Eastern time, we've got 30 minutes to go until the opening bell and we've got markets and positive territory to kick things off. You're looking at right near record territory, you get the S&Ps right now up 18 points trading at 39.85, putting it on a daily, we're going to see 4,000 in those S&Ps today. It's going to be pretty close, folks. We're talking about opening at a record print right now and the S&Ps up 17 points at 39.85, tech stocks trading higher to the tune of 1.2% higher, 13,243 in the NASDAQ 100. And out, up 46 points right now, 32,944 right near record territory as well, within about 200 points of that price level in the Russell, positive by about 11 points, trading at 22.34 this morning. We got crude, trading higher as well, crude's up $1.21 this morning, trading at 60.39, a little volatility in both directions. How about the sell-off yesterday in crude from 61 down to 59, talk about an acceleration. You lose $2 from about one in the afternoon to the closing bell at 230 and that's the closing on the futures market in crude this morning, a little volatility yet again and we're back above $60 at 60.43. We got to talk about Bitcoin, talk about some volatility recently, Bitcoin hanging tough around the 60,000 price point, 59,780. Goal contract continuing the bid that started yesterday, we had gold at 16.77. That was basically overnight Tuesday into Wednesday, the acceleration in gold really begins at about the open yesterday at 9.30. We trade from 16.87 to about 17.15. We've added $9 yet again to the price of gold this morning, we're trading at 17.24. We got silver up 16 cents at 24.69 and notes and bonds this morning. We're getting a little bit of higher price and lower yield. The 10-year right now is up 13 ticks at 131.11, the 30-year is up a full point in 7 ticks at 155.26. That is on the heels of some weekly jobless claim data, we'll get into that in a moment. We got the VIX, volatility index, how about a 17-handle, is that right? I think it is a 17-handle folks. We haven't seen that since you got to go back over a year, let's back it up. You're talking about a 17-handle was the week of February 17th. After that, we've been far above those levels, but this morning as the market continues to push record highs across the board, we got a 17.97 print for a moment, we're trading with the VIX at 18.32 so far this morning. What else we got going on? Let's jump right into the jobless claims number, we got it at 8.30 this morning. So a big number. You have the number coming in at 719,000 before I add a little bit of analysis to get into the nuts and bolts of it. Initial jobless claims, 719,000 and the week ended March 27th. That's up 61,000 from the prior week, the Labor Department data showed this morning. Economists were looking for about 675,000. The prior week's figure was revised down to 658,000, which is below the Great Recessions Peak. Yeah, I mean these numbers folks, record breaking in any other world besides the world we're living in with COVID in terms of prior to coming into the COVID pandemic, we had never seen a number. I think the record prior to COVID was 692,000 jobs on an initial weekly claim basis and we've been stuck above that level going over a year now, 719,000. Now, the only part I add to this is this number is backwards looking to a degree, right? It's telling us initial jobless claims going backwards. Really, it's going to be all about folks the next two to three months as we get over this hump of COVID. We're still dealing with people who have two shots. I think you're probably at somewhere between 14% of the population in the United States has received two shots that they would be immunized. They're kind of reached that efficacy of the two shots, whether it's Moderna or Pfizer. I think you got somewhere around 25, 26, 27% of the population that's received one shot at this point. So they're on their way. But boy, we got to get to 50, 60, 70, 80% maybe before we really eradicate this thing in a dramatic fashion to really open back up. The market is really looking for the next two or three months, folks. Once we get over that hump, right? Once everything opens back up, the numbers come down dramatically. The vaccinations come up dramatically. But nonetheless, not what you're looking for when you're looking for the economy to open back up. Continuing claims, continuing to decrease, but people are falling off the roll. So that can be a little bit skewed as well. Continuing claims down at 3.79 million this morning. What else we got going on? I think we got a break coming up. What's going on with my producers this morning? We got the markets right now. The S&P, we're trading up 16 points right now at 39.84. NASDAQ's up 150 points. We got the Dow up 45 points. The Russell right now up 11 points, trading at 22.33. We got Crude up about 57. Look at that acceleration continuing. Crude above where we were pre-market, trading at 60.73. And we got that gold contract up $9 at 17.24. Stay tuned, folks. We got some equities moving this morning. We got some earnings from last night. We got a lot to talk about on Thursday, coming into a long weekend. Market's closed tomorrow for Good Friday. We got non-farm payrolls to talk about tomorrow as well. Stay tuned, folks. Golden ratios give shape to everything in our world, represented in the Fibonacci sequence. These special numbers define the patterns that make up our universe. Not even markets can escape the omnipotence of these ratios. Larry Pezzavento is a 45-year market veteran who has published nearly a dozen books on the powerful patterns we find in nature and their relationships with the ever elusive markets. Larry's newsletter, Fibonacci 24.7, will teach you to harness the power of these natural golden ratios in order to create successful trades. Fibonacci 24.7 is designed to teach the tools you need to identify and act on these undeniable and reoccurring patterns. Sign up for Larry's newsletter, Fibonacci 24.7, and you will also receive free access to his trading webinar, Trading Strong Trending Markets. Try out Larry's newsletter risk-free. All of TFNN's newsletters come with a 30-day money-back guarantee. TFNN, Educating Investors. If you're not currently using the TAS Profile Scanner when looking at setting up your trading opportunities, then your arsenal is short a muddy weapon. The TAS Profile Scanner is a standalone piece of software that instantly filters over 2,500 global financial markets such as stocks, ETFs, commodity futures, and forex. Heated by Steve Dahl, TAS understands that in today's technological world, the use of top-flight software applications and technical analysis expertise is essential to successful trading in today's market. You also gain access to the webinar that Steve Dahl and Tom O'Brien just hosted, the best way to use the TAS Profile Scanner to profit. This webinar archive is available for all subscribers immediately upon signing up. All new subscriptions also come with a 30-day money-back guarantee so you have nothing to risk. Start your subscription by visiting the front page of TFNN.com today and you'll find the TAS Profile Scanner under the Services tab. Sign up today. Hey there, I'm Andy Arbor Time with Tiger Precious Metals and Stones. Whether you're looking to buy and sell precious metals or trying to find the perfect diamond ring, I'm here to help. I have over 15 years of experience with diamonds and precious metals. You can call me directly at<PHONE_NUMBER> and I will personally answer any questions you have and help you find exactly what you're looking for. I will be your personal concierge in the metal and stone business. Give me a call today,<PHONE_NUMBER>. Many of our new listeners have heard about The Tiger's Den. The Tiger's Den is a lively community where professional traders and investors can meet, exchange ideas and information in a comfortable moderated atmosphere. Hear all of the TFNN shows plus see all of the charts as they happen live and have access to archives of all of those charts. You can test drive The Tiger's Den absolutely free for 30 days and greatly enrich your knowledge of these markets and how to make your money work for you.  We have markets right near record territory. We got about 12 minutes to go until the opening bell for Thursday trading. Again, we're closed tomorrow, but interesting that we're gonna get non-farm payrolls tomorrow. So tomorrow, not a federal holiday, right? So you got banks open, that's why you're gonna get the economic data released tomorrow. Not a federal holiday for Good Friday. The markets though will be closed. Interesting that you gotta go into a long weekend. Waiting for non-farm payrolls for the month of March.  You're not gonna be able to trade tomorrow in the regular equity markets as they will be closed when we get a pretty important data point from the month of March, non-farm payrolls tomorrow at 8.30 a.m. Getting back into some of the weekly jobless claims data real quick before we jump past this story. So the total of those receiving benefits also dropped sharply. Now, we went over that this is continuing claims but not a great representation of the overall picture when you consider that you have 18.2 million people receiving benefits of some sort. Most of those receiving pandemic related benefits. Now that number dropping by 1.5 million. I mean, we wanna see this number get back down to like two or three million folks. We wanna see it get back down to basically a continuing claims number once the pandemic emergency assistant numbers disappear which they're gonna have to. You can't provide stimulus indefinitely. This is supposed to be a period to get us over the hump. It's supposed to be a period that basically allows those businesses that have had to shutter during the pandemic because of restrictions to keep that key in the door, turn it back on once we get over this hump and employment comes back at a much more rapid pace than if they had closed down and then those businesses are gone and just can't reopen and we have to restart it all over. Continuing claims down to 18.2 million when you look at the total picture of pandemic related benefits. At the state level, you have Virginia, Kentucky, Georgia, California reporting the largest gains according to unadjusted data. And of course, this is all