Welcome to CBS 2018 here in Santo Domingo, the Dominican Republic, where I'm very pleased to be joined in the studio that we built here with Supervidy Aranvith, who is from the Chudlongcom University in Bangkok. So Dr Aranvith, thank you very much for joining us in the studio today. It's my pleasure to be here. Now I'd like to start off by talking about capacity building. This is the global ICT capacity building symposium, that's what CBS stands for. Perhaps you could, there's been a number of conversations here about approaches in teaching and learning. Perhaps you could give us a few insights into what you might see as an innovative approaches to this. So when we say about innovative approach, it means that the teaching has to be changed, revised, than the traditional method. So if we talk about traditional method, it means that the teacher will be in front of the classroom and give the face-to-face conversation and teaching to the student. But when we talk about the innovative approach, it means that when it's changed, the teacher also has to adapt the way that they teach to the student. So for example, like the cost instead of the peer lecture for 16 weeks for the semester. So now it has to include the amount of the activity so that it could motivate the student for the creative thinking. So all that activity could be like some of the project based, or like the teacher could provide beforehand the lecture. So it's like a pre-cast assignment. The student could watch the lecture, but then the time in the class would be more of the active discussion or maybe some quiz to test the knowledge. So that is one of the examples. And are you putting these ideas into practice at your university? Yes, at our university we have, like in the Faculty of Engineering, we have adopted this concept since 2014. And we have several set of classes that we choose or the instructor would like to try the new, like the active learning approach. So we start from, because mainly our concept is based on the CDIO, the Conceived Decide Implement and Operate Standards. So for that it means that the typical class, it has to change, like for example the course syllabus. They have to add a little bit of the activity in or some of the project based in. And teachers also have to go under the training so that they know what the purpose of the new and it's become the student center. So we have adopted that for several years now. We got the university give the incentive grant as well to the instructor who would like to try this approach. And so far it's quite successful. What about distance learning? I mean that's opening up education for people who might not be able to spend all their time on campus or who might not be able to devote a specific amount of time to their education. They might be balancing it with family and work and that kind of thing. What are your impressions on that? I believe distance learning is good, especially if we talk about lifelong learning. So I believe that now we have many of the open courseware, like in the US we have MIT and many universities. But also in our university, our vision is also to support the lifelong learning to not only the students of our university, but also the people outside who are interested to get new practical knowledge. So we have the Chulalongkron University, the massive open online courseware that started in 2016. We have 27 courses and we have like 50,000 registrations. So I believe that that's quite like it's opening up the learning era. And it's also attracting people to your university as well by becoming more aware of it online on that kind of thing. But I just wanted to ask you in terms of a little bit further along in terms of the future workforce, what do you think are the tools necessary nowadays for people to be bearing in mind when they're looking at getting jobs in the future? I believe that today everything is more technological driven, especially like ICT play the important role on this fast growing world. So the students, they cannot be only have the technical strength, but the soft skill strength is very important, like the interaction with others, the teamwork ability to learn more by gaining knowledge from outside. So I believe that very important. And I think the student is aware of that as well. The company also, I think they also in needs of that, but today they are more collaborated with the university. Like they giving scholarship, giving funding support or work with students on the project in the last year. So that's how they give some insight for the student as well, like what would be the real problem when they go out and work. Finally, you've travelled a long way to be here for this symposium. What's the value of attending this event for you? I believe that it is my first time in the Dominican Republic. And I believe like, because this meeting I exposed with a lot of the experts and also like the key stakeholders. I mean, not in my area, not in my region. So mainly like what he spent from the North America, South America and Europe. It gives me a very good exposure and also to learn the experience from other region. That could give me very good feedback back when I'm back to my country. Dr Armed, thank you very much indeed. Okay, thank you very much.


