, and decide if switching is required or not. I will work through the one table and I will pass through the rest of it because we will perform a real-time simulation for the rest of it. In this scenario, we targeted the shutdown electricity, but before jumping into that, we classified our tactic and techniques based on monetary, manipulation of control, and manipulation of weave, and our entry points was smart meters, power line communication, complexity in this scenario was high, difficulty was high because unknown protocols were there, specific hardware design is required, and high voltage work environment can be dangerous because we lost one of our laptop and one of our team members got injured during this test because you work with the high voltage directly with the plugs. To better understanding, you plug the smart meter into the city network, so you turn into that specific smart meter into weapon to target the electricity for better understanding. I will discuss it through this presentation. So dependency was the communication interface reverse engineering or protocol reverse engineering, required time was high for us, and also what was our success criterias, understand the protocol, send and receive packets on the power line, send command cutoff electricity for a defined area. Sometimes we create some SOC success criteria for our customers to detect better the next attacks. In that case, it could be hardware or smart meter log management, OMS log management, core center log management or smart meter replication log management could be a success criteria in that case. We defined log sources for redeeming activities and then we defined a purpose method and a chain activity. In that case, our proposal was shut down the electricity via unexpected point of entry through unexpected communication media turn plug and matters into industrial attack equipment. So our idea was simple. So power line communication works through the power signals. You modulate it and put your data into the electricity signals. So it directly talks through the electricity. I think yesterday there was a specific session about that. In that case, we will look into how it's used in distribution companies. In that case, we have a data concentrator, which is directly connected to different types of customers, almost tightening and there are smart meters and there are some power line communication interfaces and it connects to the backend system through the APN in that case over the internet. So guess what? It was the broadcast messages going through the specific power line. If you have specific hardware, you can develop it or you can turn smart meter into your tool. In that case, we made it and we were able to understand the reading data and the shutdown the electricity comments. So since it's broadcast, each of smart meters get the data and once you give order, everyone gets the order, but one of them apply it and report back to center. So once you see the data, you see the smart meter ID and in that case, the power line communication we're using the DLSM-QSM protocol. In that case, that specific number defines the shutdown the electricity comments, double commenting one or four very similar. And also in that case, we were able to get readout data. In this case, this is the readout code for the DLSM-QSM protocol. What we are trying to say that you don't directly attack the SCADA application, RT user IDs. The best way and easy way find yet another proper line end of your goal. So in that case, the power line communication and smart meters gave us a chance to shut down the electricity, but you need to deal with high voltage electricity, you need to deal with power line communication, new type of protocols, modulation, demodulation and encryption type of fees require much more time. But most of the time, the asset owners and the pen testers doesn't pay attention on the deck channel. So you really create a value for your customer and people safety in that case. So as I know, the European countries also have great implementation of smart meters. We don't need to take care of these standards as well. Okay. So our last two scenarios based on the R2Us and industrial protocols, we will show how to do it industrial red teaming in a real lab environment, which took days for Serkan and got all during these sessions. Basically, we have two different scenarios for this presentation, one of them extracting data from config files without further reverse engineering or further implementation of anything. And think about that, you have some type of configuration files, you don't have any access to OT environment or substation yet, but you will figure out some type of data to plan your next session of red teaming activities. We have a specific example of that. Since I discussed deeply and very detailed the last table, I don't want to discuss it losing any time on that. So I will jump into the next one because we will discuss it real scenario. The yet another scenario for this session is the remote substation protocol attack. In that case, the attacker needs to interact with the substation equipments. It can be done via Raspberry Pi implementation and connect through the Wi-Fi and so on, like we did in our lab environment. And we will shutdown the electricity using the protocol commands. Once we understand what kind of protocols used and how once we understand the protocols, we will figure it out to where to send the data and finally send the data to shutdown the electricity. To have better understanding each other, what we are trying to say, if you are planning to red teaming activity in a power distribution company or assessment, you need to understand the process, you need to understand architecture, you need to understand the landscape. Once you have a tree element, then you can create your scenarios. You need to think out of the box, but that box doesn't mean you can go out public safety rules or process safety rules. So it's really hard to balance. And we want to give you some simple ideas to reach out your end goal, rather than implementing some IT-based or IT-related red teaming activities. I think I can be free from now and put second into fire. As a tradition, we face to face with the Murphy's room. But finally we succeed on the setup lab. Now I have given information about lab setup. It's a very simple part of substation process. We have one R2, ABB 1 for 0, and one ID device, one SCADA server, SCADA PCs, and also one switch. We use care player software as a SCADA master. And also we use MOTLAS-TSP protocol and also IS-1 over 4 protocol. MOTLAS-TSP use an ID device between R2 and IS-1 over 4. We use it R2 between SCADA, ESM, Kepler device. The tricky part is the heart implemented hardware substation as an attacker. We think that we have some Raspberry Pi device or the other device as attacker machine. Before jumping into details, I would like to mention that this setup doesn't indicate any one of these on ABB R2s. It's just a simple R2 that we could use on the market and we know how to configure it. So we will do some protocol based simulation, but it doesn't just affect the ABB. It's based on we leverage of the protocol usage actually to avoid any misunderstanding. And also it is very common R2 used in Europe and Asian sites. And also this is the second reason we chose this R2. Now we can jump into the labs videos. All right. So we will start with interfaces and signals. The first video is about configuration R2. I jump into that just a second. Yes, we use R2 until 500 software for programming R2, configuration R2. We created it before an open existing project. This part a little bit takes time. It may be boring. They hide the project file deep inside my file system. Yes. And Turkish character error now. This is the R2 util 500 software interface. This is the network tree. We have three communication line. One is IS-104 for SCADA communication. The other one is MOTPASS TCP for ID device MOTPASS communication line. You can easily see that some parameter of the communication protocol. Yes, it is the 1-on-4 communication protocol setup. As you see that ASTRO address, ASTRO address structure, informal structure, maximum length of idle. And then this is the MOTPASS TCP site configuration. This is the network tree. Now we are in the hardware tree. In the hardware site we choose our R2 main CPU model and also we add the field level signal information in that site, hardware site. And also as you see that the MOTPASS TCP communication configuration zone. This is the IP address of the ID device. And also again 1-on-4 configuration section. Now this is the R2 interfaces. It has two eternal interfaces. As you see that IP address of the interfaces. And this site we configured our field level signal like an active power. That is the MOTPASS site with holding register index number 13. And this is the SCADA IS-104 site. ASTRO address 1 information object address 103. And the other signal like phase A current, phase B current. We record all and show the all parameters of the signal because we may want the MOTPASS signal on-lub and maybe you want to replay your on-lub. So we wanted to give you brief info in this section. The other sections will be much, much faster let's say. But once you understand that part configuration it's much more easier to understand the rest of the simulation. This is the type of the MOTPASS signal. As you see that's force commands, signal commands. And register read cost status with cost as used for the information single point information. Digital input like position of circuit breaker. And switch control means that sends control command to the circuit breaker. Power limit set point. And the other meter inch information. Phase A current, phase B current, phase C current. It's a very simple model of the substation. So we can jump into the second one. Second phase report. In this report we directly connect the radio web interfaces. As you see that's this is the IP address of the first internet interface. Use username and password. In that site you can easily see that configuration management site. You'll see that the configuration file. Which configuration is now active. When you update this configuration file and also get configuration file from the device and also delete this configuration etc. And also directly on site you can easily monitor signal system log, system event status and client session log. And also hardware tree. Hardware tree is the live monitoring about R2. Especially in the site you see that R2 is active. R2 is operable means that it's connected to ID