ahead of tomorrow's number. The market will be looking for about 675,000 is what they'll look for. And we'll see if that comes to fruition tomorrow morning at 830 in the morning. All right, what else we got going on to jump around to some of the stocks with earnings? How about CarMax? CarMax, they reported quarterly earnings of $1.27 a share. With revenue essentially in line with forecast, they announced it would acquire the remaining part of Edmonds that it didn't already own in a cash and stock deal valuing the auto information provider at $404 million. Quite a price tag for Edmonds. I've looked them up occasionally. I think they got the blue book information on their site. CarMax though, lower this morning, KMX is their symbol. I was checking this out earlier. From about $133 to $127.25 putting this thing on a daily, quite the run it's had though from $47 and that's not even the full picture. How about $37 of the lows of COVID? You go from 100 to 37. We're sitting this morning at about 127, right near the highs we had in the last few weeks for CarMax shares. What else we got going on? Let's see. Let's get into micron. This one's interesting. So you got Taiwan Semiconductor. Where do we have an article up here? Technology. I'm pretty sure I do. Taiwan Semiconductor, they're gonna be spending $100 billion. Maybe this is the article, there it is. Taiwan Semiconductor, it spent $100 billion over three years to grow capacity. We're all familiar that we got a chip shortage going on. Taiwan Semiconductor, one of the biggest chip manufacturers, if not the biggest chip manufacturer out there. TSM is their symbol. The market loving this news from 118 to 121. You put up a three-year weekly. We've pulled back from the highs of 142, but we were trading at 34 bucks a couple of years ago. We were trading at $40 in change during the lows of COVID and we were trading at $60 prior to the COVID pandemic. So you double that price point right now, putting it back on the 15 minute. So to get into the nuts and bolts, it's gonna be interesting to see how they get this done. No matter how they get it done, the market likes it because we need chips. They had already planned a record capital expenditure of as much as $28 billion this year, but now they're up in that ante and expects to invest $100 billion over the next three years to increase capacity to support the manufacturing and R&D of advanced semiconductor technologies. They said in a statement responding to local media. Their suppliers, of course, are up. You got Micron trading higher on this as well. Pull up Micron shares. There's your acceleration from Micron from 88 to about 92. Now, what's interesting, they got the other companies in there as well, Screen Holdings. You got Tokyo Electronic, ASML Holdings, ASM International all higher. Here's the interesting part. It's unclear how Taiwan semiconductor with only $28 billion of cash and equivalents balance sheet at the end of December intends to finance that record outlay, which underscores the enormous capital required to stay at the forefront of the industry relied on by everybody, right? Now you get into it. Taiwan semi, they're gonna be spending $100 billion over three years. Intel just came out and announced that they're gonna spend $20 billion to build two new fabs in Arizona and you got Samsung spending $116 billion over a decade to expand their business. Boy, that's a lot of money to compete but Taiwan semi really coming to it with a billion, $100 billion over just three years in that industry, probably a good thing. We're gonna need some chips, folks. And you get into 5G, 5G, the whole deal is supposed to be everything is gonna be linked to the internet of things, right?   It starts brewing your coffee in the kitchen. Everything's gonna be tied to the internet sooner or later, folks. Taiwan semi, that's quite a number though. 100 billion over three years, they don't have the cash just yet but yields not that bad still in the yield market in terms of where we're coming to, in terms of what we're looking for, in terms of what they will be paying for that capital. What else we got going on? Abbott, the Food and Drug Administration improves their rapid antigen tests for over-the-counter sales and use for home with people without current COVID system. So the retail price still to be determined, the company told Reuters the tests will be sold at retailers for less than 10 bucks. It's important to stop, folks. We're gonna still be getting over this thing for the next two, three, four months. And hopefully that's it. I encourage you folks, get out there, get the vaccine, it's safe, it's effective. I had my first shot like a week, week and a half ago now. I got my second one coming up April 13th and that's how we get over this, folks, it is. ExxonMobil, they released data in an SEC filing the points of the possibility of the company's first profit in five quarters. Not bad, we get some rising oil prices, right? So you got an analyst out there saying data points to a profit of 2.55 billion or 60 cents a share with Exxon benefiting from higher oil and gas prices. XOM is their symbol. A little bit of a pop, putting this thing on a three-year weekly for some context. Talk about some woes, right? We got negative oil prices back in April. We have Exxon down to 30. This morning we're gonna open about 56. Checking out Chevron, CVX. Now you had Warren Buffett stepping into Chevron in a big way. Chevron much closer to the pre-COVID levels than Exxon. We're trading about 104 and we're gonna be up a bit on Chevron this morning to 105.50 at a time when we have crude continuing to accelerate higher, putting crude back on the 15 minute. Boy, volatility. I mean, that's quite a trading range for crude. You're talking about $1.50. Just since 6 a.m. this morning, folks, you traded down $1.50 and you traded back up $1.50. Interesting level, $61 where we were, whether it was the high Wednesday early early at about 3 a.m. or the highs we had intraday Wednesday as well. All right, folks, stay tuned. We're gonna be coming back in three minutes. Right for that opening bell. We got the S&P's up 17. We got tech stops higher. We'll take a look at some of them as well. We got some Apple news out there as well. Why not? Stay tuned, folks. We'll be right back. Hi, folks. This is Tom O'Brien. The printing presses are working 24 hours a day, seven days a week. The U.S. deficit has risen 200% in one year with no end in sight. The markets are looking for an additional stimulus bill to get us through this once-in-a-generation pandemic. There is no free lunch, folks. The more stimulus dollars put into the marketplace, the less your dollars worth each and every day. This is the time to protect yourself with a portion of your portfolio in the metal market. The Gold Report comes out each Monday morning. I bisect and dissect the dollar, silver, gold, the XAU and the HUI. The Gold Report is a long-term hedge against the dilution of your buying power. The U.S. has put more than $6 trillion into the marketplace in the last six months with more expected in the next few months. The market did and does need the stimulus, but it will have long-term implications on our buying power. The Gold Report comes with a 30-day money-back guarantee. Go to tfnn.com and order the Gold Report now. Protect your buying power out of the Gold Report now. You could be making money off the stock market. And if you're already making money off the stock market, you could be making a lot more. Check out TFNN and Tiger TV and get expert investing advice to give you the power to control your financial future. Go to tfnn.com and find the newsletter for you. Whether you're into trading gold, metals, futures, currencies, or options, you'll get advice and analysis to help you seriously get ahead. TFNN also features trading services with a 30-day money-back guarantee for new subscribers as well as TFNN's Tiger Den trading room. Trading software and educational webinars for all trading levels. And make sure you check out Tiger TV for free on tfnn.com or TFNN's YouTube channel for live financial content from 8.30 a.m. to 4.00 p.m. Eastern on market days.  TFNN, educating investors. TFNN is excited about our new software charting program, The Art of Timing the Trade Charts. In collaboration with Tom O'Brien and using his best-selling book, The Art of Timing the Trade, Your Ultimate Trading Mastery System, David White has programmed an outstanding piece of software that will complement any trader's methodology. Using this first-of-its-kind program, The Art of Timing the Trade Charts allows you to scan thousands of stocks for Fibonacci formation setups, including guardleafs, ABCs, butterflies, and much more. The Art of Timing the Trade Charts is designed to help you when scouring the markets or stocks just beginning to form the trading patterns that many investors spend days, weeks, or even months searching to find. And right now, we're offering licenses available at only $79 a month. We are so confident that you're gonna love this new charting software that will even give you a 30-day unconditional money-back guarantee. Don't miss out on this incredible new piece of software. Get your copy of The Art of Timing the Trade Charts today by visiting TFNN.com. This segment is brought to you by Think or Swim. For more information, just click the Think or Swim banner on the front page of TFNN.com. Welcome back, folks. We have the markets open and we got markets continuing to trade higher. We got all-time high prince S&P right now. You're talking about positive 21 points at 39, 89. We got 11 points to go till 4,000. We'll see if we hit it today before the long weekend. Tech stocks higher as well. NASDAQ 100 up 1.2%, 13,249. The Dow's up by 68 points and the Russell up by 13. Checking in commodities, holding at that $60.75 price point in crude and we'll check in on gold right now. Gold up about eight bucks at 17.24. Let's take a look at some of the fang stocks out here this morning. Amazon shares jumping at the open. We're up about 9.10% trading at 31.22. We'll check out Apple shares up 1.3% trading at 1.23.78. Think I got an Apple story up there too. What do we got? We got two Amazon stories up there. Maybe we don't. Maybe I'm talking about Amazon. Let's just jump to