Thank you, Tom a very good afternoon. I Don't have a power presentation Because on many occasions I have seen that the power presentations have lots of power, but no point and Then sometimes they have Points all right But no power behind that so I have avoided it even though some of my younger colleagues Insist that that I should have a power point presentation first of all thanks to I reshade and also to IAEA for inviting me to this forum It is an honor and privilege to share my thoughts with all of you some of you I know from earlier days and All of you are very much involved In what we call the development business In my presentation, I'll just make four points Because the theme of the presentation is human development and post 2015 development agenda point number one is What is human development? The second point would be how human development paradigm Is related to the Millennium Development Goals or the MDGs and the third one how the notion of human development is critical and should provide the substantive background to the post 2015 development agenda as well as the sustainable development goals or SDGs and My final and the fourth point would be a kind of a commercial I would like to talk a little bit about this year's human development report because the theme of it I think would be very much relevant and interesting to all of you in Ireland Back in 1990 We started with a very simple concept of human development We defined human development as a process of enlarging human choices and When we talk about human choices, there are two sides of the equation on the left hand side You have the human capabilities In order to enhance the choices you have to enlarge the capabilities of people on The right hand side of the equation you have the opportunities Because once you enhance your capabilities, you also need improved opportunities to use those capabilities a Very simple notion, but with far-reaching implications Let me just make three points on that point number one Income is a an important part of human development Income is a necessary condition for human development, but it is not a sufficient condition That is because income is a means to human development, but it's not the end of human development Point number two Human development is much more holistic than the other approaches that were at practice in 1990s It is different from human resource development because when we talk about human resource development We basically talk about human capital and how that human capital can contribute to production process We do not talk about the kind of human beings as the beneficiaries of development Human development is larger than basic needs approach which was in vogue in the 1980s and 1990s Because the basic needs talks about a minimum baskets to fulfill the minimum requirements of human beings But it does not talk about the choices That the human beings need in order to enrich their lives and third human development paradigm is larger and broader than their human welfare approach because in the human welfare approach The human beings are at the receiving end But they are not the ones who make the kind of the decisions that affect their lives so in the ultimate analysis human development is development of the people development for the people and development by the people My last point about the paradigm is this well known index the human development index or the HDI and It is one of the first composite indices that came in 1990 as a kind of an alternative way of looking at the progress of human beings The GDP per capita has dominated the scene for too long the HDI is as complex as the GDI or But it is not as blind to the broader aspects of development as the G as the GDP per capita or in other words the human development index is as Criticizable as GDP per capita, but not as blind to the broader aspects of human beings or human progress as GDP per capita So with that particular concept we have produced 25 reports This year is the 25th anniversary of the emergence of the human development concept We have produced reports ranging from economic growth to climate change from gender equality to culture from water to the MDGs and so on so forth Now let me come back to my second question how this particular paradigm Provided the kind of the substantive anchorage To what we call the MDGs or the Millennium Development Goals If we look at human development and the way I have described it the other side of it is human deprivation Because when you have limited choices when you have no choices or when you have very low capabilities and very low opportunities you have human deprivations or in other words we can call it as kind of a human poverty Now if you look at the MDGs whether it is MDG 1, MDG 2 and you go down the line You see that all those Development goals are basically to overcome The basic aspects of human poverty whether it is extreme poverty Whether it is child mortality, whether it is maternal mortality, whether it is hunger those are basically goals for overcoming the human poverty or what we can call multidimensional poverty So in a way the human development paradigm and the human rights paradigm Provided the kind of the substantive bedrock on which the MDGs as well as the Millennium Declaration Were framed on Now when we come to the third question How important is human development and how critical it is for the post-2015 development agenda and the SDGs my first point would be that You cannot have a development goal or target or indicator unless unless it is anchored into a kind of an analytical and substantive framework So therefore the post-2015 development agenda as well as the Sustainable development goals need a kind of a substantive bedrock on which You can develop the goals the targets and the indicators Now we all know that when we ask that question. What is the substantive and Anchorage for the SDGs or post-2015 development agenda? The obvious answer would be sustainable development The notion of sustainable development is the kind of the substantive anchorage on which the SDGs and post-2015 development agenda are based on In that context, I think there are three misconceptions the first one is To the minds of many people Sustainable development is about environment only This is not true We know that the sustainable development has a broader framework Where of course environmental sustainability is important, but so is social sustainability So is political sustainability when we look at The Middle East and the Arab states right now two years ago what happened in Egypt and in other places we know the that the notion of political and Social sustainability are important therefore sustainable development is broader than environment and that is precisely why in the Rio