Right from the start I've followed Volumio, the free software player for the Raspberry Pi. It's not the only player for the Pi, but for me it worked better than others at that time. Since it's impossible to keep track of all players, I kept on checking out Volumio and now there is version 3. Judging player software is somewhat personal. The software you are used to is likely to be your favorite. Over time you get used to the menus and the behavior. And when they improve the user interface, you often initially don't like it. Volumio 3 has its user interface changed in what is now called Manifest. And although you can still set Volumio to the older user interfaces, I love the new one. Already for a number of years Volumio offered its basic functions for free and the advanced functions on a subscription basis. That didn't change although the new user interface is only available to subscribers. There are several payment plans but if you agree to a yearly payment it's €60 per year. Which is what you pay with PC-based players like J-River and Audivana 2 although not on a subscription basis but for a yearly update. These are the extras you get as a premium subscriber. Multi-room synchronized playback, music and artist credit, Bluetooth input playback and CD playback and ripping using a USB drive. Furthermore you get Tidal, Cobus, Hi-Res Audio and Tidal Connect browsing if you are subscribed to these services. You can use it on up to six devices and you will enjoy dedicated email support. Unique to this new interface is that there is a menu icon in all four corners of the main screen. In the top right corner you can select other Raspberry Pi's with Volumio running or group them for multi-room. In the low right corner you go to the input menu which is identical to previous versions. Favorites and playlists are clear options. Music library, artists, albums and genres show the content of the selected storage medium for instance connected to a USB. Media servers show all DLNA and UPPAV servers on your network. I have several, the blue ones are Synology DLNA servers, the yellow ones Minion Server DLNA servers and the two red ones are Volumio DLNA servers or Volumio players. I'll get back to that. Back to the input menu where we see Last 100, which is your play history. WebRadio works like most WebRadio programs as can be seen here. Tidal and Cobus give access to these streaming services if you have a subscription and the Volumium Premium account. And then there is the menu in the top left corner. The menu in the top left corner shows the setup menus and some extras. I've been granted a premium plan and have it active on my Raspberry Pi based Volumio setups that I use for testing. These are all players I have reviewed earlier. There will be links in the notes below this video on YouTube. It's a NanoSound one, the AlloBuzz, the Allo Katana, the AudioPhonix Raspberry Touch with iSaber ES9038 Q2M DAC and the 17 inch touchscreen and the AlloUse Bridge Signature Network Bridge. The next setup is menu sources. Here you have the USB drive indexed. Add Samba shares as network drives and select what input you want to accept. PMP Renderer, SharePoint Sync, which is Apple Airplay compatible, DNA browser, Bluetooth input, multi-room playback, CD playback and ripping and digital and analog inputs for as far as the hardware supports this. Then you can log into Tidal, Cobus or Hi-Res Audio, again provided you have a subscription. Remain some settings for indexing and display. The appearance menu lets you set away volumio looks. For the older skins you can choose another background, including your own. Once set to manifest, there's little to change and that's no problem, since it looks great. Systems let you change the name and run Update and Network shows the network settings. In the plugins menu you find plugins like Spotify, Spotify Connect, 80s 80s Radio, HotelRadio.fm, Jellyfin, MixCloud and other internet sources. There also is a plugin for the 7-inch touchscreen, like I use here in the audiophonics Rust Touch, the network player with built-in touchscreen on the Raspberry Pi basis. Another plugin lets you use an infrared remote control. Then there is the Roon Bridge that makes your volumio player a Roon Endpoint next to be in a volumio player and there even is a DNA server. We already saw the volumio players as servers, next to the Synology servers. This was done by installing the mini-DNA plugin. Just attach a USB drive, I use the Samsung T7 SSD and fill out the path for audio files. I also changed the friendly name to, in this case, Katana DNA, since they use the Raspberry Pi 3B with an Allo Katana DAC as server. That's all. The music gets indexed and shared over the network to DNA players. That can be another volumio player but also an AV receiver by brands like Marantz, Denim, Yamaha, Camrytulio, Lin, Naim and many others. This makes the volumio software ideal to have music being shared throughout the house. Let's imagine one volumio player in the living, one in the study, one at son John's room and one at daughter Jane's room. That has its own music on a USB drive in the study. That music can be played over the network in the living but it can also be played by John and Jane at their rooms. And the music John and Jane have on their USB drives can also be played by dad in the study or living room. When John has a party, when mom and dad are away, he can have his music played throughout the house perfectly in sync. I had no problems with the sound quality of earlier versions. The output of volumio was and is bit perfect, meaning that any sound degradation is due to the hardware used. With simple headboards I like the Raspberry Pi 3B best. And I like the LO-USB signature with shanty power supply best if you need a USB audio class 2 for your DAC. I have the version with Digi-1 signature integrated so it offers me high quality spidive as well. The Raspberry Pi with volumio 3 will appeal to those that like a bit of tinkering. It also gives the feel of saving money, although that's only partly the case. The advantage is that you can start off with the Raspberry Pi with volumio under 100 euros. From there on you can, if you seek higher sound quality, get a higher quality sound card and extra features by subscribing to Volumio Premium. Fact is that the new manifest interface, at least to me, feels more intuitive. Which brings us to the end of this video. As usual there will be a new video next Friday at 5 p.m. Central European time. If you don't want to miss that, subscribe to this channel or follow me on the social media so you will be informed on new videos around. Help me reach even more people by giving this video a thumb up or link to this video on the social media. It is much appreciated. Many thanks to those viewers that support this channel financially, it keeps me independent and lets me improve the channel further. If that makes you feel like supporting my work too, the links are in the comments below this video on YouTube. I am Hans Beekhuyzen, thank you for watching and see you in the next show or on theHBproject.com. And whatever you do, enjoy the music.