Amazon to start it off. The trends in terms of where people are going, right? So Amazon out there, they're saying most US employees will return to work in the fall. Seems to be fair and better than fair folks. By the fall, we better be there because if we're not there in the fall in terms of getting over this thing, we got the, we got, we got, we have what we need folks is the best way to put it. We have the vaccine. The vaccines are effective. You even have news out there talking about Pfizer, I believe was 91% effective in a follow-up study looking at people, whether they go for six months now, they've been receiving the vaccine, the variants that are out there, strong effective vaccines with a supply to go with it. Many states opening up across the board now. And nonetheless, if you're not there by the fall, we got problems folks in a big way. And those problems just might have to be with anti-vaccination trends across the US and the world. Hopefully that's not the case. As I mentioned, I encourage you to get that vaccine if you can, it's safe, it's effective. That's how we get over the hump. And you can't fault these companies for saying by early fall, the company said in an internal memo this week, most of its US employees will return to the office in the US as vaccines become broadly available in the next few months, kind of stating everything I just went over. We expect more people will start coming into the office through the summer, with most back in the office by early fall. Workers in some European countries may return later owing to vaccine distribution setbacks in Europe that we've all heard there as well. Amazon, the second largest US private sector employer behind only Walmart. So interesting to see how you see those things taking shape. I don't know what employees in terms of most of they're talking about, whether they're gonna be providing people the ability that have it to work at home in some capacity, but they're gonna face some competition when you look at whether it's executives that they're trying to poach and what they're doing because a lot of those big tech companies, they're saying that they're gonna provide some degree of work from home capability, right? Amazon, not in that business it looks like as they look to bring most of their employers back by the fall. Interesting to see how we're gonna get these divergences when we come out of COVID with companies that are the management team believes and it might be right for them. It's gonna differ company by company, but in Amazon they believe they want employees back in the offices as opposed to whether you see some, you know, some of the big Silicon Valley companies out there that are trying to do a different deal and allow some of those workers to work from home indefinitely, maybe one of the perks that allows them to go after some big talent out there as well. The other Amazon story out there startup Thrasio, poachers CFO from Ailing JC Penney. So this company, it's a brand startup. What they do is they basically buy the brands that are doing well on Amazon. So they joined the company, Bill Wofford, not familiar with them, but I guess he was hired in 2019 to help turn around the unprofitable department store chain will serve in the same job at Thrasio. The company said Thursday, he's the latest executive to leave JC Penney since it filed for bankruptcy in May.  Chief financial officer, there we go. So they get JC Penney CFO and he's gonna be coming into the company that basically, Walpole, Walpole, good old Walpole. Walpole, Massachusetts based Thrasio is the best funded of a raft of startups looking to capitalize on Amazon's e-commerce dominance by acquiring up and coming selling, up and coming sellers on the company's third party marketplace. So Amazon brand startup Thrasio. Interesting nonetheless, it's a big business folks. You see Amazon, they copy all those items in general, right? But you got companies out there, basically just trying to buy up some of those brands. Thrasio and its peers buy out small merchants, sometimes mom and pop operations out of garages, plan to use their retail expertise to turn the acquisitions into global brands. Smart business idea. They also announced a $100 million in new equity funding, bringing the total debt and equity raised by the company since December to 1.35 billion. It's quite a price tag. They better have some good managers when you spend at 1.35 billion for a company out there. What else we got Verizon making headlines? So they beat out European carriers to run 5G at UK Freeport. You're gonna see these battles going on folks. They won its first industrial 5G deal in Europe. There's gonna be 5G deals all over the place as 5G expands, beating out local telecom companies and marking an early win in a push to sell the wireless systems to global businesses. We'll check out Verizon, full disclosure. I have some Verizon. My mom's got some Verizon. She worked there for a while in her career before she retired as a union employee. One of the only reasons she was able to retire when she did because of those union abilities to negotiate working there for her lifetime. Verizon trained at about 58, down about half a percent so far this morning. We got markets sitting right where we opened though. The S&Ps just pushed $39.91. I mean, look at this chart folks. We've seen pullbacks, right? You don't have to be a genius technician on your charts to draw an up-trend channel. And we are just in a straight up-trend channel across the board right now. S&Ps sitting at $39.90, even tech stocks, right? Let's zoom in on the NASDAQ 100. We're pushing up to $13,275. You back it up to the highs we had in the middle of March, $13,287. We're within nine points right now in the NASDAQ 100. We might be there by the time I finish this sentence to challenge those highs in the middle of March. And then you get back to basically the end of February. You're talking about a level within 100 points, the high there, $13,353. So this will be a critical area when we come up with some of those tech stocks. You're gonna be pushing to the area we had towards the end of February. We were also back up there in the beginning of March and we were back up there in the middle of March. You're pushing right over that. Yeah, and as they're talking about S&P cash over 4,000. Break it out folks, thanks Dan. Break it out. 4,000 in the S&Ps. I'm sure we probably got 33,000 as well in the Dow. And look at that Dow channel. Just hanging right up towards the upper boundary line of that channel line. It's pretty well-defined folks and it hasn't done much. You had a little consolidation here from November to January. From there, we've accelerated again and talk about pushing levels that are just constant basis, highs across the board. All right, what else we got going on? How about Frontier? They're going public this morning and there's your S&P 500 top in 4,000. You'll see those headlines across the board today as we come into the long weekend. Really interesting just from almost, we're pushing all these levels coming into a long weekend with non-farm payrolls from the month of March where we're going to just begin getting some lofty expectations, right? The number that they're looking for is 650,000, something like that. They're looking to add hundreds of thousands of jobs in the month of March. We're going to do that over a long weekend. We're going to have all the markets in positive territory right now to kick off the trading. We'll see how it happens exactly. Frontier are aligned. So they're going public raising $570 million and an IPO starts trading today. I was watching their CEO on Bloomberg earlier, the discount budget carrier, the latest US carrier to go public, trading expected to begin next week. Interesting time that they go public, right? As we're basically on the heels of the pandemic. They sold 30 million shares, the price at 19 apiece, the low end of the target range. You're talking about a $4 billion valuation. On their IPO, could be a big year of travel to be expected when we break out of this. Stay tuned, folks. Give us a call, still time.<PHONE_NUMBER>. Love to hear from you. Stay tuned. Are you in the market for buying or selling real estate in the Bay Area, including the surrounding St. Petersburg, Tampa and Clearwater markets? Tiger Real Estate LLC is a firm that has extensive experience in the Tampa Bay area. Whether you're looking to sell your current property for maximum value or you're in the market for a second home or investment property, Tiger Realty has the experience across all areas of real estate in the Tampa Bay area to help buyers and sellers make the most informed decisions across all price levels. From the price you should be paying per square foot in certain up and coming areas to the type of cash flow investment properties are capable of creating, Tiger Real Estate can help you make the best decision when it comes to all areas of the market. Before you make one of the biggest decisions of your financial future, call Tiger Real Estate LLC today at<PHONE_NUMBER> or email us at tiger at TFNN.com. That's<PHONE_NUMBER>. Call us today. The technology around us is changing every day. With so much happening, it can seem impossible to keep up with all the information. David White's investment newsletter, The Technology Insider, is designed to give you all the information you need to understand the technology that shapes today's markets and tomorrow's future. David White has made his living staying on the cutting edge of technology. His weekly newsletter will give you specific recommendations for valued tech stocks, as well as entry prices, target prices, and stops to set for each trade. Dave delivers his weekly newsletters every Friday with updates throughout the week. You can get The Technology Insider at TFNN.com for only $37.50. Sign up for David's newsletter, The Technology Insider, and get an inside look at everything the technology sector has to offer. Try it risk-free today with our 30-day Money Back Guarantee. TFNN, educating investors. Will the S&P 500 continue to climb for bold trades on U.S. large-cap stocks in either direction, trade SPXL, SPUU, or SPXS, directions daily, S&P 500, bull and bear, leveraged ETFs. Direction leveraged ETFs. An investor should carefully