device. As you see that's CPI switch position is on. And also meter inch information about systems. It is live data. Real-time data. Now I can talk about a little bit configuration file if you wish. Our third video related the configuration file and extracting some data. Again it doesn't integrate any vulnerabilities on the R2. But somehow if you reach out backup systems or if you reach out the file server and the IT system. Once we have a configuration file now we will download it and extract some data from it. It's really easy actually before furthering reverse engineering implementation. In that case we are not into the remote substation. We are not in the control room. Somehow we get data about the configuration file. It can be engineering workstation file server again or backup system. Maybe engineering partner workstation. Once I get the configuration file I am directly able to see what kind of R2 is used. What version and what purpose they are using. What kind of interfaces and what kind of IP addresses they have. And also what kind of protocols they have. It will affect my further planning actually in the red teaming activity. What kind of devices connected with that R2 in substation. And what kind of signal parameters they are looking for it. So once I have that information without any probing any scanning activity or any physical attachment it's really leverage of your efforts once you have that kind of specific knowledge. We have also some specific projects that reverse engineering to read all the data not people readable format at the moment. You have much more better information than knowledge about the targeted system. So in that case we want to show you you don't need to go to the control center or remote substation. Somehow if you are able to get config files you may read directly with the not bad plus plus and read some data understand the process understand the protocols interfaces and plan a better red teaming activity or targeted attack into the targeted system. So I will jump into your part sir. Yes before we do is about the normal traditional application and communication with SCADA systems and R2 first of all I would like show to my IP address and same subnet with the R2 interface one and then we use set before kept server as a SCADA software SCADA master program. This is the configuration of the master sites kept their sites kept server sites configuration file as we see that communication address common address advanced settings network interface as we have same subnet same address more advanced parameter for IC 1 and 4 originator address like and also network interface. Network interface means that it's the IP of the radio and the port of the IC 1 over 4 and this site we also configure our signal this means that it is analog short float volume Astralis one over three and so it is the breaker control command command single command means j cj. Actually it will directly affect the open and close breakers later than we will apply some scenarios. It's really important to understand what type of parameter and what type of commands they take. Now we connected to R2 as you see that this is the real-time data as you see active power 2400 and also breaker control is zero breaker pulse is one means that the closed now we sent the breaker control control command is one yes it takes the commands in the real-time and real-time operation when we sent this command we reanalyzed circuit breaker or shut down the circuit breaker with this command and also I would like to show some wire shark traffics between Kepler and R2 this is the Ethernet we apply our display filter for IS-104 yes as you see that this is the test frame in the protocol now we recent the command again and show the traffic yes this is command single command Astralis one over seven as you see that this is the wire shark single command address is one IO address is 107 and also set command value is zero as you see you can easily get this information from the wire shark because the IS-104 is an open text protocol not encrypted or hashing port hash protocol you can easily get information from the traffic in that case you see that the single or double command take place in IS-104 in that case we sent the specific shutdown or open command in a targeted area in case it was zero it means we shut down the electricity through a legitimate traffic I mean it was a traffic generated by the control center now we will try to apply as a attacker point of view who is in the remote substation via implemented hardware this is a five video of us yes we have information about the second interface about R2 now in the attacker machine I configure my IP address for the second interface of the R2 as you see now I use M-MAP for some research and some search vulnerability or open ports in that case we are looking for who has an IOC-104 in that case in that protocol use specific ports if nobody changes so we are looking for in the same subnet if someone has that specific protocol please be aware it's an attacker point of view and cut into the substation looking for some IOC-104 endpoints and two devices we found it this is the R2 device as you see from the IP address and also IS-104 is open port and also services up but now we have only information about R2's protocols and R2's IP address but we don't any information about the signal and signal address now we use capware again we configure capware again as you see we tried it one now it's connected to R2 now in the protocol structure we have general integration commands when we send this command R2 get a response and send all information about in this R2 insight we send GI commands to the R2 I don't know any information about the object address but when we send this command R2 response to these commands and now we can easily observe which address and which type of information inside of it as you see that so this is one IO address is 100 and value is also as you see 332 etc etc so basically protocol gives an opportunity to us to pull all kind of signals and data from the R2 for a specific protocol line as an attacker we use exact same tool but it's simulation environment again you can use your lab environment that specific tool yet another tool we have it's developed by I think the master degree student in Germany they called ISE test and to be make sure all of you we will send the legs command through the depth as specific tool connect again R2 now we send command again get information from terrific and also we send commands to 107 as you see from wire shack traffic we send commands and also on of on commands and also as you from terrific it is action confirmation from the R2 in number of line 18 and 37 this means that's R2 accept this comment once you get into the substation you pull data through the protocol and you send the command through the protocol again in that case single commander double command supported by the 104 and then you are able to shut down the electricity in that case if it's your end goal you may apply very different type of scenarios and redeeming activities but we want to show you that it can be done there are some safety mechanisms or configuration mechanisms to avoid it sometimes you implement the IP based solution or animal detection solution to count that kind of activities so in the station we are end of our presentation with takeaways we would like to stress out during great teaming activity we need to think out of the box but we still need to take care of public and process safety it's really a rule of thumb for us power distribution environment is not complicated as process wise when compared to power plants or petrochemical but it has direct effect of the other critical infrastructures and customers directly power distribution companies have lots of different interdependencies therefore information getters career role for red teaming activities and power distribution companies easy to target and easy to defend compared to other ICS infrastructure so we have two minutes left if you have any questions please feel free to ask we will go on discord as well as well as well as we can so Sarkand if you have any comment please do it or we can get questions if you have any questions we are we will be in discord we will be happy for your answer for your questions John and Sarkand thank you for your talk I noted in the discord speaker q&a that I consider this a mandatory talk to watch for both learning about one-on-one and assessments so really really appreciate y'all dying dialing in and supporting us thank you very much having us I hope you enjoy


Every life form starts with a birth. In this case, Cobalt 60 is being born. This is a radioactive isotope. It's being created at a nuclear research reactor. Radioactive isotopes occur naturally or can be produced like this artificially. The creation of Cobalt 60 begins with Cobalt 59. The natural stable isotope of this chemical element. Before irradiation, it needs to be carefully prepared and packaged. When ready, it can begin the next stage of its journey into a reactor core. Here, the radioactive isotope is produced by bombarding the Cobalt 59 pellets with neutrons. Unlike stable isotopes, radioactive isotopes decay over time and release ionizing radiation. These rays can be used for many beneficial purposes in medicine, industry and agriculture. Before a radioactive isotope can be used as a sealed source, it needs to go through a process called encapsulation. Cobalt 60 pellets are transferred into individual capsules and welded. Then it's time for the source to begin the next phase of its life. It needs to get to work. It can be put into various devices. These provide the shielding that protects the operators but allows the radiation beam to enter the targeted area or object. In industry, equipment containing a sealed source can be used for industrial radiography. This method can check the quality of wells in sections of pipelines or pressure vessels. In agriculture, a source can be used in irradiators for a variety of purposes. For example, plant breeding, where gamma rays are used to induce positive changes in seeds. Or to sterilize male insects to suppress populations of pests that can destroy fruit fields or make livestock sick. In medicine, sources are used in machines which treat cancer. The radiation the sources emit is used to kill cancerous tumours. High activity sources are used in commercial irradiation facilities to sterilize medical supplies and preserve food. The radiation destroys parasites and pests. It kills the microorganisms that can lead to wastage and food