Live from Houston, Texas. It's theCUBE, covering Grace Hopper's celebration of women in computing. Welcome back to theCUBE's coverage of the Grace Hopper Conference here in Houston, Texas. I'm joined today with our reporting fellows. This is our Tech Truth Fellowship in partnership with Silicon Angle Media and the Ground Truth Reporting Project. These are the next generation of great reporters who are going to be on the ground here at Grace Hopper getting great stories and finding out what's really going on with so many of these companies and great organizations. I'm going to introduce them and they can talk about their projects. First up we have Keras Hustad, Tori Bedford, and then Puja Sivaraman. I'm going to start with you, Keras. So tell me a little bit about yourself, where you work. Yeah, so I'm a journalist based in Chicago. I work for a publication called Chicago Inno and we cover hyper-local tech and startups in the Chicago and Illinois area. So we're really taking the non-silicon valley approach to what's happening in tech throughout our country. So tell me what you're going to be looking at here at Grace Hopper. Yeah, absolutely. So I think at a conference where you have 15,000 women in technology, it's a great opportunity to explore what happens when women are behind the tech that are going to create the infrastructure of tomorrow. Because we have so many examples of products that have missed features or have created sort of a discriminatory product feature because those tech teams were not diverse. And so what I want to do is look at a few tech companies and startups that are doing some, that already have diverse tech teams and to look at how the products, how that impacts their products. So that's one big thing I'm looking at is sort of how diversity impacts the actual tech products that will create the infrastructure of our future. So it's thinking about the end user and who that is and how she might perceive the product and then the design decisions that are made when that product is in. Yeah, absolutely. Because for so many of these tech companies, I'm looking at Apple directly in front of us, 50% of iPhone users are women. However, Apple's technical team is approximately 20% women. So the question is sort of, can you really say that you are innovating for your customer when you don't have the minds that represent your customer on your technical teams? Great, great. Well, I'm looking forward to seeing what you come up with. Let's go on to you. Tori, what are you going to be looking at? First of all, tell me a little bit about yourself. So I work as a radio producer at WGBH, which is an NPR station based out of Boston. I do a little bit of reporting there and I produce a talk culture and news show. And I'm really intrigued by this fellowship because I feel that a lot of tech, we talk about the latest innovations, we talk about stuff that people are working on, it's very exciting, it's the future. But this angle, looking at it, looking at diversity is I think really, really important. And I think there's a huge effort and it's really interesting to look at the ways that companies are doing that. Something that I have been chasing after, I've been looking at VR, like virtual reality and AR, just kind of looking at kind of the intersection. There's this ethical question of the idea of identity.    And so if you can present as or perform as this avatar that doesn't have those identifications, you could potentially get further. But that introduces a whole bunch of ethical issues where there's this erasure of identity, there's this erasure of culture, there's this gender blindness and race blindness. And so I think it's really interesting that's something that VR companies are tackling now and thinking about and what that kind of means for the future.  So what are you going to be specific? Are you going to be talking to a lot of these coders to these creators of these games? So there are a number of virtual reality companies that are kind of thinking about what it means to be a human being or any kind of character? These are deep questions. Yes, these are very deep questions. I think a lot of these problems that VR is dealing with, they're not necessarily the field that needs to, that feels that they need to solve them. But I think in a way, they're kind of doing their part. I mean, these are larger philosophical questions about humanity that need to be solved in the real world before they can be solved in the world of VR. But the world of VR is encountering them now. I think that's interesting. I think we see that in a lot of fields of technology where we have this technology and then as a culture, as humanity, we don't know how to deal with it. We don't know the etiquette of certain things that we've developed. We don't know how to interact with each other and to be the most ethical. And these are morality problems that I think is really exciting to look at in the future. Right. I mean, we are the first generation to be thinking about these things, tackling these things, having these technologies in our pockets. Yes. And so, no, that's... And we have to think about representation in these companies as well. We have to think about introducing different perspectives. We have to think about what might seem like a solution for one person or one group may not be the real solution for another group that they are hoping to represent. So I think that introduces the topic of inclusion and diversity in those companies as well. Great. I'm looking forward to seeing what you come up with. Pooja Sivaraman, tell me a little bit about yourself. So I recently graduated from Tufts University, which is near Boston, Massachusetts. Congratulations. Thank you. And I have always been... I'm a reporter for the Grand Youth Project right now, and I've always been interested in the intersection between technology and social justice. And I think in the tech industry there's a hesitation to talk about the social implications of products, but I think that's what this convention is about. It's about looking at input, who's going into the industry and output the kinds of products that are coming out of it. So I'm working on several stories, but I'm really interested in the gaming industry and specifically looking at Post Gamergate, which was a harassment movement that took place in 2014 that specifically targeted women gamers and game developers. And I'm trying to investigate whether that movement, which definitely brought a lot of attention to the fact that women are being harassed, women gamers and women game developers are being harassed. And being harassed through social media. Exactly. On the internet they're facing violent threats, they're being driven out of their homes, but... Because they are women gamers. Exactly.  