consider a fund's investment objective, risks, charges, and expenses before investing. A fund's prospectus and summary prospectus contain this and other information about direction shares. To obtain a fund's prospectus and summary prospectus, call<PHONE_NUMBER> or visit DirectionInvestments.com. A fund's prospectus and summary prospectus should be read carefully before investing. An investment in the funds is subject to risk, including the possible loss of principal. The funds are designed to be utilized only by sophisticated investors such as traders and active investors. Distributor, foresight fund services, LLC. Don't forget, you can listen to TFNN live on your mobile device 24 hours per day. Go to TFNN.com, then hit Watch Tiger TV. That's TFNN.com, then hit Watch Tiger TV for the latest market information. Welcome back, folks. I got a chart here up of Fubo TV, a 5.4% today. Quite the pullback this equities had, right? You pull this thing up, I got a daily chart here. We were at a low of about eight bucks in the last year. We make it up to 62.29. We make it almost to 60 bucks back in January. And then a cascade to lower prices. Crisis, yeah, it's a crisis in this equity right now, too, from that sell-off. You jump over to the Analyze tab. They're trading higher, because they're gonna be playing. So you're at a $3.2 billion company right now, just for some reference in terms of the context of their market capitalization. The news with Fubo is that they are going to be streaming all Chicago Cubs non-nationally televised games. Now, interesting, sports is one of the best ways, folks, to bring people into some of these streaming platforms, in my opinion, because there's nothing like live sports, right? I mean, you saw that big deal the NFL did to the tune of about $100 billion recently. And that, basically, the NFL, they did it across the board in terms of they're talking about NBC, CBS, Amazon, Disney, they tie them all in. So instead of just going to one streaming platform, they are spreading the wealth to all the streaming platforms and now all the traditional media companies have them. Whether you got CBS, right, Viacom, they're gonna have Paramount Plus, I believe it is. You're gonna have NBC with Peacock. They'll have theirs. You have Disney Plus with their ESPN streaming platform. Fubu, that's a great deal. But be careful of this equity, because in the world of streaming, if you can't accelerate during COVID and kind of hold somewhat near the levels that you had, I'm not sure how you're gonna be successful when you accelerate from $62 back in December to $55 back in January. And now you're sitting at 23.55. There's something going on with that equity that ain't so good to put it lightly. Disney shares, positive by about 1.5% with the market today trading at 187. You got Netflix shares jumping over to them, positive by 1.8% today, 531.04. Let's see, what else we got? Let's check in on Viacom. Some of the stocks that really got hurt with the Archegos saga happening last Friday. Viacom up about half a percent this morning, you get discovery shares down about 2.10%. I talked about it before, folks. If you're looking to get into either of these equities, you could definitely start with a partial position here. Don't start with a full position. You don't know how these things are gonna reverberate. Obviously, there's a lot of bright minds out in Wall Street, folks. Hedge funds and the likes that have plenty of money that could plow money into these equities if they thought $45 was a bargain and a half. That's not happening just yet, okay? So you just got cut in half. Yeah, that was a liquidity crisis that sent it lower. Yeah, and that's our man, Pete, saying in the den. Should we use swaps? Well, that depends, Pete. You got $5 billion you wanna put in play for your entire equity? Exactly, exactly. Viacom down at 45 and discovery. But both of these strong, strong equities in a big way. I got people in my household that watched discovery in a big way. They got quite a brand of channels that they encompass in there, whether it's TLC. I think you got Lifetime in there. You got the Food Network along with others. But you get cut in half and the market hasn't bounced back too quickly yet. So they're just a little dicey, but longer term. I see both of these being a player in a big way. Let's jump to some of the others while I'm here. This is CMCSA for Comcast, trading at about 54.38. That's NBC, that's Peacock. They've done pretty well remarkably. And I had one more on my head. Ah, AT&T, that's the other one you don't wanna count out, folks, HBO. Now this is a small portion of their business in terms of streaming, right? HBO Max, but I can tell you, they're talking about 120 to 150 million subscribers. But I think it was 20, 24, 20, 25. That's a premium service. I like this equity. It doesn't mean that it won't chop around forever though. You put this thing on a monthly, right? And yeah, you've been stuck in a doldrums.  We had a high at 2,000. You dropped down to a low of about 20. But yeah, I mean, you're talking about this thing straight between 25 and 40 since basically the year 2000. So I'm not sure that you have the ability for the type of capital appreciation that you might want in that equity, but nonetheless, keep it on your radar because HBO Max is here to stay this morning though, pulling back about 6 10th percent. Quite a pullback indeed. All right, what else we got going on? Checking around to some of the stocks that I like to take a look at as well. Let's take a look at some of the other tech stocks. Check out Salesforce this morning. We have some Salesforce for disclosure in my newsletter. I got some Salesforce for sure. Salesforce up about almost 2% right now. You got tech stocks charging higher at a time when we get the note and bond market a little bit higher as well. We get the 10 year right now up about 13 ticks. So that's gonna correlate. I'm pulling it up right now. You're looking at a yield now in the 10 year of 1.69%. We're now under 1.7%. In that 10 year, that's putting a boost on some of those tech stocks with the NASDAQ 100 up 1.5%. We talked about so CRM, you're up about 2.1%. Let's check out some of those other big tech stocks. We got Google up 1.8% this morning, Microsoft up 1.6%. Check out that. Apple shares up 1.15% this morning. Facebook shares up 2.1% at $300 for Facebook. I believe, I was gonna say real close. So we hit a high this morning of 302.40 and you're about $2 away from the highs we made in August. You put this thing on a daily, talk about pushing the higher on and to that consolidation. We're right up there. Look to see how Facebook reacts to the highs we made all the way back in August of 304.67 as we push towards the all-time highs on Facebook shares. Let's check out Twitter shares as well. TWTR, we're up 3.4% on Twitter this morning. Still well off the highs we had of 80.75. All right, what else we got going on? Checking out some of the headlines out there. Sherwin Williams. So they split three for one. That's effective today. Asa SHW, they've been on quite a tear. You see the print here, right? That's the split going on. Hasn't yet calibrated on the Thinkors Swim platform. We put this thing back on a three-year weekly. Thank goodness that's a split, but remarkable. You trade from a price of two, excuse me, what's the low there? 3.25 at the COVID lows. And right now, you got to triple that number. So we're trading at about 750 for Sherwin Williams. Everybody doing everything they can to their household at home, including painting Sherwin Williams. They get some great paint out there. They too, too. I use them for my properties. Sherwin Williams this morning, they had about 10%, excuse me, 10th of a percent, 10th of a percent as they split three for one. Be aware of that one on your chart when you see those numbers flickering. And we cover the Taiwan semiconductor story in terms of $100 billion. And we'll wrap it up with Neo. Neo said it delivered 7,257 vehicles in March. 373% increase over the same month last year. Here's what I'll caution you folks. Be careful of using percentages of small numbers, okay?  If you produce 10 in your first year, you produce 50 your second year. Well, geez, you're up almost 500%, right? They're still at a very, very low number.  But what is that? That means they probably made 2,000 cars last year during the month, and they made 7,200 this year during the month.  And you're up 5.2%. We'll put it back on a daily to see the action. We're trading at $41, 66, 99, the high there. We got to check in on Tesla shares. TSLA up 3.4%, 690, 15 for Tesla shares this morning. All right, folks, stay tuned. We get the SMPs. We're talking about 4,000 right now. And the SMPs right now in the cash, we're trading at 39, 98. So just a hair under that number yet again. You get the NASDAQ up 1.6% today. That's the full NASDAQ trading 13,459. We get the Dow basically flat. The futures are negative by 20. The cash Dow up about 12, and you got the cluster up by 19. Stay tuned, folks. We'll be right back to finish up the show. Give us a call,<PHONE_NUMBER>. Right back. Sharpening your skills as an investor is like getting better at playing a musical instrument. You have to practice, sure, but you also need excellent instruction from experts. At TFNN, you'll get advice and guidance from the authority in technical market analysis, and it's not just dry, tedious text either. TFNN airs live financial content streamed live on tfnn.com and TFNN's YouTube channel with Tiger TV, live every market day from 8.30 a.m. to 4.00 p.m. Eastern for free. Each host is an experienced trader and gives their take on the market while taking calls and questions live from around the world. From the moment the market opens until the closing bell sounds, Tiger TV has eight different shows with expert hosts to help you make the right moves with your money. Watch online at tfnn.com or on TFNN's YouTube channel and become the investor you were born to be, TFNN. Educating investors. Markets can rise and fall like the tides. Subscribe to Basil Chapman's newsletter, the opening call, and you too can ride the wave. Basil Chapman is an authority in technical analysis. His Chapman Wave trading system has been helping traders identify trends and capitalize on