poisoning. After years of activity, there comes a time when a radioactive source can no longer be used. This could be because its remaining radioactivity is no longer strong enough for its original purpose. Or if the devices containing sources are damaged or obsolete. Eventually, sources need to be treated as radioactive waste. When managed properly, the next phase in the life of the source is conditioning. This prepares radioactive waste for safe and secure storage and eventual disposal. Conditioning usually involves the careful removal of the source from each individual device. Once the source is out, it's necessary to identify the type of radioactive isotope it contains, the dose rate and radioactivity level. Such information is essential for an inventory. Conditioning greatly reduces the volume of radioactive waste since multiple sources can be stored in one capsule. And a long-term storage container can hold several of these. After conditioning, the old devices can be handled like conventional waste. Following conditioning, disused sources can be placed in long-term storage facilities where they will remain until a disposal facility is established. Some countries already have disposal sites where sources such as low-activity cobalt-60 can be safely put to rest. When a disposal pit is full, it will be filled with concrete and permanently sealed, bringing to an end the lifespan of a radioactive source. Practically all countries in the world use radioactive sources, but many need to improve their management strategies. If sources aren't controlled properly, they pose a threat to human health and the environment. The International Atomic Energy Agency, the IAEA, is helping countries to develop effective, safe and secure control systems for their radioactive sources. It does this by providing training to radioactive waste management experts from around the world. Such meetings offer the participants the opportunity to gain theoretical knowledge and practical experience. IAEA experts give direct assistance by conducting conditioning missions to help countries prepare disused radioactive sources for storage and disposal. Together with external partners, the IAEA has developed new technologies such as the mobile hot cell. This is a shielded radiation chamber that can be deployed worldwide and used to condition high activity sources. The IAEA has also conceived a new system known as the borehole disposal concept. This involves the drilling of a borehole into the ground, the depth will depend on the amount of sources and on geological conditions. Especially constructed casing will be placed inside the hole and surrounded by grout. Containers filled with disused and conditioned sources will be loaded into the borehole. Once the hole is full, it will be filled with concrete and sealed. With IAEA support, several countries are already developing this system. Radioactive sources have become an indispensable part of daily life. When properly managed, the benefits they provide are far greater than the problems that could arise. With IAEA support, countries can develop systems to keep sources safely and securely under control from the cradle to the grave.


Hello, everyone. Welcome again to OSS. It's Friday. It's lunchtime. Thank you for coming to our session. So my name is Yixiong. I'm with Futureware Technologies. My teammate, Macaulay, Eunice here as well, we're going to present and talk about Quark, a new high-performance and secure container. Here is the agenda that we have prepared for our talk. I will get started with introduction and background and introduce ourselves a little bit and give some background of why we're building these new Quark containers. And then Eunice will take over. He will talk about the Quark design, Quark architecture and he will explain the difference between the Quark container with other open-source containers. We have some performance test data to compare the Quark and with other open-source containers project. And Eunice will also show and analyze some of the performance data. There are some very interesting features to building into Quark containers, mainly for performance optimization. Again, Eunice will also talk about that, especially for RDMA communication. Hopefully at the end, we'll have time to answer questions you may have. So who are we? So again, my name is Eunice, we are part of CloudLab at Futureway. And Futureway is an R&D organization that focuses on open research, open innovation, open standards, of course the open-source project. Currently, I'm leading the CloudLab and Eunice is one of the chief architect in our lab. So CloudLab, by the name, we built and optimized Cloud-related open-source project. And here I show some of the examples of the open-source project we have worked on. Some of the project we're still working on. One goes through each of them in detail. But I do want to mention one of the projects called Centaurus. This is a new two years old project focused on Cloud Infrastructure project. And this is actually a Linux Foundation project we donated in 2020 to Linux Foundation. So it's a Linux Foundation Cloud Infrastructure project. The Centaurus project actually has four or five, in fact, the sub-projects, and they're focused on different domains. Arktos is for Cloud Compute and MISA is for the Cloud Network. We had two sessions yesterday and the day before yesterday, Wednesday, to talk about MISA. And then we have, of course, one project for AI, one project for Edge. So please go to the website, Centaurusinstruct.io if you want to know more information more about this project. Now back to today's talk. So what is Quark? So first, Quark is an OCI-compatible container runtime engine. Now OCI standard for Open Container Initiative is an open industrial standard for container runtime and container format. So it has two specifications. One specification for runtime specification, the other specification is for the format for image. So when I say Quark is compatible with OCI, it means that given a Docker image, we can run your applications with Docker image within the Quark containers. Quark also provides VM-level isolation and security, such as semi-like Cata. For those who have not heard about Cata or Cata containers or don't know about Cata containers, Cata is a secure container with lightweight virtual machine that feel like and perform like a container, but it's actually a lightweight virtual machine that provides high, strong isolation for the work node using the hardware virtualization technology like a hypervisor. So basically it is a virtual machine. Now Quark is quite different than Cata. You need to talk about more about the difference. We also have, again, test data to show the difference, the performance difference between the Quark and the Cata. Now Quark also supports RDMA communication for container network between containers. When I say transparent, I mean for user, they don't need the changing code. They need to use TCP-IP socket to communicate from one container to another container, but underneath it, when you're running on the Quark container environment, underneath it, we use an RDMA connection, which provides much better performance networking when we talk about then go through the TCP whole stack. Now Quark is also developed using Rust programming language, which is considered secure, multi-secure language than other programming language. Of course, Quark is open source, and please check out the github.com with the link provided in this slide. So you may ask why we are building another containers, why we have Cata container from Cata community, device from Google, Web assembly. In years to this keynote, Matt from a Web assembly company he showcased a Web assembly-based microservices that start up within one millisecond. He literally said one millisecond to start up a Web assembly application. So why we need a Quark? Now before I answer the question, let's look at some of the requirements we have and the use case we have for high performance and secure containers. First is the serverless requirement. We have a serverless container platform where we run customers' serverless functions, serverless applications that within a shared cluster due to the multi-tenancy requirement, we have the run customers' functions within a secure container so that they don't impact each other. Currently, we do use Cata as the secure container in our platform. However, like many Cata users, we encounter some of the performance issues. It's very heavy because it's a VM and it's taken a long time to start up. It doesn't meet our serverless platform requirement. So the team is looking for, we're looking for something to replace Cata. The second is no lightweight low overhead containers for edge applications. So on the edge server, the resources are very limited, especially in our case, memory resources is very limited. So the team, our edge platform, looking for a new containers that has not waited, replaced the containers that you're using today, which is Docker. High performance container networking, mainly driven for AI and other network-sensitive applications. For the AI machine learning training jobs and running on the platforms, the communication between the training tasks has a huge impact on the performance. And they are looking for something to high-performance container network. So we bundle orders and we decide, hey, we may need a new containers. But how about GVISOR from Google? Well, GVISOR is a potential solution for us, in fact. However, GVISOR design has its own limitation and a performance issue. And we need to talk more about this. And we have a test data to compare our quad containers with GVISORs with Cata, and so far as from preliminary results, and we have much better performance than GVISORs. And there's also a news that GVISOR is also going to be implemented in Rust language. But that's just the news. Now, how about WebAssembly? Well, when the clock was started almost two years ago, WebAssembly was considered as a container for browsers. It was only running browser. Today, I don't think they still... they still doesn't support the multi-threading, the network IO access. So we are not sure this is actually ready for business-critical enterprise application. But the community is working very hard, and they try to make it as a mainstream for cloud computing. For us, we don't think Quark and WebAssembly is mutually exclusive. Technically speaking, we can run WebAssembly code within the Quark containers. But that's a whole not a story, and of course it's out of scope for today's