And I think the Gamergate movement shows that there's this definite miscommunication between the people who are creating the games and the people who are using them, because 45% of gamers are women. And that's a really surprising statistic to some people because when you look at mainstream games, they're very sexist, they're very misogynistic and they don't seem to be made for a female audience. So I think that's the conversation that I'm looking into is that you have so many female gamers, why aren't there women creating games? And I mean, there are women creating games, but why aren't they getting funding? Why aren't they getting into the mainstream? Why aren't they on the forefront of the gaming industry? And so are you talking to gaming companies as well as sort of up-and-coming gamers? Absolutely. There's actually several really interesting panels at the Grace Hopper Convention itself from Microsoft Gaming and other gaming companies about how to improve diversity in their companies. So that's definitely something I'm interested in hearing about. And I think I also want to look at what's really fascinating to me about the gaming industries, there's this on-screen, off-screen relationship where you have female gamers and then you have female avatars on screen and you have sexism on screen and you have sexism in the industry. And I'm trying to look at how those two aspects of it correlate because what's interesting is there's been multiple psych studies about female gamers who often choose male avatars in games just because on screen it's perceived that male avatars are stronger or are better at the game. And similarly there's many female gamers who will turn their mic off when they're playing the games to almost erase their female identity. And I'm really interested in looking at these two dynamics of it, of the gamers themselves and the game developers who are trying to change that. And obviously those two populations tend to overlap because there are a lot of female gamers that see things on screen they don't like and are inspired to enter the gaming industry and create more inclusive games. Well, all of your projects get at such deep philosophical questions. What does it mean to be human? What does it mean to be a woman? How do we perceive power? This being your first conference, what do you think is the mood? Can you just tell me a little bit about the vibe that you're picking up on here? Yeah, absolutely. I mean, I think it is very optimistic but with the awareness that we have a ways to go. So actually there was a company who won a sort of data driven contest, or I don't want to say contest, it was analysis of basically the top tech companies and who is creating the most inclusive workplaces for women. And when the company that won actually had kind of like their acceptance speech, the CTO said, you know, this is really exciting but now is the time to redouble our efforts. You know, we've achieved gender parity at one stage of our company. Why can't it be across all of the companies? So I think that people are really excited that there are more women at this conference than there ever have been before. But I think they're also really excited about how to attack the next challenge. How do you get to that next level of inclusion? Right, right. And how about you? Are you finding that it's a positive mood? I think that it's interesting that you brought up these like larger philosophical questions that we're looking at because there's a lot of that. There's a lot of talk of, it's not so simple as just putting women somewhere. You know, you can't just hire women for a company, generally, there's so many complex facets to that in terms of diversity. So in a lot of times these policies that help women really help men and help human beings. And so that introduces the larger question. We were watching the keynotes and this IBM strategist, Lisa DeLuca came on and she was talking about how we are often encouraged to move in a certain direction. A lot of women feel this push to go towards STEM and to move toward, you know, and she was saying that it's important to remember that you have to follow your dreams and your passion as well, which sounds cliche, but she had always dreamed of writing a children's book. And so she had two sets of twins. After the first set of twins, she wrote this book and she got a grant and she, or she fundraised for it and she published it. And that book eventually helped her get hired at IBM because it helped to raise awareness for what she was working on and the subject of the book. That is a great note to end on. So I want to thank you very much again for joining us here with the cubes coverage of the Grace Hopper Conference. We are going to be looking at what these reporting fellows come up with. Thank you. I remember.


Moodle Workplace – Custom pages Custom pages allow you to add read-only customised pages in the primary navigation. Global pages are visible to all tenants and tenant pages are visible to one tenant only. A new custom page, MyTeams, is available. Here, the Workplace admin toggles the Workplace launcher to the left of their profile in order to navigate to Custom pages. From Custom pages, we can access any existing pages, for example the new global MyTeams page, available to all tenants. And from New page, we can create a new page. The admin first has to decide if it is to be a global page or a tenant page. A tenant page only applies to the current tenant. And while a Workplace admin can create both global pages for the site and tenant pages, a tenant administrator doesn't have the option to create global pages. The name is a page heading and will be shown in the primary navigation at the top of the site unless we choose a different text in title. The weight defines the order in which the custom pages will display, pages with lower numbers, display before pages with higher numbers along the top. Once the page is saved, we enable Edit Mode top right and then from the Content tab, click Edit Page. Here you can add blocks in a similar way to the dashboard, except that unlike with a dashboard, users can't change these blocks. For example, from Reports, you can select a report to display and with a text block, you can add text and other media. Blocks appear in the centre but can also be dragged to the block drawer on the right. From Audience, we can define who can see this page, for example all users or those with a specific role or job assignment. And the Access tab displays the names of those with access to the page. Existing pages can be managed from the gear icon and their position in the navigation changed from the weight dropdown. And note that unlike with the dashboard, these changes are reflected immediately in users' view of the pages. To summarise, custom pages allow you to add read-only customised pages in the primary navigation. Global pages are visible to all tenants and tenant pages are visible to one tenant only. A new custom page, MyTeams, is available.


Alright, thank you guys for coming and spending this fine sunday afternoon with me. I'm gonna guide you on an experience of 50 slides, 3 videos and 1 tool. Today we're talking about something called firmware slap. It's something that I've uh spent about the last year and a half working on. It's a combination of concoct analysis and semi-supervised firmware function cluster uh uh that in the end produces a series of explo- or uh of vulnerabilities that we know are exploitable. So my name is Christopher Roberts. I'm a researcher and engineer at Red Lattice. I am a CTF player in George Mason's competitive cyber club and in general I'm pretty interested in finding bugs. I like learning about program analysis frameworks and I like trying to stitch the two together whenever I get the chance. And so for this talk we're gonna talk a little bit about exploitable bugs. Just a real quick background on what they are and a little bit of the uh more recent history to kind of set the framework for what we're gonna be talking about today. A couple years ago here there was something called the DARPA cyber grand challenge. It was a combination of these automated cyber reasoning systems that were designed and tasked with finding exploitable bugs in binaries, writing exploits and throwing those exploits. And on top of that once it found those vulnerabilities they were also tasked with patching them. It was a tall order. And unfortunately they those systems were not quite at a point where they could analyze real world systems. They had a couple things competing against them today. They have a series of mitigations and protections that you as developers employ every day. You have source code level protections through things like static analyzers using like uh clang and LLVM. You have your compile time protections that's offered by your compiler. You have your non executable stack, your stack canaries making your uh relocation offsets read only. You have a whole another option that