momentum in the markets since 1984. TFNN invites you to test Basil's proprietary Chapman Wave trading methodology with a monthly subscription to the opening call newsletter for only $149.00. Your subscription to the opening call comes with a 30-day money-back guarantee as well as daily market updates on key indexes, stocks, and commodities. Ride the wave. Sign up for the opening call risk-free today. Introducing Primal Edge. Today it's even more important to take a supplement that complements your health. Primal Edge is specifically formulated to boost your immune system and help with weight loss, better sleep, stress reduction, and the need to detox. Our early ancestors found all their nutritional requirements in the wild environment, but today our food sources don't contain the vitamins, minerals, and nutrients that we need to stay healthy and strong. That's why we need Primal Edge daily nutrition. It includes a special blend of ionic, soil-based vitamins, minerals, fatty and amino acids, and an easy-to-use liquid form. Primal Edge is powered by highly concentrated humic and fulvic acids. Nature's preferred delivery system. They've been called miracle molecules because, like sunlight, air, and water, without them, life cannot exist. That's right, Ellen. They ensure we receive all the nutrition we need to be healthy and thrive. We take it every morning. Primal Edge. Just $89.00 exclusively at TFNN.com. This segment is brought to you by Think or Swim. For more information, just click the Think or Swim banner on the front page of TFNN.com. Welcome back, folks. We get the S&Ps up 21 points right now. We got tech stocks surging higher on a yield to the 10-year down about, well, down below 1.7% as we get a little bit of decrease in yields with weekly jobless claims coming in a little bit bigger than the market expected. Tomorrow we get non-farm payrolls. I'm gonna pull up Delta, so Delta. They've been in the press a little bit, having to do with their reaction, the heat they're taking, having to do with the new voting law passed in Georgia. So you have the governor over there. He's in a little bit of battle, whether it's Delta, because they have that big base there coming out against this Coca-Cola as well. Folks, the biggest problem with this law is that it is based on the premise that voter fraud has existed, et cetera. This all played into January 6th and what happened, folks. We do more than just straight market talk here at TFNN, folks. It's about life, too. When my dad started everything, he talks about white light all the time. If you listen to TFNN, you know it's more than just about simple, by-low, sell-high market technician, et cetera. I encourage you to take a look at this, folks, and see what it does. The real basis is, yes, you can strengthen everything going on, but it can't be based on the premise that voter fraud existed, because it did not, and we see the harm that that can do. To the man Marco Rubio out there, just very insincere comebacks. Let's talk about what's really happening. Instead of saying, Dio Delta, your business partners with the Communist Party in China, so you can't say anything to the state where you do business. I don't even understand how that plays into reality, folks, all right? If you want to talk about not being able to say anything because you've talked about China, how about the king of the Republican Party right now talking about that we love each other, China's Xi, all right? Or asking Xi to help them with re-election by boosting US farmers, all right? Or talking about how well Xi and China have done for coronavirus in the early days where everything was ignored, okay? You're gonna say we're getting political, folks, but this is real, and we see the problems that it created on January 6th, talking about election fraud persistently. That's what this law is based off, which is does not exist, which is why you're seeing comebacks like this from a weak, weak man like Marco Rubio, all right? Little Marco, we'll call him. So pay attention, folks, this is a big deal, all right? And it's unfortunate because that voter fraud did not exist and we're seeing the same trends existing that got us in so much trouble towards the end of the election season. We just surpassed, let's see that happen again. We'll end the program on that, no, folks. S&P's right there, 4,000. Thanks so much for-


Welcome! My presentation is about incident response and how my personal perception on that particular topic might be of interest for you. So, what am I going to talk about? Just a brief overview. What are the challenges? What have been the solved challenges so far? What are the dos and don'ts during an investigation? And what can you do to be prepared in case of an investigation? So, imagine you're working in an IT department, mid-sized company, a few hundred people, and all of a sudden one of the boxes starts blinking or you get a notification, you get an alert. What can you do to be prepared to dig into the roots for this cause, to figure out what's going on? And last part is about personal research project of mine. Together with colleagues we built something really cool, I think, and I'm happy to talk about that at the end. So, who am I? My name is Martin Schweinecke. I'm a researcher at SBA Research. Maybe a few words about SBA. We are a publicly funded research center which gets kind of an incentive to work in security and to work with companies. So, it's kind of like a very, very small Fraunhofer. We have around a hundred people working there and in contrast to Fraunhofer we focus exclusively on digital security and everything that's related with it. So, we have, I don't know, network testing, we have pen testers, we have combinatorial testing and so forth. So, what's my background? I did a PhD in digital forensics and I'm still working in that area, which I find very interesting and I'm also interested in online privacy, everything that's related to Tor or can be seen as a countermeasure to digital forensics. I'm also on Twitter if you have any questions and would like to ping me after the talk with questions. So, what are the goals for this talk? Why am I here? What I'm going to talk about is a brief introduction to incident response. What are particular steps that can be taken in case of a possible breach or data loss or ransomware or things like this? I want to talk about current challenges, what are the problems right now for forensic investigations and what are the things that actually work? So, usually if you have a problem, you Google it, you have like a ton of forum posts with people with like problems and you never quite know what are the things that actually worked and at least I hate that if I have a conflict problem and I see 20,000 entries and they all point nowhere. And also I want to talk about how things can blow up in your face. So, I'm an academic, I come from the Technical University of Vienna and apparently reality is kind of different on the outside of the academic world. So, what is incident response?  You have Ashley Madison, you have Hacking Team RSA, they all have been hacked and this has been publicly reported that they have been hacked. Google got hacked big time when they lost part of their source code for Gmail simply because someone wanted to read some person's emails. And there are studies that try to estimate the time of breach and the time of discovery of the breach but they usually leave out a large portion of unreported incidents. So, just recently there was a report by the RAND Corporation where they said that a zero day is undetected for 180 days as well as breaches which is okay if they did their number crunching correctly but of course there's always the possibility of a dark area where nobody knows what's going on. So, what the press is trying to tell you what incident response is is that there's APTs everywhere, APT, APT, APT. Everybody nowadays isn't cool if he didn't get at least attacked twice with an APT. Mostly what an APT right now is you have a spearfishing email with an office document attached and you have to enable macros and then you're in the network. So, this is not the particular advanced persistent threat that the press would like us to believe that's actually happening. And usually at the beginning of an investigation you have an initial report. So, somebody notices something, somebody says that's weird or you get an automatic alert from some of the appliances that you have stacked in your server room and the root cause for incidents, why you do incident response is to figure out what's going on, how did that happen and how can I prevent this and future incidents from happening again. Yeah, and usually in the beginning of an investigation it's great if you can assemble a team and if you have dedicated specialists which are ready to work with you but usually that's either you or someone else who is known for being into security and who is tasked to have a look at that. So, of course, goals, what do you want to achieve? You want to have some form of reaction. You want to have people looking into that.  