declaration it has been said that the sustainable development Development has economic social and political dimension my own view is That it is important and it is useful to talk about the three pillars of sustainability but do not take a Pillarized approach to sustainable development One has to find a kind of the entry point where you can bring those three issues together But if you talk about a Certain environmental sustainability and then economic sustainability and then social sustainability That kind of a pillarized approach will not take us anywhere To make my point very concrete suppose you take inequality as your entry point Once you take inequality as your entry point for the development challenges that you face The first thing you can talk about economic inequality in terms of inequality in opportunities Inequality in terms of outcomes so the economic part of the sustainability you can really look at it analyze it and Address it through the issue of inequality Then you can also talk about the inequality of the ownership of natural resources How the natural resources are owned by different groups and How there is a kind of a disparity among different groups in terms of the Ownership as well as the management of natural resources there you can bring the whole question of the environmental sustainability Third you can talk about the management of the resources of a particular country From the point of view of the disparities and how it is playing up with other types of Inequalities and you can bring it the whole question of political inequality Because a lot of the disruptions and the lot of the conflicts down the road Have had their roots into the kind of the disparities and inequalities in terms of opportunities In terms of resource allocation in terms of ownership of natural resources So therefore my plea would be not to take a pillarized approach or a mechanical approach to the broader aspects of Sustainable development but to find the kind of the entry points where you can bring together the different aspects of Sustainability to address them to have the policy implications and so on the second misconception is and You can hear it from different people that we are talking about the SDGs because we want to focus on middle-income countries and the MDGs were for the poor countries and since we have spent 15 years about talking about the poverty and the MDGs for the poor countries the time has come for Talk about sustainable development because we have to focus on the middle-income countries We all know that the majority of the extreme poor people live in middle-income countries 500 million people out of 1.3 billion basically live in India and China which are middle-income countries So therefore when you talk about extreme poverty, this is not an issue or a problem only for poor countries It is as much as a problem in middle-income countries number two if you go beyond absolute poverty and you talk about Relative poverty which is basically inequality Inequality is rising both in India and in China the disparities between the Coastal zones of China and its hinterland is mind-boggling The disparities between Bangalore in India and the rest of India like Bihar or Jharkhand is really serious therefore whether you talk about absolute poverty or relative poverty these are not problems of Poor countries only these are problems of middle-income countries So the when you talk about the SDGs being only for the middle-income countries That is not true when you talk about MDGs only for poor countries That is not true MDGs are as relevant for middle-income countries as in poor countries And SDGs are also relevant for poor countries because we all all know that the climate change The environmental degradation are affecting the agriculture the livelihood of Millions and billions of people in poor countries. So therefore When we bring about those issues the whole issue of poverty they are relevant for the poor countries the third and the important question is Whether there is a tension between Sustainable development and human development and that is something which is discussed in the In the academia in research institutions and so on so forth If you come from an environmental camp you always say well environmental Sustainability is about the coping capacity of the planet if you come from an economic Economist's front or the development front you say well those environmentalists only talk about environment. They don't know anything about development In my mind The human development paradigms provides a broader framework to talk about both human development and sustainable development Because when you talk about enlarging the choices of people You are not only talking about the present generation You are also talking about the choices of future generations So you are focusing on intergenerational choices in terms of providing intergenerational capabilities and also Retaining opportunities for the future generation without creating it whether it is in the economic field Whether it is in the social field whether it is in the environmental arena The whole question of intergenerational choices is very much Within the human development paradigm So in my own thinking the sustainable development is One aspect of human development when you are talking about intergenerational choices capabilities and opportunities and there is no Tension between them as often perceived by many One of the basic tenet of human development is universalism When we talk about choices we talk about choices enlarging in every society for every individual when you talk about capabilities We talk about enhancing capabilities for everyone when we talk about opportunities we talk about opportunities for everyone So the universalism is very much at the center of either of human development as well as the index in The index we talk about Enhancing life expectancy That is valued in every society. We talk about Enhancing knowledge that is also valuable in every society Decent standard of living is something every society every individual wants to enhance there So in universalism in terms of the present generation and future generation is at the very center of the human development paradigm That said I think there are three issues We have to be mindful of as we move forward with the post 2015 development agenda the first issue is that When I talk to different governments different countries different people Particularly in the poor countries They often say that look there is still an unfinished MDG agenda So there is DGs or the sustainable development goal Cannot start from the scratch It has to build on the MDGs the experiences of it The pitfalls of it the failures of it But at the very core of those sustainable development