doesn't even let you use a number of uh very vulnerable uh functions. And finally if all those fails you have your operating system to lean on just a little bit with something called ASLR. And so fortunately we have all of these protections and so none of these automated reasoning systems can exploit us at all except in the embedded case. We've got a couple things that we're uh we're missing. We've uh you can use static analyzers. Sometimes you might have a non executable stack but all in all you're really missing all of those big things that make it hard to exploit vulnerabilities. Um and I'm coming to you with backed up information. I went on Amazon. Uh this is right during prime day and I typed in router. These are the top five most sold routers. And if we know that they have none of these exploit mitigations obviously this is just a show of confidence. They're telling us that these things are coded to perfection. That there is no possible way to exploit them. And so you don't need a way to mitigate exploits, right? It's really bad. There's almost no exploit mitigations on these top five routers. So a very first demo we're going to talk about something called the Almond 3. It's this smart home device that can hook up into your network. It can act as a gateway. It can act as a router. It can hook up into your home security system. Set off alarms. It can tell you what the weather is. It can do everything. And it's got a touch screen. And so this first video is going to be uh finding a couple bugs in it. There's a full screen bug. Alright so here we have got this device on the network. I'm browsing to it and on our left we can see that we can see all of our status information. We can see where the DHCP is on. What our host name is. We can see what our IP address is. This thing is living on my network. And I've gone ahead and I've downloaded the firmware online. You just Google Almond 3, secure a firmware download. And you get it right there. And I'm going to use this little script I made called PwnFirmwareCGI against this thing. And what this is going to do for me is it's going to go in. It's going to extract out the file system. It's going to extract out all of our shared objects. And it's going to go in and iterate over every single binary in this firmware. It's going to recover a series of function prototypes. It's going to recover hundreds of these. It's going to build a set of analysis tasks that we can run in parallel. That's using a system called Anger. And we're analyzing those individual tasks as individual functions for vulnerabilities. We're looking for memory corruption. We're looking for command injections. And finally this tool is going to take that information. And it's going to set it into a templated Python script that I have that just sends data to a web server. So we're using information recovered from that function prototype. We're grabbing information that takes us to that exact URL on this firmware. And we're generating the exploit. And so here we've got a whole bunch of fun colors that just tell us that it's found an exploit. And it's writing those to these files. And so here in a second we're going to see that I have two Python files that were generated automatically from Firmware Slap.  I'm going to see if Telnet's open in my very favorite port, 1, 2, 3, 4, 5. And unfortunately Telnet is not open. I don't just get my free back door. So we're going to go in and we're going to open it up ourselves using these automatically generated exploits. I'm going to go in. I'm going to launch my Telnet daemon. I'm going to tell it to listen on port 1, 2, 3, 4, 5 without credentials. I'm going to run this exploit across the network. I still have to provide the IP address. And then finally we're going to connect in. And it runs everything as root. The video had some segments sped up at two times speed. We took the demo time from five minutes to three minutes. All right, so concoct analysis has been a talk that's been talked about a whole bunch. I'm going to give you the 5,000 mile high view on what it is. In essence it combines something called symbolic analysis with concrete analysis. And a way to kind of visualize this in your head is it's representing a program as a set of equations. Each path, each possible program state is represented as a unique set of equations. And we can ask really specific questions for these program states. And so I'm using anger for this tool, which is a concoct analysis tool that was used in the third place team in the DARPA cyber grand challenge. It's perfect for concoct analysis. It's got some reverse engineering applications. And in essence, we can tell it to do this. We have some code over here on the left. And we can tell it to treat a variable as symbolic. It can be anything ranging from whatever. And so as it's going through and looking at all these individual pieces of the program, it's generating constraints. It's finding each of these program paths that print out you did it wrong or the other wrong. And it's created a different set of program constraints. And so we're not limited to just doing this for some variable where it's get user input or make this thing symbolic. We can represent a whole lot more of the program state. We can represent registers as symbolic. We can represent our stacks as symbolic. We can represent our files, our network reads, our environment variable reads, all of that as symbolic. And instead of asking, can you reach this point of the program, you can query for a lot more interesting conditions. You can ask if one of those network reads or if one of those file reads corrupts the program counter, a buffer overflow. You can ask if some of that input taints a system command, a command injection. And you can also ask it if we can track all of our reads and writes required to trigger that vulnerability. Holy cow, this thing is awesome. Why isn't it used more?  So it tends to fail on really big code bases. And this web server that I'm looking at is 200 kilobytes. That's absolutely minuscule for what I just showed you at the very beginning where we're looking at an entire firmware that's megabytes worth of size. And so we need something that can digest this large amount of information more quickly and more efficiently. And so we have a couple challenges before us. We need to model more complicated binaries. We need to model more complicated environments. We need to model when there's a hardware peripheral in a firmware that we can't understand. Or when there's an NVRAM value we can't understand. And just for kicks. Let's also try and find binaries and functions that are similar to one another. So in general, when you have these large system services, they tend to follow a pretty similar, uh, control flow. You start them up, they parse some massive config file, maybe they read some environment variables, maybe they accept some command line arguments, um, maybe they set up some sockets, maybe they parse some user input. Anyways, it's a whole lot of information that's going to consume all of your resources, all of your memory. It's going to take forever to analyze if you're just trying to do this in anger. And so I'm only interested in that very bottom piece where that vulnerable code is. And then I want to work my way back up. So there's a really cool technique that's been talked about just a couple times called under constrained concoct analysis. I'm trying to throw as many complicated words at you as possible, but all it means is we're starting from the bottom and we're working our way back up. We can tell our analysis tasks that we don't know what those hardware peripherals are giving us information wise. We can tell it we don't know what NVRAM values are being given to us. We can also skip past a lot of that initialization that comes from parsing config files, from reading environment variables, from reading our