And, of course, you want to close any entry doors that may be open so you need to figure out how the attacker got in and what steps he has taken inside of the network. So, this is where my area comes in. Usually it's something like life forensics under time pressure so you have someone in your network and you know that there is somebody but you need to figure out where to lock, where to find traces that are left behind on which machines the attacker has been and so forth. And, ideally, of course, you move faster than the attacker so you can prevent further exploitation and also you can work remotely because nobody likes to jog around office buildings trying to figure out where this particular machine is that might or might not have been compromised to do further analysis. So, of course, there's always time pressure if the management would have an answer by yesterday. That's really great. Usually if you do not have any public exposure so if you do not have any news entries, postings, anything which relates to that you might or might not have been breached, that's okay. But if the press is involved and the public is knowledgeable that something is going on, then it's rather stressful. There was Petia just a few weeks ago. There was the shipping company Maersk. I don't know how to pronounce it. What they did was to have a dedicated page just to keep people informed on the ongoing investigation what they're doing, what they're trying and so forth. So the public part of incident responses aside from the technical part also very important. So what is the context of academia in this area? Because usually you want to have a techie, you want to know someone who can work on the wire and you want someone from the ivory tower to look into your problems and to dig into your networks. Academia usually is something like the ivory tower in a sense that they simulate, they have their lab set up, they try to make things work and prove that an idea is valid and yet they cannot operate in a dirty environment, a natural-grown network just alike. This can be very tricky. However, what academia has the benefit is that it's rather watchful, probably not like Sauron and every professor who feels offended by this, I'm sorry, but usually you got the opportunity in academia to browse ideas and to discuss them widely instead of within a confined public group which is very beneficial in such scenarios. So another problem of science or why academia can be challenging in this field is that you always have the conflict science versus engineering. So usually many forensic investigations, they're pure investigations without any academic value or without any engineering value. But then you have these particular problems that academia likes to focus on which are really hard and scientists want to figure out how to improve the status quo, how to make things better or get better insights. And the tricky part because forensics or incident response is really applied is to convince an academic review that this is something novel and this is something publishable because the field in security in academia is really, really fast. Usually you can find a paper weeks before its publication online simply because then the authors have the benefit of spreading their ideas faster than their competitors, so to say. So the reviewer is then in a tough position because he's not into the idea but usually those practical papers they have a thorough evaluation and they have some points which are valid. So this is really tricky because it's new in the context of security, maybe not so new in the area of system security and in particular in totally different research areas like medicine or psychology, this is well established. So you have studies, you have their layout for how to conduct proper science and to how to conduct studies. But in this particular area this is rather challenging. Another example is that many things in computer security are rather narratives. So they are based either on marketing material or on people selling stuff and there's not much of an evidence-based science going on here. So if you have a new drug, you test it, you have your statistical tests at the end and then you can conclude whether it works or not. But it's not the same thing for digital security because if you have a new idea and even the most simple ones like is it beneficial to have an antivirus scanner in your network are very hard to answer because of course having antivirus is what everybody thinks. Yes, of course you need antivirus in particular on Windows but it's really hard to prove it from an academic point of view in a real environment whether or not this is actually beneficial. Also just at the last TCC, Bruno had an excellent talk on that topic and if you're interested in that, go have a look. So one of the benefits of academia we have creativity, we have independence and we have plenty of minions that can do work with us and problem is that we do not have that much money so compared the budgets of larger corporations with academia are so cheap compared to that. It's astonishing. So if you buy a consultant for, I don't know, a week this is almost a salary for half a year for a student. And in particular, everything from software licenses, funky equipment, all those things do not work that good in academia because they're mostly very expensive. So still, when I started in this area and I started with my PhD years and years ago there have been just a few publications that were generally perceived as standards. So one was RFC 3227 is remarkable because it dictates the order of volatility. So the basic idea is you have a breach you're trying to collect the things that vanish first as well as first. Then there was NIST Special Publication 886 from 2006. Again, trying to figure out standardized procedures how to do incident response. They also specify that you have to use a right blocker so if you have a hard drive and you want to investigate it, you have to use a proper blocking tool that prevents modifications of disk. Still, even though those standards are already really old, they have all the principles in them that is used for the scientific progress that followed for me thereafter. So what are the current challenges? One of the most influential papers of my work was written by Simpson Coffinkel like seven years ago. It was published at the FRWS conference and what it was was more or less like a position paper in particular with focus on digital forensics and incident response in which Simpson made a list of all the things that work well currently and at the moment and things that will become very challenging in the near future. Most of those things written in there have been correct. One of the things that have been written there was that there was some kind of golden age of digital forensics. So computerization progressed and people did more and more work with their computers and digital forensic techniques allowed them to look into the past more or less. So you had a file system and it was structured with a very, very comprehensive structure which you could parse and then you could sort it and timeline it and so forth which could give you a very, very accurate detail of what the person or the persons in front of the computer have been doing. Also, the challenges they faced have been rather simple compared to the complex problems that I'm going to talk about soon. Also, RAM forensics was possible so you could acquire the content of a RAM. You could acquire the content of network communications and everybody was happy more or less. What Simpson wrote was that some of the challenges that will be faced in the future are, for example, flash storage, SSD drives. So usually in an investigation, you take the hard drive, you make an image of it and then you start digging into artifacts like files or deleted files which have not yet been overwritten. The problem with flash storage is that you have up to three microcontrollers on the hard drive that can fuck you up in this process because if you copy a file to a different or if you edit a file, it is not replaced at the same position just with magnetic drives but the storage controller can put it anywhere. Compared to regular hard drives, SSDs are very complex and a lot of the responsibility of the storage controller puts something in between the analyst and the actual data. Also, what he said was lack of time, of course. This is equivalent to storage sizes. So like 10 years ago, how big were hard drives? Actually, I don't remember, but comparing, I don't know, one of my first hard drives I bought was 30 gigabytes. That was like, I don't know, 20, 25 years ago. Nowadays, you can buy 12 terabyte hard drive, which is really good. Also, the number of artifacts you could observe have been becoming more diverse. So you have a long, long list of possible vectors that you can analyze, but due to lack of time, you will focus on the most promising ones. He also said cloud. Cloud is, of course, challenging because it's not stored locally and you somehow have to get the data out of the cloud again. Encryption is a problem. I'm very much pro encryption if it's done properly. It's just very convenient. Also, the number of devices will increase and very much increased. So everyone has a pocket computer in their pocket. They have a notebook, a tablet and at least three, I don't know, PlayStation or smart TVs, cars, all those things that store information digitally, which can be then very cumbersome to analyze and making this much more challenging than it used to be. So storage capacity is a problem still today. You have, like I said, 12 terabyte hard drive costs about 600 euro right now. If you buy four of them and put them in a software rate, then you have really, really a lot of storage capacity. And one of the problems with this huge amount of storage is the time it takes before you can start looking into the data. So the forensic process usually dictates that you have to hash the data. So you build a cryptographic hash sum over the entire hard drive. Then you can copy it and then you have to hash it again to prove that you did not modify the information in any way by simply copying it. But if you think of a 12 terabyte hard drive, if you have to read it from the very first byte until the last byte, this takes something between 8 and 2, I don't know, 32 hours. And then you have to run this repeat and do it three times in a row. This is a lot of time which can be problematic in incident response, simply because you want to dig into the data right away. If you have money, there's special hardware for that. So you have so-called forensic bridges where you can plug into the devices you want to acquire and they do everything in one step. So you just have to wait for one-third of the time. In particular on slow interfaces, if you have a 2 terabyte external hard drive, which reads 20 megabytes a second, ages, just ages. Also, if you think about production systems, if you walk into a company and you want to take the productive exchange offline, this is nothing which will ever happen. Sus admins will throw themselves in your way to stop you from taking down the productive exchange system. So plenty, plenty of challenges that one has to overcome to get actually starting with the forensic investigation. So just a few examples. There have been plenty of engineering efforts to reduce the time used in these steps and to gain already insights into the stored data from the beginning. So the National Software