talk. And we are actually working with... talking to some of the WebAssembly companies to see whether there's a potential that can collaborate and integrate these two together so that Quark can support the WebAssembly backcode. So this is a basic, simple background and introduction. Now I'm turning it all over to Yunin. He's talking more about the Quark itself, the design, the architecture, the difference between the Quark containers and the g-visors and the cutters. There you go. Yeah, let me go to the Quarks architecture and design. Yeah. Quark's goal is to provide secure high performance and the Linux-compatible container runtime. For the compatible, we hope that Quark can run the Linux container just like the RunC, just like Docker, without changing. And actually, just like Linux kernel, it provides a Linux system car interface, and we hope it is a Linux-compatible system car interface. It also integrates with the CNCF tools, like Docker, Kubernetes. It supports OCI and CRI interface so that we can use Kubernetes and Docker and CRI to schedule it. Another thing, unlike RunC, we hope it is secure. It is secure like the current water machine level isolation. So it is based on, just like the Linux water machine, it is based on KVM water machine isolation. And it is very basic, the secure program language that's Rust. The next is performance. We hope we can provide high performance container runtime. Actually, because Quark needs to be part of secure, so secure is not free. So if we want to get high performance, we do some trade-off on that. So we compromise some containers, users' scope. For example, RunC sometimes is just like a common Linux process. It can run in embedded device, it can run the mobile phone. But Quark is optimized only for the cloud native application and running in the server environment. And next, I will give more detail on how we do the optimization for the cloud native application. Let's go to the architecture. Actually, Quark's architecture is like the Linux water machine. There are four layers. The bottom layer is the Linux host kernel. And the next is VMM, that's the water machine monitor. That guides the kernel, that guides the application. For the Linux machine, the VMM is the QML. And the guest kernel is the Linux kernel. And the Linux container application, which are the same Linux container application. The Linux water machine's virtualization happened at the device, at between QML and the Linux kernel. That QML provides device virtualization. For QML, it can support Linux kernel, support Windows kernel. And they just virtualize it just like a real machine so that the other OS kernel can run over that. And Quark is different than that. Quark, virtualization happened at the system core layer. That's between the Linux container application to the guest kernel. Quark can be considered as a virtualized user space OS kernel. It intercepts the system core. Just use the S86 system core instrument. And based on that, we do the virtualization. And Quark, unlike the Linux water machine, Quark's implementation includes Q-Kernel and Q-Weiser. Q-Weiser is just the VMM. And Q-Kernel is the guest kernel. But different than the Linux water machine, Q-Kernel knows that it's running over the Q-Weiser. And Q-Weiser knows it's running over the Linux kernel. So it's not designed to run on any real hardware. It's just running over the Linux host kernel. So that based on that, we can do some optimization on that. Later I can give more detail on that. Here. We can consider that Quark, just a user space, virtualized OS kernel. Just like common Linux kernel and other for Windows kernel, it has OS components, like memory management. It's just like other common kernel. It's based on the pager table, have pager fault, and it will copy on right, et cetera. It also has task manager. It has process manager, thread manager. For the Quark, it supports the Linux process and thread semantic. It also has fast system, has IO system, like a common OS kernel. For the performance part, because Quark and the Linux water machine all use the S86 virtual VM instrument. So for the CPU part, there's no much difference. For the memory part, they all run with the KVM shadow pager table. There's no much difference, too. The major performance optimization part is at IO side. For example, the IO include disk IO and the network IO. For example, the IO that's container application want to send some data to the remote. What he needs to do is that container application should send the data first to the guest kernel, and then guest kernel send it to the host application. Then host application send to the host kernel, then go to the hardware. The normal way to do this sending needs the context switch between the guest and the host. The common standard way to do that is to go through the hypercars. That's the standard terminology in the virtual machine side. Quark supports that. But hypercars have some performance issues. Hypercars need to do the guest and the host context switch. It includes the store mining register into the memory. The register includes the float register. It may be more than 1kb in the store in the memory. It also includes the page table switch. The cost is pretty high. Because Quark implemented this kind of system car virtualization, the guest kernel and the host VMM know they are working together, so we can do some optimization on that. For this kind of guest kernel to the host communication, we implement another mechanism that's Quark call, that Q call. The idea is that we use memory map to create a queue between the queue kernel and the queue wizard. When queue kernel wants to send some request to the queue wizard, he just sends it to the queue. In the host side, we have a dedicated thread to get the request and process that. Before the request is processed, the queue kernel's virtual machine can switch to another task, because we have our own task manager. When the queue wizard finishes this IO request, he will just schedule the task to the ready queue, and then queue kernel can schedule it later. Based on that, we don't need to do the contest switch, so we can get better performance. The next is your car. We can get better performance with your car. That's IO urine car. IO urine is the new IO infrastructure in the Linux that just appeared a few years. It is the fastest IO mechanism now in the Linux. It's faster than the EPUL, than the PPUL, than the select, this kind of async IO infrastructure. The basic idea is that the IO urine is created a shared memory queue between the application and the kernel. When the application wants to do some IO request, he just puts the request in the queue, and the kernel thread will take it and process it. Quark uses this thing, too. The basic idea is that Quark just maps the IO urine shared memory queue to the queue kernel, so that queue kernel can send the request to the Linux kernel directly, and then Linux kernel can process it so that we can bypass the queue wizard so we can have better performance. Furthermore, we have another IO car, that's the RDME car. RDME later I can get more detail. Based on RDME car, queue kernel can send the consenting data to the device, RDME leak directly, bypass the Linux kernel and get better performance for the model. This is IO optimization. Based on that, we can get better performance. This is some test result we tested before. Because Quark is designed to run a service application, one-dimension problem dimension is the memory overhead. We can see that Quark's memory overhead, this overhead is over the wrong C. Quark takes maybe twice as much memory over the wrong C to run a small container. And the device takes 28, that's almost twice of the Quark. And Cata, because this is a full Linux kernel, so it takes much more than the Quark. Next is the startup latency. For the service application, we hope we can start the container as quick as possible. And we can see that the wrong C's startup latency is about 600 milliseconds. And Quark is about 20 milliseconds or that. So almost the same. And the device is 700. And the Cata is full Linux kernel, so it's the most slow. We also do some throughput tests for the Quark. We use the Radius, etcd, and the NJX benchmark to do tests. For the Radius, we use the Radius benchmark. etcd, they have a benchmark named benchmark. For the Radius, the type result is compiled with wrong C. Wrong C has so many benchmark, for example, for the PIN, for the SAT guide. This 100% is... We do the comparison with the wrong C throughput. Wrong C is 100%. And if the Quark is slower than that, that's maybe 90%, etcd. This chart is about that. And we can see, for the Radius, Cata and Quark is almost like wrong C. A little over that and a little under that. But the device is slow. And for the etcd, similar thing, we can find that wrong C is much better. In some scenarios, it's better than the Quark, the device and the Cata. But the majority of the scenarios, the Quark is better than the device and the Cata. For the NJX one, that's the most interesting. Wrong C is much better than the Quark. Wrong C is 34K, RPS 34, but the Quark is 20. And the device is 10. The Quark is twice of the device, but the Cata is very slow. I don't know why, but it's super slow. So far, Quark has some optimization already done that. And it's already reached about 30K. That's just 10% less than the wrong C. But because we need some manual configuration, so we didn't put the result here. Here we can see that very likely that wrong C is Quark's performance rule. We cannot accept wrong C's performance. It is easy to explain. Because Quark is also just a Linux process running inside Linux container. So its performance is hard to accept Linux container. It's almost impossible. But because Quark is designed for the container application and running inside the server environment, running inside the data center, maybe we can get some opportunity for that. One opportunity is the TCP or RDMA. Let me give some initial introduction about RDMA. For the normal TCP, in the left side, that's the normal TCP. That's the data transfer between one machine to another machine. When application want to send data to another machine with TCP, it needs to send data to the socket and socket to the TCP IP proto stack.  