command line arguments. And we can jump past that and just look at the interesting code. We can start down here. And when you start at that low of a level, you can break up each of those actions into separate analysis tasks. And so not only are you analyzing substantially less code, it's going to be faster, you can split it up and run it in parallel. So you're using less resources and you can run it faster if you just add more cores, more tasks. It's horizontally scalable. The challenge comes in trying to understand and model what each of those actions at the very bottom are. And so our friends at the NSA released a tool recently called GEDRA. GEDRA has the ability to go into a given binary or a given firmware and it can recover a function prototype. So this is information that we can use to understand what arguments, what values, what registers go into a given function, into that very bottom piece that we want to understand if it's vulnerable. And so we can combine the two. We can use GEDRA and we can use ANGER together to build these analysis tasks with this information we recovered from GEDRA. Part of what I'm releasing later is a GEDRA plugin that goes through a given binary and it will iterate over every function, it will run the decompiler on each of those functions and it will dump the given function prototype telling us what it returns, what arguments it uses. And so we're interested in finding bugs in all of these binaries. We can use ANGER to build these program states, we can run each analysis job in parallel. So let's find some more bugs. This video has sections that are sped up at about two times speed. So here, I'm using something a little bit different. It's another Python script I cobbled together called Discover and Dump. I've got a binary here that is a CGI binary for that very same Almond Securified device. And it's going to be a lot faster now because we're looking at just a single binary instead of the whole firmware. We provided that binary to this script and behind the scenes, it's handing it out to GEDRA. GEDRA is going through, iterating over every function, recovering those function prototypes. It's building those program analysis states for us, passing those back to ANGER and then we're running our ANGER analysis tasks all in parallel and before I can even finish that sentence, it's found a vulnerability for us. So let's dissect a little bit about what that vulnerability is. Up here at the top, we have a couple arguments. We have A0, A1, A2, these are the argument registers that are provided for this function. Our tool has gone in and it has told us that we have three pointers here, three strings and we have a string at the top, we have a string in the middle with another value required for this and we can see that this very first one correlates to that first argument being passed into our function. We also have a series of tainted memory values. So these are all the instructions in the program that took that information that user provided input and touched it in memory, concatenated it together or did some sort of operation that eventually made its way down into a system call. This information, this user provided information, went down the path and was finally a command injection. And because I like to live dangerously, I made this tool always make my command injections reboot the system. It's a very visual way to see that yes we won. So we talked a moment ago about function similarities, function differences and wanting to compare one function to another. These techniques for binary and function diffing have been used time and time again to identify where patched vulnerabilities are. When Microsoft releases a patch you can go in and compare a Microsoft patch or a Microsoft patch versus a older version and you can find out where that code that was patched was and you can go back and reverse engineer this to find out where a vulnerability or a CVE was introduced. And the state of the art tools to do this are generally Bindiff and Difora. They're very visual, they're very good at looking at one thing compared against the other. And they use a set of basic block counts, basic block edges and kind of a couple heuristics. All kind of tethered together. And unfortunately they're pretty slow if you're trying to do these at scale. They're really, really good for one off comparisons for when you have that patch and you're trying to find out where that vulnerability that was publicly disclosed was. And so I wanted to take this information that I had found from this concoct analysis pass and I wanted to see if there are other places in code that couldn't be analyzed that might also be vulnerable. And so I decided to take a data mining approach. I decided to go for clustering. So for you and me we can see that there's obviously two clusters there. But we need to convince our computer that there are two clusters there. It doesn't have eyeballs the way you and I do. And so a classic way of doing this in data mining is extracting features. So on a grid up here we would call them X and Y components. And we could find the distance between all of these and all of the other points. And a very popular form of clustering is something called K-means clustering. And so you extract these features. You have these X and Y components and you pick two random points. Any two. And you categorize all the points based off of that. You ask which points are closest to which point that I had just picked. And you get this two very distinct clusters, these groupings. And what you do is you take another set of two points. Two points that were in the very middle of those groups. And you repeat this process a couple of times. And it works very similar to the way that you or I might look at one of these graphs and be able to say here in the top right we've got red, here in the top left we've got blue. And it works really well for visual information like this. Fortunately you don't need to use X and Y components and break out your algebra one knowledge. You can use the existence of information. You can use string references, data references, function arguments, basic block counts. All sorts of information that you can pull out of reverse engineering tools. You can convert this into information that can be used for clustering. And you can develop a method of really quickly finding similarities between functions and binaries. There's one hang up with K-means clustering. If you don't guess the right number of clusters you get a really bad result. Obviously there's four here but if we told it there was two we got a whole lot of blue on one side and a whole lot of red on the other side. So one of the ways we can fix this is called cheating. I mean supervised clustering. Supervised clustering is where you go in ahead of time and you say I already know what everything is. I can tell you that there are four clusters right here right now and you computer go find me four clusters. Unfortunately all of these firmware writers they don't just tell us which functions are vulnerable. They don't tell us which functions aren't vulnerable and so we can't really do supervised clustering. So I made up a word just for you guys today called semi-supervised clustering. So the idea is you use some known values to cluster data. So if you had some sort of concoct analysis pass that found vulnerabilities for you or maybe if you had CVE information you could start with some known good set of data. You could say I know these are vulnerable. I want to find functions that are really similar to these bad patterns. And so we can set our cluster counts to a number of known vulnerable functions. And we can pull a whole lot of information back out of these functions. Ghidra has a lot that you can pull out of a function. It has a lot of information that lets you convert it to the existence of data. You can turn a data string call reference into a zero and a one. You can normalize the information to make it so that one feature, one set of that data is not more important than the other. Or maybe it should be. But being at offset eight million and memory shouldn't be more important than having two function arguments. And so there's a really cool way of doing that called the cheese squared test. And if I had a whole lot more time we could talk about it. But what you can do is you can import from SK learn use cheese squared test and it works. Oh man. It was the easiest two lines in this entire program. And so what it does at a super high level is it takes all of these features, all of these zeros and ones, all of these, this normalized information and it tells us what's good and what's bad. Having the same file name as another function might not tell you whether they're especially similar or not. Or everything being the exact same architecture might not be useful information. So let's us take this information out of these binaries and just throw them away for all of our clustering. But we can make it even more complicated. We can take it a step further. We can use this thing called the silhouette score.  