agenda their notion of extreme poverty Inequality and the unfinished business of the MDGs have to be there. You cannot just wake up on the first January of 2016 and say well that was past chapter. That was history. I'll straight a fresh That's not going to work There are at least 20 to 30 countries which have their five-year plans where MDGs are The long-term objectives and some of those plans will finish in 2017 some of them 2020 some of them 2019 They are not going to scrap their plan as of 1st January 2016 and then start afresh. So the unfinished agenda of the MDGs are still very much there Second when I look at our own experiences with the MDGs We see that Even though the MDGs were adopted in 2015 Sorry, 2000 it took five years To basically integrate them into the national development strategies. It took us another five years Till 2010 when we really became serious about it. We talk about MDG acceleration. We talk about MDG action plan but with the SDGs There is no time or Patience on the part of the people around the world to wait for that long to implement Whatever goals we come about so there will be a demand and There will be pressure for the implementation of SDGs as early as possible and that is a Responsibility the international community will have to leave up to The third and the final point With the SDGs is that When I look at the Millennium Declaration and MDGs particularly since I have been involved there the MDGs were basically Formulated by a group of experts But we know that with regard to the SDGs. There have been millions of people's they have been thousands of consultations In different parts of the world through the website Using the virtual Technology so therefore people would like to see The reflection of their thoughts in the post-2015 developer agenda as well as their ideas as to how to implement it So we are talking about a much broader stakeholder in terms of the formulation of those goals As well as the targets and that needs to be kept in mind my final thing is about as I said a kind of a commercial for the 2015 Human Development Report and I will just take a few minutes for that The 2015 Human Development Report the theme of which is rethinking work for human development and Let me make just five points there one We are not talking about jobs and employment only if we talked about jobs and employment that would be more like ILO We are talking about work So therefore the notion of voluntary work the notion of care work that people do within families and Within communities are very much part of it and the care work is important because there is a gender dimension to it the creative work The literature the paintings from which people get satisfaction Which are very much important for enhancing their capabilities are part of that definition So we are looking at work from a broader perspective and it is not limited only to jobs and employment The second point is We think that intrinsically work is human development enhancing Because it provides you with a livelihood to earn a decent standard of living It gives you security. It gives you a platform for interaction with other fellow human workers and that kind of thing Yes, there's a positive linkage, but there is also a negative linkage There are certain types of work which erodes human development the exploitative work the child labor The work of the migrants in different parts of the world Domestic work under certain circumstances Can really erode human human development destroy human dignity and violates human rights The work under very dangerous conditions the work in in different kind of Mining or other places where the worker's safeties are not Maintained can be really detrimental to human development So it is important to look at both the positive and negative linkages of Work in that particular context the third point Women's work are important The gender equality is a critical dimension of human development So we don't want to take a band-aid approach or a after the after the day approach to the issue of women's work and which is changing quite fast and Part of it is as we call it like the a tale of two cities It is a tale of two worlds of work for women the work outside home the work inside home The question is how to balance those kind of things and the question of grass glass ceiling We are one to bring in. I remember that Mrs. Clinton has announced her candidacy. I think yesterday I think in her concession speech in 2008 when she lost it to President Obama She said well, we have could not break the Glass ceiling But there have been enough cracks Because I have got 18 million votes from the Democrats. So they have been cracks So therefore, I think the issue of the glass ceiling and the cracks Have to be part of the discussion for the future generations The fourth point is the whole issue of what I call the new world of work The world of work that I knew my Parents knew are no longer there There's a flexible work time there is a crowd working you don't need a traditional office to do the kind of the work There are different kinds of services that you can have and It is changing very fast using a the internet technology the mobile devices and be the whole issue of globalization and Please don't think that this is very much limited to the developed world of certain sectors. It is not Coming from Bangladesh. I know how the mobile devices and the Grameen phone have changed the Women's empowerment their economic activities in that particular country how they use of Electronic transfer of money through M. Pessa in Kenya has changed these things So this new world of work as we see it in the developed world is moving very fast but the mobile devices and The different kind of technology are also changing the old work of work that we know and We still do not know what are the impacts of those things So we're trying to look at the implications on human development of this new world of work Yes, they have there are positive ones, but there are also negative ones The whole notion of leisure has changed you take vacations You go to a beach on your left side is your mobile phone on your right side is your iPad So that your office follows you everywhere the whole notion of family time Has changed the whole notion of privacy is now different So therefore the negative impacts of some of those things on human development needs to be looked at our final chapter would be on the whole question of what I call Sustainable work and there I'm not we are not looking at only green jobs or low Carbon emission jobs Sustainable jobs are also the kind of the work that the younger generation can have Sustainable jobs are also the kind of the work that you generate in sectors where poor people live Where the work is something to which people can connect to in terms of their creativity in terms of their longer-term commitment in terms of Having a decent standard of living. This is something that we are trying to develop as in any other Human development report there will be strong policy chapters and this is my five-minute commercial on the human development report 2015 in conclusion The post 2015 development agenda Is a historic moment Because it provides us on the basis of our experiences to have a kind of a universal global commitment To the development agenda and the development priorities That we set and we all know that the choices that we make Today would determine the kind of the world that we shall have tomorrow Because in the ultimate analysis Human destiny is a choice and not a chance. Thank you