It needs to go through NIC, proto stack, and socket, then go to the application. But RDMA is simple. RDMA can support to send a user space memory to a remote memory so that it can bypass the Linux kernel. And then we can get a lower latency and a higher throughput. But all this performance improvement is based on less CPU consumption. It is so good, but we didn't use that in the cloud native application. It's because for our cloud native application, when we use the network, we use TCP-based RPC, like TRPC, like HTTP. And the RDMA interface, API interface is different than TCP. So if they want to use RMA, they need to do the core change. It takes time to do that. First of all, for the cloud native application, when they run in the Kubernetes, there's more challenge. Because in the Kubernetes, we have container network visualization. One container has one virtual IP. And when the client needs to talk with his server, he needs a service discovery to find the server IP because this is a part of the startup at a wrong time. We don't know SAP. If we want to use the RDMA-supported, we need to solve both of these issues. First is the API compatibility, another is container network visualization. Quark tried to solve this issue with these two steps. First is TCP socket visualization, another is container network integration. Because Quark implemented this kind of system call virtualization, it can intercept the system call from the application. When the client application wants to send some data to remote, he needs to use a CIS call, like a CIS send. The CIS send will copy the user's buffer to the kernel buffer. If you go through TCP-IP protocol stack, this kernel buffer will send to your TCP-IP protocol stack and to the remote. But with Quark, because Quark intercepted the system call, it's Quark's role to explain how to implement this send. It can use TCP-IP stack, also can use RDMA. With RDMA, Quark just sends this kernel buffer to a remote kernel buffer. Just use RDMA, send it, so that it can bypass all the no matter-length host protocol stack, all the application protocol stack. They just bypass that. Next is the container network integration. Actually, this is our current implementation architecture. For each machine, we have one that's RDMA service. That's a shared memory connection connected to all the Quark container. And the Quark container sends the data to this Quark RDMA service. And the RDMA service sets up this RDMA connection to all the other nodes. And based on this our node, that's all the TCP connection is built over this RDMA connection. That's multiple TCP connection can build over one single, that's RDMA connection. And we can get better performance. And we also do the integration with the Kubernetes that's the API server. And then we can integrate with the Kubernetes container network. We have done some, we have done majority code for that. And it's working on the performance test and the function tuning for this solution. So far, the initial test that the TCP or RDMA performance is better than container network. The container network is the part mapping, just over the Linux part mapping over the Linux bridge. It's performance better than that. But not better performance is not, it's not meet our requirement. It's not exceed so much. So we are still doing problem tuning. And in some scenario, performance is also better than the host network. Our metal machine in the host network is something else better than that. But not all of them. But this one place is much better than both of them is that the TCP connection set up time. When we set up a TCP connection, connect to another, connect to a server, the RDMA connection is much faster than them. For the host network, maybe the TCP connection latency is 300 microsecond to maybe 500 microsecond. But the RDMA connection just takes 50 or 60 microsecond. We are continuing to work on that to improve performance. Next is optimization for the service mesh. Service mesh is popular now. And it just adds the flexibility in the container programming and the production maintenance. But this flexibility needs to pay the price. That's the performance. So far, the major service mesh implementation is based on set of car. That is the client, the TCP client, send the data to the remote server. The TCP connection is intercepted by the set of car in his machine. And then the connection will send it to the remote set of car. Remote set of car send the data to the remote server. The intercept is based on the IP table. The IP table, the data transfer between the client and the set of car is the inter-process communication. It introduces a match that's memory copy. The performance is low and latency is high. So it is decreased. So it introduces that's actually two TCP hops. So the performance is bad. But for the quark, it can implement a better implementation for this service mesh. Actually, because the quark can do the system car intercept, so the system intercept, that means they get the user's data before they use the segment to the IP packet. And it just gets the data from the application directly. And they can check the ITB header and can find the remote IP address and just send it. So they can implement the psychological inside the Q-cernel. And based on that, so there's no extra hop between the client and server. So they can get a better performance. That's higher throughput and lower latency. This is for service mesh. Next is for the two-stage container start process. As I mentioned that quark is a kind of user-based virtualized OS kernel. So we can do some optimization that's maybe harder for Linux kernel to implement. For example, for this two-stage container start. For the service application, we hope we run the multi-tenant application in a shared resource environment. That's different. And when the tenant's traffic come in, and we start the container for this tenant as soon as possible, as quickly as possible, we can execute that. And so we can get better performance. But there are two types of the container start. One is the cold start. That is, we just start the start container from zero. It takes a long time to start it. Another way to do that is to warm up, warm start. That means we start the container beforehand and just put the container there and waiting for the customer's traffic. It is fast, but the lower hand of that is that each of these are already sourced. Even there's no traffic. The CPU usage is zero, but because each of these are all the CPU and all the memory, so the customer need to pay for that. And can we have some, another way to do this container start between the cold start and the warm start? That's what we can do as a two-stage container start. Let's go to the container start itself. As a container start, I have two stages. First is the send-off setup. The send-off is the Kubernetes. That's the CRI send-off definition. It includes, first, schedule the container. That's to choose the node and notify the node start container. And the node will download the image and decompress that. And then they need to set up a network and register the load balancer, et cetera. And then the container needs to start. It needs to create a Linux namespace, create a C-group among the file system and load the ERF. After that, the send-off start is finished. After that, it goes to the application start. For the application start, the Linux kernel will just change the CPU's IP register to the application's entry point. And the Linux application will take over the CPU control and start to run that, include the memory allocation and run the application, and waiting for the customer traffic. For the stage one, actually, memory usage is low, because it's just that the send-off consumes the memory, and it's controllable. And the latency is high. It'll take maybe 100 milliseconds to maybe 10 seconds, because they need to download the image sometime. So because we can take that quark as the user space that's OS kernel, we can do some hack here. For example, we can start the whole sandbox and block before the entry point, before we enter the entry point. At that time, we have another state for this container. It's not a core start, not a warm start. It's just between them. And in this state, customer already finished, we already set up the sandbox, but we didn't enter the user's application. So user application cannot consume the CPU. User application didn't consume any memory so far. So we can use the memory usage as the sandbox. That's about 20 megabytes. So when the customer traffic is coming in, and we can just load the... We can enter the application's entry point and the start application. So we can have a lower latency than the core start. Actually, we can do more aggressive way to do that. Because quark can also handle the page table management, like the page fault. If there's a missing page, there's just a page fault and a locate memory for that. So they know how much user's application consumes the memory. And they can also block the user's application to run anytime. So we can also use the more aggressive way to run the user's application. For example, we can block the user application when they consume some memory, for example, 20 megabytes or 50 megabytes. When they consume so much, we stop it and block it there. So based on that, we can... We can continue to minimize his application start-up, start-up time. So the cost that we consume, the 20 megabytes or the 50 megabytes memory, but it takes less start-up time. So it's just giving more flexibility to the system, to the service schedule. This is some promise of optimization for the quark. This is all my talk. Any more questions? Yeah, thank you, Euni. I think hopefully we have time for open for questions. You may have. The quark is very detailed. Thank you for explaining. We have one question. I'm sorry, I have a hard time to listen to you. Can you repeat again? Let me repeat the question. The question is, is there any operating system that doesn't run the quark container? Is that right? Well, we try the Linux container OS, so we have not tried any other OS yet. So all things with building on Linux OS. We are not 100% compatible with the Linux kernel. So, you know, some application doesn't work with GWISER, so I'm wondering maybe some application just don't work with quark containers. Okay, that's a very good question. Let me repeat the question again. Were all applications run within quark? The answer just like GWISER? No. We implement maybe 70 to 80% of system call. That means that if your application using the system call does not, 80% or 70%, it will not run. But we believe 80% of application or cover 80% or maybe 90% of application for the system calls they have. That's a very good question. I think I say the stop sign. One more questions if you have? No? Okay. Thank you very much again for coming to the talk. Thank you.