The way silhouette score is defined is it's how good is a cluster. Like you Google it and you get how good is a cluster again. And what it's designed to do is it tells you how similar every function in a cluster is. And I noticed as I was increasing my cluster counts on this entire firmware that I was starting to get really eerily similar groupings of functions. I was finding functions that did a lot of string operations where they were concatenating or they were s and print f-ing or they were just doing something with strings because they had a lot of string references. I found C++ destructors and constructors where all these objects are getting created and destroyed. I found file manipulations. I found lots of web request handling. And so that was really cool. And so if we go back to our horrible mismatch from before where we just guessed two clusters, we can apply our silhouette score and we can think about it as big circles. We want the smallest circles possible because we want everything that's been clustered to be really, really similar. And so if we have a really large number, we know that our clusters, our clusters of functions are not really similar and we should increase our cluster count. And we can do this over and over and over again until we get a really good number where we have a very small distance between all the functions. And so for my third demo, we're going to do just that. This video is running in real time. It is taking in over a hundred binaries across this firmware. It will cluster all of them and produce a result of how similar every function in every binary is in about a minute. And so we're providing a function that we're interested in. I know that this function is a command injection and I want to find functions that are really similar to this. And so I'm providing a path to my extracted firmware. I'm telling it to go through and iterate over every function inside of this firmware. It's recovering that set of information out of Ghidra and now we're clustering. So over here we have a set of numbers and those are the number of clusters that we are testing against and those other numbers are the silhouette score. We want the smallest silhouette score possible. And so right now we are mapping those cluster counts to their corresponding silhouette score. And so we're going to just test out 50 clusters and we're going to see that there was a spike right around 13 of the lowest silhouette score. And that is the best grouping of those functions and how close they were together. And so in less than a minute we ran across an entire firmware and compared every function to every function. And so I did this a lot. I did this for just way more than just this firmware. And I had a lot of really interesting results. Up near the top we have an impeccably spoiled number. Zero. It means we did a good job. It means the first function that we're comparing against is the exact same as the first function. It was a really good test to let me know that I was doing the right thing. But right below that I have a really really really small number again. And what this showed me is that there were code clones in this firmware I was looking at. Someone went in copied and pasted code from one binary into another. And because I did this clustering I was able to identify it automatically. And then just below that again I had another function that was really really really similar to that very first one. And as I dived farther and farther into the data I started finding similarities across calling patterns where data might be loaded in from an argument s n print f and then used in a system call. I'd find similar function calls, similar data references, similar file accesses, similar ways of interacting with sockets and networks. And so looking at that very first function, the original function we provided in that third function that was really really close it's actually really hard to tell that they're different at all. You could have just had one function in there outside of maybe the function name and the string it referenced. So many patterns were identified automatically using this clustering and feature extraction technique. So I showed you a really complicated graph earlier. We were interested in that value. The trick for finding our cluster count was finding the biggest drop. The smallest value returned out of our silhouette score. So I've just thrown a whole lot of information at you in about 30 minutes. I hope you were taking notes. I'm just kidding. I don't expect you to go out and implement this on your own. I don't expect you to try and use the first script or the second script or try to hobble through my poorly documented python. I've built a tool. This tool is called firmware slap. The tool that we're talking about today, it automates every single one of these steps. You provide a firmware. It'll locate the system root. It will locate all the shared objects. It will iterate over every function in every binary, recover those function prototypes, build and run those analysis jobs. It'll identify those vulnerabilities for you. It'll extract out the features using SK learn, iterating over all of those features to see if they're good. It will cluster those features and it'll dump it into JSON. And because I know not everyone is a big fan of black backgrounds with green text, it exports it to Elasticsearch and Kibana. You're not limited to just Elasticsearch and Kibana. It's JSON loaded into whatever you like. I've included a series of scripts to load that information into Elastic Search and Kibana if you want. But this tool is designed to talk about something a little bit bigger. You have protections in your code. If you're writing firmware, use that extra flag on GCC. You have these protections that can be so easily used to prevent a tool like this from automatically building exploits. Enable your ASLR. That'd make it so much harder for any of these exploits to land.  It's time to bring a lot more automation into our embedded systems. You have IoT fridges and washers and dryers and routers and smart home systems. And not all of these systems are getting vetted. Not all of these systems are going through the proper QA. They're trying to produce the cheapest and fastest product that they can and get it to market. And that is creating a series of very, very vulnerable devices. Don't blindly trust and run these third party systems. I'm giving you the tools to find these bugs yourself. Today this morning, I released firmware slap. You can find it on GitHub. I'm releasing the Ghidra Function dumping plugin. And I'm also releasing all of the pox associated with this presentation. And that's where you can find it. Thank you.