Reference Library NSRL, it's published by NIST every three months and it contains plenty of software installations which you can hash and then exclude from the files that might be of interest for the investigation because every Windows installation kind of is the same and you have plenty of files which are redundant on every hard drive. Also, there has been work again by Simpson on identifying file fragments usually if you delete a file, of course it's not magically gone but only the reference to the file is gone. So either by using file carving or file fragment identification techniques you can figure out which files have been stored on the drive. But some of the optimizations are not that optimal. One sifting collectors, for example, proposes to use a prioritization during the analysis process. So you start with the most promising files and then you start going down. But there's a certain point in time where you have to stop looking at things and you cannot ignore the rest which is there but on the economic side it doesn't make sense to look into everything. So there has to be some form of conclusive process, some form of general agreement of, I don't know, anyone to figure out when it does not make sense anymore to dig any deeper. So encryption, of course, makes investigations tricky. The good thing during investigations is that usually people want you to look into your things but they give you the recovery key, the password and so forth. But if you want to hide something, if you want to encrypt something, this works and is usually not bypassable. Also, both devices and on the network more and more information is encrypted which is absolutely a fantastic thing. But still encryption can be bypassed, it can be fingerprinted, so instead of watching the communication content, communication metadata is inspected. And of course you can do traffic analysis on who is communicating with whom, how much data are they exchanging and so forth. Cisco just a few weeks ago had a white paper on encrypted traffic analysis. They probably figured out that the world is moving towards HDPS and everything is encrypted and their shiny boxes cannot look into the details anymore. One of the challenges which is still very much a challenge is the heterogeneity of devices. So if you are in the position of needing software for Android or iPhone, this is doable. But if you find someone with a Lumia phone and you want to dig into that phone, this is really hard because nobody makes tools for the so-called long tail where very few devices and very low probability that you will find someone who will actually pay for you to develop this. So the most common things like Mac, Linux, Windows, they work fine with the commercial tools. But if you have more on the exotic side, this can be very tricky. Also Cloud Forensics is a lie. In particular in academia there have been publications on Cloud Forensics in particular. But usually Cloud, that's at least my perception and my opinion, Cloud Forensics means either it is remotely accessible, just like EC2. You have a machine you can log in and you can do things there. Or it's some form of publicly described API which does your software magic. But both of them are new. You have methods for both ways. And you do not need some form of new methodology or new nomenclature to figure out how to do forensics on those things. And again, commercial world is already very far. For infrastructure as a service you can use just the regular tools and for software as a service like smart phone applications and so forth. Usually you can fiddle around, you can reverse engineer the Android applications trying to find the communication endpoints and then reverse the communication. What's also going to be very interesting, at least from my personal perception again, is GDPR, the general data protection legislation which will go into effect on May 2018. Because in particular for companies they have to be able to tell their employees what information they store of their browser usage, their digital artifacts and so forth. And in particular for larger companies if they haven't yet started to look into GDPR they hopefully very soon will. So what are the dos and don'ts of incident response? First rule of incident response is you have to get a RAM image. You want to get the data which is stored in the random access memory and you want to have it in a forensically sound manner. Second rule of incident response is you have to get a RAM image. Again you want to have it, you want to have it really badly. Why the RAM? Of course everything that's juicy is in there. So many law enforcement agencies still today they go for the data approach. So they storm into the building, they pack everything that looks like storage media and they drag it into the lab. But if they find the running PC usually they just pull the plug, box it and then ship it. This is very much problematic because encryption keys and open files information and so forth is lost in the process. Also it's of course non reproducible so if you have a RAM image you have the exact snapshot of what was going on in that machine at that particular point in time. Once you have the RAM image and I will shortly talk about how you can get a RAM image you can inspect the machine. You can try, for example on Windows you can use the Sysinternal tools to look into running processes or open network connections. But depending on how well you know these tools your mileage may vary. Also what you really do not want to do is to force anything that's persistent on disk. So you do not want to search for files or anything which touches the hard drive a lot. You want to focus on the things that are on that machine but do not put it on the hard drive. Also there's this tunnel conflict between rebooting the machine or pulling the plug. Usually if you have the perception that the operating system may be compromised you want to pull the plug simply because shutdown processes can be manipulated and information can be forever lost if you simply shut down the machine. But depending on the environment and the context you can also just shut down the machine because the user would shut it down anyway. Once a machine is dead it's of course dead. There has been the cold boot attack where you can get the RAM content even 10 minutes after the computer has been shut down but this is a rather esoteric approach. So in my perception once a machine is dead it's dead and it stays dead until the bitter end. Also you do not want to reboot the machine because again RAM is wiped during reboot and the information in there is lost. So for regular investigations the best case you can get is you have one machine which might or might not be compromised. You do not have any lateral network movement and the breach is contained in time. This is the best case. This is piece of cake. This is what you can easily work with. Reality however is often very very much different. For example nowadays you can have server machines with terabyte of RAM and if you want to just thinking of taking this one terabyte of RAM and making an image out of it again takes ages because you either have to dump it to an external hard drive which are slow or you have to transfer it over the network which also is very much slow. Also a breach is usually not local in one machine but it could be the entire network, it could be an entire VLAN and you want to investigate all those machines at once which can be tricky. You can have very much very fast network links tanking a bit upwards which again is very hard to acquire mostly because mass storage devices do not have 10 gigabit capacity and you need to figure out a way to get access to that data. So how can you get a RAM image? Usually for Windows best approach is FTK Imager. It's a free tool. You install it and it gives you a button that you can click on to acquire the RAM image and just pipe it onto an external hard drive or over the network. There also RedLine is from Mandiant and many of the forensic tool kits already include a free tool which you can then use to acquire RAM images. On Linux there is LIME. It's a kernel extension which you can load dynamically at runtime which gives you direct and raw RAM access. Similar thing on Mac OS. This is doable. Recall as part of GRR which I will talk briefly about in a minute works for all of the above. So if you have the capacity and the will to dig into GRR this is probably the best way to have a universal way to dig into RAM. For mobile devices on Android again there is LIME which you can push with the ADB interface. On iOS there is nothing you could try to do simply because it's designed in that particular way.  What can you do to have something ready? Just a few tricks to be prepared. First thing is of course lock all the things. Every machine has a lock file, every application has lock files. Best way is to centrally lock them and this can help you tremendously even though lock management is still tedious task. Best way is to just push it into a login machine or a pipeline and have it there ready once you need it. Even simple things like NetFlow informations from fancy switching boxes can help in case no other information is pertained. For networks the upper class switching boxes or upper class switches, usually what they have is so called mirror port. So they can use the uplink port and mirror it seamlessly to another port. But you can also do it on a budget so just mirroring network traffic is rather cheap. The best example is this particular, it's just a random manageable gigabit switch from Amazon which has gigabit on all the ports and offers the possibility to mirror traffic. The good thing about traffic mirroring is that it's completely passive so an attacker cannot see that you're actually inspecting traffic. I think this box is about 40, 50 euro which is really cheap. To use this it's a bit more expensive but it has an open Linux on it and you can already run analysis on that box which can filter out some of the traffic. Then again, reality kicks in. Where do you place this particular network tab? I tried to do this in SBA. The problem was that if I place it before the firewall I'd have to have numerous mirror ports. If you have to put it after the firewall I will not see the real IP because the firewall does