A fiery horse with a speed of light, a cloud of dust, and a hearty high old silver, the Lone Ranger. With his faithful Indian companion, Tonto, the daring and resourceful masked rider of the plains led the fight for law and order in the early western United States. Nowhere in the pages of history can one find a greater champion of justice. Return with us now to those thrilling days of yesteryear. Out of the past come the thundering hoofbeats of the great horse, Silver. The Lone Ranger rides again. Come on, Silver! Let's go, we come! I am Silver! The Lone Ranger and Tonto had been instrumental in founding the town of Eureka. It was there that their old friend Barnaby Boggs made his home. His niece, Judy, lived with him. Judy, I declare I've been so all fired well-behaved during the past year that not even the Lone Ranger could have cause for complaint. I wonder if we'll ever see him again. Well, dear, I'll tell you. As long as Eureka is a well-run town, and with me as mayor, I don't expect he'll show up. I'm afraid not. But let there be some sign of underhanded crooked dealing, and you can start looking for him. But how will he know what's going on? Judy, that man has ways of knowing things and baffle understanding. I do declare there are times when I think he's psychic or something. Then we may be seeing him soon. What's that? Have you been watching those two crooks that he hoped would reform? Simon Richfield and Deek? Yes. But they've given no one any cause for complaint, dear. Model citizens, I'd call them. They were, until you were elected mayor of Eureka. Yeah, dare say that was a blow to Richfield. It was, and he's going to do something about it. I'll tell the new sheriff to keep an eye on him. Oh, Uncle Barnaby, you know Simon Richfield better than that. What do you mean? He won't give the law any cause to jail him. He's too smart for that.  You probably wouldn't take me seriously. I... Well, it's just something that I heard and a... I guess you'd call it a hunch. Dear, I'd call it a womanly intuition, and I'd take it seriously. Well, I was in the kitchen back of the cafe. Yes? The walls are thin, you know. Nearly a temporary structure. Anyway, there were two men in the little private office next to the kitchen, and I could hear them talking when they raised their voices. I recognized Richfield and Deak. To the point, Judy, get to the point. What did you hear them say? For some time, they talked in a low voice, and I couldn't make it out. In fact, I wasn't even interested until I heard Deak's chair fall over, and he spoke so loudly that I could hear every word. How many times have I got to tell you I don't want any part of it?  Well, I'm out of jail, and I'm not being hunted by the law. I'm satisfied with things as they are. Well, I'm not. I can't stay here and grow Mars. You can do what you want, but don't count on me. Don't worry, I won't. From now on, you go your way, and I'll go mine. That suits me. But remember just one thing, Deak. You squeal on me, it'll be the last time you'll talk to anyone. Nah, how can I squeal? I don't know your plan. Get them out without hearing it. That's typical of you. You said it was a scheme to get Rich into a hurry. That's enough for me. I don't want to know what the plan is. And that was all I could hear, Uncle Barnaby.  Awful curious. I suppose I might question Deak. But then, according to what you heard, he doesn't know what Rich feels up to. Deak left Eureka a little while ago. Left town? For keeps, I think. He took everything he owned with him. I see. I'll see who that is.   Yes? How do you do, young lady? My name is Bowers, Jake Bowers. Yes? I just arrived in your town. I'm looking for a gentleman named Richfield, Simon Richfield. You know where I might find him? He's generally in the cafe at this time of day. Thank you. I'll look there. By the way, Richfield, don't you have a partner named Deak? He got cold feet left out. Old feet? Without even knowing the plan I had in mind. He's got ideas of staying honest. As for me, I prefer the things that money can buy. I can count on you. I told you that in my last letter. You didn't come all the way out here without knowing about me did you? No, I didn't. I checked up on you. We'll then get to the point. What is this big idea of yours? Richfield, how would you like to be a banker? A banker? If I wanted to go into business, I'd open a cafe. There's more money in banking. That calls for proof. I mean, my kind of banking? I'll talk sense powers to open a bank with neat capital and the charity and the score for the things. That, sir, is where you're wrong. All you need is a large room and a safe in which to keep the money. I've already lined up a place in Junction City. That's three days away. My home is here. Mm-hmm, to be sure. You'll open the bank here and I shall do the same in Junction City. Now, with two banks, we can maneuver things to make a fortune. Maybe you know what you're talking about. Go on, tell you what to start. You see, I have a connection with a printer that can make paper money for us. You don't mean kind of anything. Oh, by no means. We issue notes on our own banks. Junction City bank notes and Eureka bank notes. People deposit gold and silver money. We give them paper money. How far would the law let us go? Oh, it's quite legal. Banks all over the country issue their own currency. There's nothing wrong about it as long as there's gold to bag it up. Uh-huh. I'm learning things. Eh, what if someone comes in and wants to exchange that paper money? You exchange it for notes issued by my bank in Junction City. I, in turn, swap it for notes issued by the Eureka bank. Then they'll have to go to Junction City to cash those notes, eh? Of course. They do make the three-day trip and if there's no alternative, I'll give them gold up to a certain point. Always I think you have an idea. Yes, sir, a good idea. Now let's get down to the details. A few weeks later, there was a bank in the town of Eureka. Barnaby Boggs eyed Simon Richfield with suspicion but found no indication of anything illegal. The paper money was in circulation and was accepted by the townspeople. Boggs, however, wasn't satisfied.  Now look, Barnaby, why don't you just figure that maybe Richfield might have had crooked plans and dropped him? He's turned out to be a right helpful citizen in this year's town. Yeah, maybe I've been wrong. Maybe so. To tell the truth, Boggs, I'd sooner trust Richfield than not trust him. Especially if I was you. How's that? You've got together a tidy sum of care since you helped start this town. Oh, not so much. Don't tell me. I've heard about the poker games you've cleaned out. Who, me? On top of that, you've made some pretty fair deals in real estate. You must have several thousand dollars in your house. Not so loud, Sheriff. You see, you are nervous about it. Well, if I was you, I'd take a chance on Richfield's bank sooner than on thieves breaking into the house. There's already been several robberies around here. Even as the sheriff spoke, there were thieves in the home of the mayor. They crept in through a rear door and entered the living room where Judy sat. Just keep still. No matter, we'll quiet you. What do you want? We didn't come to ask the time of day. Where's the old man keep his money? Thieves. You called it, lady. Now talk up and fast. We'll have to find a way to persuade you. You get out of here. My uncle will be back most any minute. And if he finds you here... That old tadpole better not come nowhere through. I'm hankering to see what it happened if a bullet hit that fat stomach of his. You killers. Where's the cash? I won't tell you. Let go of me. Talk. You're hurting my arm. Walker, by the lemon daylight, I'll do more and hurt it. Red, keep watch out of that window. Yeah, I'll watch. Go on. Make her tail box hide in place. You beast. You'll pay for that. Are you ready to talk? No. Not even if you twist my arm off, I won't do it. Hey, what is it? Someone's coming here. Good. Hey, where in a mask? A mask? Let me see. You come to the window with me? He's rained up right outside the house. Come in here, sure enough. Now you'll get with him. You listen to me. You so much as open your face and I'll shoot. We ain't fooling about this, see? Red, get your gun and stand ready. Right. We all fix things, so is that mask. Omri gets the blame for this. Curious that he'd wrap being masked and all. Make the girl tell him to walk right in. You heard what my pal said. Tell him to open the door and walk in. I'll nail him the minute he steps inside.  