Tommy here from Learn Systems and TrunetScale Blueprint 22.12 is released on December 14th of 2022. I have been running the beta version for quite a while and nothing fishy happened. The installs all went swimmingly and I'm really hooked on this new Blueprint version. Also, please leave all of your well fish related puns and comments you can come up with with true scale down in the comments because I'd really enjoy reading them. In all seriousness, there is a lot of improvements and I have found even when I was doing the beta testing that release candidate testing a Blueprint, it's to be a very stable system. Two things of note, one of them that's still in the production full release here is not fixed is going to be the virtual machine's ability to talk to the host itself. So if you have the network interface set to whatever network interface your VM and your Trunass is on, they can't talk to each other, not natively without creating a bridge. I find this really odd. I know the solution that someone may comment is create the bridge, but it seems like natively they should talk into reason being maybe you want to serve up some shares from your Trunass system and you think you want your VMs to be able to access those shares but out technically using the network interface like looping out and looping back in. So I'm not sure why that's designed the way it is where you have to create the VM, tie it to a network interface and then bridge the interfaces together seems kind of odd. The second one is your apps didn't start after you upgraded from the old release to the new blue pin release. There's a fix for that and I'm going to leave it linked down in there. There's some changes they made and there's a forum discussion and there's also just a simple command you can run to fix it. But that simple command isn't run by default because it does create some security changes. And so I'm going to link to the forum poster you can read through and if you want to get a deeper understanding or if you just want to get it fixed, you can run this command really quick and it'll get your application starting. Now as far as big changes, we're going to focus on the UI one shortly, but let's just kind of run through them real quick here. And the first one you're going to notice is going to be the non root as admin. It's kind of been a joke to me with true NASA, like why have a username spot when you always have to log in as root? Well, that's finally fixed. And there's going to be instructions that they have how to create those non root admin users. You just really add them to the built in administrators group pretty simple, but they've got documentation on that. The tuning and support for all NVMe systems, this is important. So that's a new feature that came API keys with role based access controls, USB pass you for virtualization. They already had pass you for things like video cards, but using the USB pass through was well, extra steps. Now it's built into the UI store J as a cloud provider. I do plan on doing a video on store J. I think it's a really neat service. And I just haven't gotten around to really digging into it, but I did get my account set up on there. So I will have more news soon on that. But I think it's really cool, but they're integrated not only as a service you can run as an app, but also as a cloud storage provider. Check them out. It's an interesting way they're integrating storage as a distributed system. Now storage performance and improvements leaves a really broad piece on the table. I don't know exactly how much faster this is. So I'm going to do some tests where I, well, compare it to core. And that's my benchmarks I did quite a while ago. And it's because it takes a little while to put these benchmarks together. Now that I know that they've specifically noted they've improved the performance, I'm going to build a core machine, do a battery of tests, reload it or upgrade in place to the Angel Fish and I'm sorry, Bluefin not Angel Fish and do the difference. I probably won't retest Angel Fish compared to Bluefin to see how much those storage performance improvements are. But you can see my old video where I did compare TrueNAS Core and the Angel Fish version. But now that it's getting to be a more mature product, it's nice to see that there's going to be some performance enhancements that are coming from there. Now the thing we're going to drive into next is going to be lots of UI enhancements. That's the part I want to focus on really showing you, because that's where I think they just did a great job of kind of rethinking the UI to make it, I don't know, nicer, easier to use, puts a lot of information in one place as you tap through. But rather than me verbally describe it, let's jump into that. Now the first thing I'm going to do is log in not as root. So we're going to go here and username LTS and then a password I have in there will show you the current interface, which really hasn't changed much in terms of the dashboard. But there's at least one thing I will comment on here that I'm not completely clear on compared to how it worked in TrueNAS Core with it being BSD based. And that's the ZFS cache. Now there is a forum post about this. And it may help shed some light that they're doing some work on this. And you may want to change how much arc is available on there. This has been a little bit of a confusing point because TrueNAS Core system does use all of the ZFS cache based on all the free memory it has. So if the memory is not in use, hey, let's use it for cache. The algorithm seems to be different and are some limitations by default where it's only using part of the memory that you have available. So there may be some tuning you have in there, I'll leave a link to those forum posts on there. But essentially, you're just setting the ZFS max arc size. And as I said, I'm still doing testing on this. This is not something official, this is just discussed in our forums. But you can set that, for example, by saying echo, and then set it to sysmodules, ZFS parameter, ZFS max arc size. Now, if you're just doing it from command line, this will be reverted on reboot. And I'm fine with that for now, because I don't reboot it very often. I don't mind just setting it as needed. But I'm still trying to figure out the ramifications or if there are any problems that are created with that. But the noticeable thing is going to be when you go to arc summary. And let's scroll back up here to the top in here, you can look up your arc summary, and you'll see that I've set that max size 50 gigs. So by default, it was only using like half. I think that's all the defaults for Linux. So I went ahead and changed it. So I think I'm doing this properly. I say, I think there's a forum post I'll link to so you can ask some questions. I'll be asking some questions in there in the forum as well to try to get some clarification. But I thought I'd bring it up. It's at least a big change with how this works inside of Linux versus how it worked in BST, which was completely automatic and I never had to think about it. Now they did make some minor changes to the reporting, which you can get to directly here. They have a nice auto refresh to kind of cleaned it up a little bit. So we can go and scroll backwards actually go right about here. You can see where I was doing some testing on here, switching to the networking. I did some tests. I haven't had any problems with the reporting. It actually seems to be a little bit faster, more responsive. I know if you flip through them before would kind of hang up sometimes, but that doesn't seem to be the case anymore. But the arc cash thing and the memory cash thing still has me a little bit confused as to what makes it go up and down, which is why I brought that up before I brought you to the memory. Because if you're wondering why these changes are happening, these are sometimes reboots, but it seems to kind of go up and down even when I'm not rebooting it. I'm not 100% clear as to why. Now where the big changes come are right here in the storage and data sets kind of being separate as opposed to the way it was where it was one menu with storage. We have where we can manage the drives and a topology of ZFS itself. So we can see the usage, capacity, ZFS health, we can run a scrub, see the disk health, view reports, manage the disk. So you're managing the raw disk right here. And over here, we can manage the devices. So we have a raid Z one and we can expand these out, see if there's any error. And for any one of these, you get these menus that come out on the side so you can get the ZFS info on this particular device offline the device, manage the encryption device info on the device. So you're actually pivoting back and forth between different aspects of the hardware, run manual test, even on the smart drives. I like that all this is consolidated under storage. So you're managing it from the physical to the logical of the way the V devs may be set up. And then the data sets itself here. This is now inside once you