not and the modem only sees one IP communicating with the firewall. This is a problem because I can either lose information or lose scope for only half of the building, for example. For collecting logs there is a lot of open source which is readily available. You have the Elk stack, you have Grey lock, you have OSSEC which can all pipe the logs over the network into a bin so that you have it in place once you need it. Also the Microsoft world there is something like Windows Event Collector and even though I've never worked with it it probably does the same thing, simply judging by the name. Also you can use Splunk or anything if you have enough money but the top three there are three that you just need to have a machine to have it running. Then there's the funky part. Again, reality kicks in. You're trying to figure out how to monitor this. This is again very tricky because you have a high number of devices, a large network capacity and mostly I put the picture here because you do not want to go down in the basement where the actual servers are. This is where Google Gur comes into place. I'm a huge fan of it. It's built dedicatedly for incident response and this is the system that Google uses internally for their incident response. You could also have smaller solutions like PowerShell. PowerShell now runs on Windows, Linux and Mac. There's also the Linux subsystem on Windows. You could try to work backwards to get access remotely but Gur is the thing that usually floats your boat. Again, trying to deploy Gur in the office didn't work because some complained that they have sensitive customer data on their devices which cannot possibly be exposed in any particular way. Then we have privacy and legal implications. Simply we cannot allow personal devices which are used by employees to be inspected at any time, which is a good thing, of course. What I then used it for is for infrastructure so you can have Gur on all the hosting servers that you can control and have it running all the time. I'm a bit short on time still. The good thing about Gur is that it works remote and it's remote all the time. The logic is server-side so you have your central server which hosts all the information and the way Gur works is that it has an agent running on every machine. The good thing is that installation is really simple. You click it.  It's like the perfect botnet. You just click it, it's installed and you have it up and running. Also offline clients run the tasks as soon as they're back online. Once the machine is back, simply because it didn't get the task because it was rebooting or having network issues, as soon as the machine is back it will fetch the task, complete it and send the results. The good thing, the really good thing about Gur is that it has scalability in mind. Allegedly there are setups with more than 100,000 machines monitored. It's a long-term supported project. It's publicly available, GitHub and all the things. The only downside I could figure out was that it has privacy and legal implications which are not trivial to overcome. One of the really cool things of Gur is that you do not need to transfer the RAM image. Gur offers you a straight way into the kernel of the machine so you could use volatility on the live RAM, which is really, really cool because you do not have to transfer hundreds of gigabytes of RAM and you do not need to store them and you do not need the time to process it. You simply use volatility on the running machine and everything is in place for your investigation. Another nice feature of Gur is that you could do hunts, so all the machines which are orchestrated by your Gur master, you could task them all at once, saying for example if a new antivirus, Mandia and FCQ or something, Super malware is published, usually it contains indicators of compromise and these are usually hashes of files or mutexes or similar things and you can pipe this information right into the Gur console and have it run on all machines within minutes. As you can see I have an HP notebook that was a bug in one of the audio drivers which used to lock everything, every keystroke into a file and in our office people had to walk from desk to desk and see if this file is here but with Gur this would have taken 30 seconds for every affected machine. So now a short contextual cut to work that we have been doing. Picatoriant is in a later step of an investigation of relevance because it takes a hard drive image and it can tell you information about the hard drive image simply by looking at the file fragments it finds on there. So you have the image, you have all the hashing and all the preparation has been done and what you would like then to know is what remaining artifacts can you identify on that drive what is still left there which was once possibly on there and the way we approached this problem was you have to have a lot of file hashes and one of the file hashes database par excellence is peer-to-peer file sharing because usually in peer-to-peer file sharing you have gigatons of hash values swirling around the network simply because people want to share files and they want to identify the file based on a hash value. So for investigations usually you would like to ignore all these because they are neither the cause nor the cure for your problems just in Beaver maybe is but that pool probably not. So how can you exclude this information? You have 12 terabytes of data, this is part of some office file sharing server they had I don't know Rick and Morty all of them on there and you want to figure out if this is really Rick and Morty and it's really the latest episode or not. Our approach was to harvest as many torrent files as possible and work with them to figure out which parts of the sectors can be identified. Also one of the very nice things about torrent files is that they are copyright free because the content that is used to sharing of course is copyright protected in many cases but the torrent file does not pertain the same privileges. What we then did was to extract all the hash values, pipe it into the wonderful tools, bulk extract and hash TP again open source software which is specifically built for investigations with a very specific set of tasks and we publish it last year. So just a few words about the hashes. Everything in BitTorrent is hashed with SHA-1 and SHA-1 is very common in digital investigations as well and what you would like to figure out is which part of chunks are absolutely irrelevant. The real benefit of this investigation is that it's fast. It's really fast not because we use torrent files but because bulk extractor is built in a way that it's really fast. I once saw a presentation by Simpson Guffinkel where he said that they once had access to a machine with 200 CPU cores and bulk extractor pinned all of them. So it was just pure parallelization at its best and the more cores you added, the faster it will be done. Also it can find deleted and even partially overwritten files so you can say afterwards the liberty that on this PC Justin Bieber was stored. Also the hash DB files which drop out at the end can be easily shared and I will show you that in a second. So how did we pursue that? Our goal was to get as many BitTorrent files as possible. Of course the first approach was to build a crawler that crawls Pirate Bay, kickers torrents and all those file sharing sites to get as many torrent files as possible. And in the end I think after four or five months period we ended up with 3.3 billion chunk hash values which if you add it up gives you up to 2.6 petabytes of information. So everything that has been shared with these file sharing things adds up to 2.6 petabytes and the tool chain is readily available. But what we then did and this is new, this happened after the publication of the paper we also used DHT crawler which listened on the queries that come in on the distributed hash table and we got another 2 million torrent files which we could then index and which we could then boost the capacity or the maximum amount of information up to 6.5 petabytes. So sharing is caring of course, the paper, the tools and everything is online and I'd be happy in particular to get feedback to this because the forensic community where I presented that was rather not impressed I'd say. So I'm presenting it here and I'd love to hear your feedback and if this is of value for your specific tasks or if it was wasted time. Anyway, thank you very much. Thank you very much. Thank you very much for this very informative talk, Martin. There's still a bit time left for questions. Do you have any questions? Please line up. There are two microphones. One more in the back, one here in the front. Anybody have questions? So I would have a question. Oh, there's somebody. Am I on the, yeah, good. So you looked at a whole lot of torrent files and you collected hashes from the files that are contained by the actual content of the torrent. Excuse me, could we go a bit closer? Closer, yeah. Ah, there I am. Thank you. But some of those files might actually be malicious files and malware. Did you do any filtering on that? No. So the beauty of it is that this is just an additional step towards finding out what's on it. So what you can find is the torrent file which is relevant for this particular sectors. And then you can inspect it. You can see which files are on it, which files have been identified. So yeah, there was no filtering. But yeah, what I forgot to mention is the beauty of this technique is not to confine it on bit torrent files because usually Justin Bieber or whatever is not that impressive. But you can pipe any information you have into it. So for example, if you have the suspicion that one of your developers took code, you can just pipe the code, torrent it and then apply this. Probably not publish it because then it would be public torrent. But this works without any knowledge of the content itself. So I would like to know what's your preferred system? How do you do it? On my notebook I have Linux. My servers are Linux. My PC at home is Windows. Yeah, a mixture of a bit of everything. And did you ever have a big incident you wanted us to tell about? Not that I'm allowed to talk about it, no. Okay, so are there any other questions? Okay, so thank you very much again.