Look, I'll see. Why are you... I'm in shooting.  Get him. I'll get you. I'll get you for that one. Leave it alone or I'll break your other arm. Help me. Either of you want any more. Are you ready? Well, how about it? You're going to compete to draw for your other gun? No. I'll draw it for you. There. Leave it on the table. You wouldn't be here if you hadn't ducked down. Judy, are you all right? Yes, I guess so. They were twisting my arm, but I guess it's all right. Who are these two? I never saw them before. They were after Uncle Barnaby's money. Does he keep it here in the house? Yes.  Oh, here comes the sheriff. Little late, isn't he? What's all the gunplay? What?  Steady, sheriff. Sheriff, not that man. There are your prisoners. Great day. Red Lofken and Spalcator. Never mind the talk. Texas Woon takes us to jail. Judy, Judy, that white horse out front. Hello, Barnaby. You. He saved your money. What happened to you, Judy? Oh, I'm all right. One of those pole cats slapped me, that's all. She shouted a warning that saved my life, Bugs. We'll deal with these crooks.  We're wounded. You get patched up when we get to the jail. Now shove on before I gun-slick your hair. I'll be over-large to form a complaint, Sheriff. Take your time, Bugs. They ain't going nowhere. I see. Their first bullet went through the glass and that door. Don't mind that. I'm grateful that you and Judy are safe. Well, uh, what's been doing all right, Barnaby? Huh? Eureka's grown since the last time I saw it. Yes, yes, it certainly has. Remember when it was just a lot of open ground? I tell you, things are booming. And you're the mayor? That's right. Mayor? Justice of peace, no republic with seal.  Uncle Barnaby is very grateful to you for all you did. You've made a good citizen of him. Hey, hold on. You must have had a reason for coming here. It's Richfield, isn't it? I, uh, see he's opened a bank. He has, and I for one suspect ulterior motive. Uncle Barnaby, no matter what you suspect, you're gonna put your money in that bank. I'll not go through another incident like this, this last one, simply because everyone knows you keep a lot of cash in the house. Now, just a moment, dear. Before you decide that Richfield's on the level, tell the mask man what you overheard just before he opened his bank. Did you overhear something, Julie? Yes. She heard Richfield fighting with Deek, because Deek wouldn't go along on a new get-rich-quick scheme. Just after that, Deek left town. I see. Then a man named Bowers come here and spend a few days talking to Richfield. Where is Bowers? He's settled in Junction City. Open the bank there, a bank like Richfield's. A bank that, like Richfield's, issued its own currency. See, Barnaby, you ask why I came to Eureka. Yes. I rather hoped it was a social call. I wish that could have been the case, Judy. You came here because you think the same as I do, that Richfield's a crook. Isn't that so? I, uh, came to ask you to put your money in Richfield's bank. There, you see, Uncle Barnaby? What? You mean that? Yes. Now he'll do it. Will you? Well, if you say so, but I declare that's the last thing in the world I'll expect you to say, you must have a reason for making that request. I have, Barnaby. Very good reason. The curtain falls on the first act of our Lone Ranger story. Before the next exciting scenes, please permit us to pause for just a few moments. Now to continue our story. It was on the day after the Lone Ranger had appeared in town. Simon Richfield was surprised to see Barnaby Boggs enter the bank. Boggs, this is a surprise. Richfield, I came to put my gold into the bank. I see. Well, I'm happy to welcome you as a depositor. There's one thing I want to get straight, Richfield. Yes? When I draw cash, what do I get? Banknotes. Same as everybody else. Put out by the Junction City Bank, I suppose, huh? Probably. If I want the gold instead of the paper, then what? Of course you may have the gold if you insist on it. That's what I wanted to know. What if I come here with Junction City paper money? Well, of course, that would be redeemed by the Junction City Bank. Well, how is it that you pass out so much paper money that's issued by the Junction City Bank and the bank over there passes out the paper that's issued by the Eureka Bank? Boggs, there are things about the circulation of currency that you don't understand. I'm expecting to learn a few things in the next couple of days. I'll have this gold deposited and the bank book made out for you. See what you do. One thing more, Richfield. Yes. You better be on the level. Yes. The Lone Ranger gave you a chance to go straight. Remember that? Of course I do. I have a notion that he's checking up. He'd be pretty put out to find that he'd made a mistake in giving you a chance. The Lone Ranger and Tonto had been camped near town for nearly a week, keeping a close watch on the Eureka Bank and Simon Richfield. The masked man watched Tonto approach at sunset. He knew by the manner of his Indian friend that Tonto had something new to tell. What's going on? What is it, Tonto? You know, something happened. No, you have something to tell me when you ride like that. That's right. Got Simon Richfield. That's right. He sent messenger to East several days ago. I remember that. What about it? Well, today, Tonto from Junction City come to Eureka. Who? A fellow named Bowers. A man who runs a Junction City Bank. That's right. Those two are friendly. That much is confirmed. Ah, them plenty friendly. You see, you meet, shake hands, go to cafe and take back room for meeting. Tonto, how long ago did that happen? Just few minutes. Me come here fast to tenure. Give me a hand with silver, will you? You want saddle? Yes. Settle your silver, you dear fellow. Me get saddle from trees. Settle, boy. Waiting for several days for a chance to run. May get it sooner than we thought. Here. Here's saddle. Thanks. Now, I'm going to the cafe. Uh-huh. You go to Barnaby Boggs. It's time to meet me there. Ah, me tell them.  That's right. Boggs and I will have to hold our conference in the kitchen. There. I'll wait for him there and I'll get going. Settle, settle.  