have the pool, your ability to manage each of these data sets by breaking all this apart, they're able to put a lot of information together in a more consolidated way I feel. For example, if I click on my LTS video production folder here, I'm able to see that it's a data set file system standard, the settings. But if I need to change the settings for that data set, I can edit has a little slide up menu to change those by default, they inherit. So you can see inherit on or I can off for any of the extra data set features, data, data set space manager, and if I was doing some quotas, ZFS encryption, who the permissions are, I like being able to see that at a glance, and the data protection right over here. So I can forcibly create a snapshot, but I can also see the total snapshots snapshot tasks and then pivot to managing the tasks that are related to it. So there's the tasks related for that particular data set. And these just are really nice enhancements to be able to jump between any of these. And what it's doing is we have period snapshot tasks, and then it's filtering for that period snapshot tasks name, but then we can actually clear it and see all the snapshot tasks. This kind of back and forth makes it just a lot easier to manage and see like, Oh, I clearly don't have any cloud sync tasks that are off-siting this via cloud, but I do know I have maybe a replication task on it. But she got clicked back over here to the video production. There we go. And the same thing, it'll let me take it to that particular replication task, the video production to purple, which we can clear and see the other ones, the Tom computer to back up to purple and sync thing to purple. Now something I'm going to note, and we're going to edit this, the sync thing to purple purple is a NAS that I have, I've had for a long time, it's an older, slower one that does run true NAS core. And because it's running true NAS core 13, you're may wondering, well, do you have any replication problems with it? And I don't. The interoperability with replication between core and scale has been great. So I can still maintain core machines or that machine's kind of dedicated to it just has a bunch of WD purple drive, since the purple name, and I have them all stacked in there and I'm able to easily replicate to it and I can get the data back and forth. So interoperability, when you're doing the ZFS sync hasn't been a problem for doing the replication. So that's one nice thing they've kept compatibility with. Now, scrolling down here, networking looks pretty much the same. Data protection is another consolidated view for seeing all the different tasks and everything in one place, the smart tasks are sync tasks. So instead of pivoting them from the data set, this is just a different consolidated view. So you can see them, but I really, I don't know, I just really like the way they've laid this out. It's been, to me, a lot easier. It is a big change, but a lot easier overall to understand what's going on with any of my storage. Your credentials, local users, and I'll show this, but it's in the instructions link down below and we'll search for LTS. I'm gonna go ahead and edit that user. All you're doing is going to the auxiliary group when you add a user and choosing the built in administrators. Also, have an admin user separate than whatever your users are for things like your shares that still should be done by the way. Don't just assume that you always should use your admin for the shares, that's not good security practice. Down the virtualization. Now, I haven't had any problems with the virtualization. And as mentioned, and we go here and expand out and edit a VM. You can see the way the edit works on the side here, being able to change things, boot method, UFI, and I haven't done a lot on the VMs in terms of like any videos or tutorials. Those are coming. I'm going to do a dedicated one to how this works, because it's a little different than some other virtualization, but I think it's nice. It's got a decent UI to it. It's been stable and has actually survived several different updates I've gone through on here. Now, the devices, this is where they added the USB passers. So if we go here, USB pass through, controller type, and you can pick the different things that are plugged into it and pick the device and go from there to be able to add it to your system. I haven't tested this yet. I don't have anything really plugged in to dive in and test it, but at least it's here and we're building it in, which I think is really slick. Now, as far as applications, the only ones I've tested and the only ones I really use in production here is sync thing and that data, both of them work fine. I've went ahead and done several updates to next cloud and it hasn't had any problems. I don't use next cloud much. I don't use it commercially with any of our clients, but I've been testing it for each update to see if any of the issues cause any breakage and so far, they haven't. As far as available official supported applications from IAC Systems and TrueNAS, this is the current list. They've added a few more on the list. Here's your StoreJ, Plex, Minio is in here now, QT BitTorrent is in here, and I think Photoprism is new, but the rest of them are, you know, it's kind of a smaller list at the moment. Of note, yes, you can add other catalogs to this. There are the TrueCharge catalogs available as well. So that's another third party, so you can have even more application support within here. I haven't dove into it a lot. I've mostly been focusing on testing this with the current catalog that supported from IAC Systems. Now, while I didn't have any problems with TrueNAS scale, Bluefin, that doesn't mean you won't. But good news, it does set up boot environments that you can revert back to.  You just go activate the previous boot environment. But it is good practice to not upgrade the ZFS features if there were any ZFS features be upgraded. You'll get a notice on your pool that there's a feature update to apply, sometimes when you update both TrueNAS core or TrueNAS scale. And if you update to those features and those features are not available in the version you want to roll back to, well, you may not be able to mount your ZFS data set. So that's really important. You don't want to lose the pool. You don't want to lose any data sets or create any weird issues. So don't do the ZFS pool upgrades until you know that it's working. Next, anytime you set up any of the applications in TrueNAS scale, make sure you understand not only how to install them and where the data should be going, but also understand how to restore them prior to putting data in. I just like to give this out there as a warning, because sometimes people get excited. It works. They start using it for data and then they realize they don't know how to back it up or never did back it up. So go through at least one restore process before you really rely on it for data. That'll save you a lot of trouble and hopefully us a lot of consulting calls when we tell people this is kind of broken and it's going to be a lot to recover it or maybe sometimes as people have learned, there's not a way to recover it because they thought it was separate from the pool and deleting things wouldn't cause these problems. So I'm just trying to save some people some trouble. Finally, love to hear some of them fish puns. Leave them down below.  I think there's something about geek culture and play on words that go hand in hand. So give me your best true NAS scale puns or anything we can come up with around there. I will enjoy reading those. Head over to my forums for more discussion on this or any other topics I talk about on my channel or head over to the IAC systems forums to engage with the developers there and tell them what you love and what you love and maybe a little bit of what you may not love about to NAS scale and thank you and thank you for making it all the way to the end of this video. If you've enjoyed the content, please give us a thumbs up. If you would like to see more content from this channel, hit the subscribe button and the bell icon. If you'd like to hire a short project, head over to laurancesystems.com and click the hires button right at the top. To help this channel out in other ways, there's a join button here for YouTube and a Patreon page where your support is greatly appreciated. For deals, discounts and offers, check out our affiliate links in the description of all of our videos, including a link to our shirt store where we have a wide variety of shirts that we sell and designs come out well randomly, so check back frequently. And finally, our forums. Forums.LauranceSystems.com is where you can have a more in-depth discussion about this video and other tech topics covered on this channel. Thanks again for watching and look forward to hearing from you.


He hit a low, no call, Brown feeling it. He started trotting back. It was like a step bird shot it, he knew it right away. He's falling for so far, something, I put this in.