Settle. Easy. Wait a minute, silver. One silver. Get hungry, Bowers. I'll have some food brought in. I can't eat when I'm upset. What's happened anyway, Richfield? Why did you send such an urgent message for me? Nothing to be perplexed on. These walls are no better than paper. What's been on that wall? Another private room? That's just the kitchen. Have a drink, Bowers. Thank you. And listen, you remember hearing me speak about the loan ranger. Yes, of course. I've heard a lot of others speak to him, too. What about him? He's to you. Look. He's here near Eureka. Are you sure? He was here a week ago when I sent you that message. I haven't seen him for the past few days, but I think he's still nearby and watching me. Is he anything on you? Yeah, but he's trying to get something. He had Barnaby Boggs put a couple of thousand gold in my bank. You're in the clear so far, aren't you? Of course. But if there's a run, if everyone starts trying to cash in the paper money at one time... Most of those who hold money in your bank are in Junction City. True enough. But if there's a plot to expose me, this mass man could get the currency together. What's that? I'm certain that I'm right. Boggs is in the kitchen. I told you these walls are thin. Who's with him? That mass man's voice. Passed out more paper money than they can redeem? Yes. Well, I don't like this. No way to fool it, Boggs. How's that? Bring in government officials. What would they do? They'd make an examination. If they found those two were issuing money that's worthless, they'd land in jail. Why don't you come to my hall? We can talk it over there. All right. Come on, we'd go right out the back way. No one will see you when that mass is over your face. Right. Well, Richfield, looks as if you were right. What are we going to do? We're certainly not going to wait for that mass man to make a case against us. Sadly, I'm going to take what I haven't skipped out. Sooner or better. Always. I'm going over to the bank right now and get the gold out. We'll talk in a few minutes, but it'll help. I'll go with you. You came here in a wagon, did you? Yes. Bring to the back door the bag as soon as it gets dark. We'll put the gold on board and make a getaway. After leaving the cafe, Barnaby Boggs and the Lone Ranger went to Boggs' home. They stood in the darkness near the porch. Presently the door opened and... Barnaby, I... Oh, I didn't know there was someone with you.  Why, Uncle Barnaby? You knew very well that this mass man was with me. In fact, Judy, you could hear his voice. All right. I did know he was here. Good evening. Good evening, Judy. Nice to see you again. I came because I... Well, I was curious. You did go to the cafe, didn't you? Yes. We took advantage of something you told me. Really? Have I been of help? I think so. What did you do? I knew that Bowers and Richfield were holding a conference in that back room. Oh, yes. You mentioned having heard Richfield and Deek while they were in there. The walls are very thin. That's what we counted on, Judy. You see, my friend and I held a conversation in the kitchen. One that was primarily for the benefit of Richfield and Bowers. You mean you wanted them to overhear you? Yeah, precisely. We did not know how successful we were until we heard from Toto. But what did you say? What did you want to do? Honey, have you ever seen a pot of stew standing quiet on the stove? A pot of stew? You look at the top and it's all slick and liquid. Yes. But you just stick the spoon in deep and stir it up. And all the things that are hidden will come to the surface. Uncle Barnaby, what is stew doing? Uncle Barnaby, what is stew to do with Richfield's bank? Well, same idea, my dear. The Lone Ranger planned to stir those two crooks up and see what they'd do. Toto's watching them. They'll have to see what Bowers and Richfield do before we can plan our next move. Hey, hear that? Who feats? Coming this way. I'm listening to them for several seconds. Oh, I hope it's Toto. It is. There he is. See him? He sakes how he's whining. He must have news. Oh, Scott, hold on, hold on, hold on. What's happening, Toto? You come quick. To follow back a bank, then load all gold into wagon. Run way. Is it behind the bank right now? Not right. There's time for us to move. Slash the gold, Bowers. Good. You did all right here, Richfield. Better than I did in Junction City. Yeah, but someone's coming. Kind of found that I hoped we'd not be seen. Come on, Silver. Shit mess, man. It's a Lone Ranger. I was afraid of something like this. What are you going to tell him? I've broken no law. Oh, Silver, hold on. Oh, what's this? Bank robbery? No, it isn't. Richfield, sending out your own bank? I'm moving the gold to a safer place. There's no law against that. You leave me alone. Some time ago, you wrote on silver with me. You're going to write again. No, no, I won't. Hope will help. Stop.  Will you see Bowers? Come on, Richfield. You'll pay for this. You'll be sorry. We'll see. Up you come. Bowers, do something. Don't try it. Just stick around. Richfield will soon return. Let me down, I tell you. Let me down. Come on, Silver. The hoofbeats of the great horse Silver had barely died away. Bowers heard several other horses approaching. He recognized the round form of Barnaby Boggs. Then the moonlight showed upon the sheriff and the taco and then a couple of deputies. Oh, hello, hello, hello. What's going on here? A bank robbery. That's what it did, sheriff. The Indians' tip was correct. Hey, you're the critic? Just came to town. Now wait. This is no robbery. Who's team? Mine, but that does wag him. Mine, but listen to me now. Loot in the bank. I'll bet a cookie. Get that Indian off that wagon. This none of your affair. Gold here. Gold? I knew it. But it's not a robbery. I... that is, we... Well, Richfield... Don't you try to lie out of it, sir. I am not. And don't try to say that Simon Richfield has taken all the gold out of his own bank. Well, he is. He... What's that? He's taking the gold away? What intonation does he aim to use to back the currency he's issued if he ain't got no gold in there? I don't know how he runs his bank. It's none of my affair. Bowers, if you're telling the truth about Richfield, we could toss him in jail. He can't run out with all the gold? Yes, he's fired my wagon. You can look around here, see his footprints, if you want to verify what I say. That mask man carried him away. Just a minute now. Are you calling Simon Richfield a crook? Well, I...  Now, which is it? I'm not a bank robber.  Yes, he is. Now you can talk, Richfield. What? How is you double-crossing my... Richfield! I heard all you said. Where are you been? That mask man brought me back so I could hear it all. You turned on me.  No! That man's a thief. You cut him looting the bank. Well, you can't get away with that, Sides. You took that gold out yourself and you know it. I don't know anything about it. Call me a thief. I'll show you. Watch that gun! Look out! Oh, my shoulder! Try any more gunplay and it'll be worse. You...  All right, Bowers, I'll fix you. Sheriff Morgz, that man's a crook and I can prove it. Just try to cash all that paper of money in Juction City. Just try it. Try to cash the notes Richfield issued. Try that and see how the gold lasts. By a thunder, you're both going to the Calibou. Now, come on, get started. What's so funny? Honey, I just came from the jail after the sheriff tossed Bowers and Richfield in where those crooks had tried to rob me. A lot of people will lose their money, won't they? Oh, they won't lose much. The gold is on hand here and in Junction City. But I was telling you... Yes. When those skin-flint bankers landed in jail, Red and Spike set up a house. Oh. Seen that they... They counted on Richfield to fix things with a jury at their trial so they wouldn't go to jail. When they saw him jailed and there to stay, they turned state's evidence. Richfield hired them to try and scare me into banking my gold. Yes. Oh, gracious. Richfield wanted me to bank with him. He didn't know what he was getting into. He didn't figure on the Lone Ranger. Oh, honey. There's a gent that no one can figure on. I know what Uncle Barnaby. I know it. I'm still alive!