Hello friends, I am Sanjay Gupta. In this video, I am going to explain you the concept of exception handling in Java. Before starting, you can note my information. You can subscribe my YouTube channel by clicking on the link which is available at bottom right corner of this video. You can download my app Takimiz that is available on Google Play. You can connect with me by following these details which are available in front of you.  So first point says an exception is an indication of a problem that occurs during a program's execution. Second point says exception handling enables programmers to create applications that can resolve or handle exceptions. So friends, exceptions are run time errors which can terminate execution of your program in between. So you can resolve this problem by applying exception handling in Java. Third point says in many cases handling an exception allows a program to continue execution as if no problem has been encountered. Fourth point says a more severe problem could prevent a program from continuing normal execution instead requiring it to notify the user about the problem before terminating in a controlled manner. Last point says this feature enables programmers to write robust and fault tolerant programs that is programs that are able to deal with problems that may arise and continue execution. So I hope you have understood the meaning of exception. Exception means any error that can occur during execution of the program. You can handle that error and you can show an error message to the user so that that error can be handled properly and you can implement robust or fault tolerant programs. In continuation, next point, a Java exception is an object that describes an exceptional condition that is an error that has occurred in a piece of code. When an exception condition arises, an object representing that exception is created and thrown in the method that causes the error. Next point says that method may choose to handle the exception itself or it can pass it on. The exception is caught and processed. Exception can be generated by the Java runtime system or they can be manually generated by your code. So exception can be generated automatically by Java runtime system or you can manually create exceptions so that you can control your code. Java exception handling is managed via five keywords which are trial, catch, throw, throws and finally. So with the help of these five keywords you can implement exception handling in Java. Now you can see Java exception hierarchy here to top most classes throwable which is further inherited by exception and error classes. Exception is further inherited in runtime exception and IO exception and runtime exception is inherited by array index out of bound input mismatch exception, class cast exception, null pointer exception, arithmetic exception. Then error is inherited by awt error, thread depth and out of memory error. So this is the simple Java exception hierarchy that we can use to handle exceptions occurs in Java code. Now there's an explanation regarding that chart which I have shown you. Here first point says all exception types are subclasses of the built-in class throwable. Thus throwable is at the top of the exception class hierarchy. Next point says immediately below throwable are two subclasses that partition exceptions into two distinct branches. One branch is headed by exception. This class is used for exception, exceptional conditions that user program should catch. This is also the class that you will inherit in subclasses to create your own custom exception types. Next point says there is an important subclass of exception called runtime exception. Exceptions of this type are automatically defined for the programs that you write and include things such as division by zero and invalid array indexing. Other branches is headed by error which defines exceptions that are not expected to be caught under normal circumstances by your program. Stack overflow is an example of such an error. So friends, this way throwable class is further divided into two parts. First one is exception and second one is error. So exception can be handled whereas error cannot be handled. Exception is further divided into subclasses and further those subclasses which are subclasses of exception further divided into various subclasses. So this is the complete hierarchy of exception handling in Java. If you want to watch how exception handling is implemented in Java, you can watch my further video which is available in the playlist. That video will show you how you can implement exception handling in Java. If you want to watch more programming related videos, you can subscribe my YouTube channel. You can connect with me by following my details. Thank you for watching this video.


This session is about metadata. My name is Chema Alonso. He is Jose Palazón, Palaco. We are from Spain. I'm working in a small security company in Spain. I'm also a Microsoft MVP, but I don't work for Microsoft. He's just an award on Microsoft Geese to San Technician around the world. He is working for Yahoo. He's working as a security engineer. And today's session is about metadata. We are going to use metadata hidden info to recognize the networking infrastructure of a company. And we are going to use to do this a tool. This tool is free and you can download it from the Internet just after finishing the talk or just during the talk. So if you are rushed, you can download the tool and go away. So it's easy. Well, probably most of you are aware about metadata and metadata security problems because in 2003 there was a hot topic in the news. In 2003, the Iraq war was about to start and the United States wanted the United Kingdom to be an ally. To obtain this help, the state sent a document to the United Kingdom in which this document proves that in Iraq there was massive destruction of weapons. Do you remember this story? Hands up? Yeah. Well, when Tony Blair presented the document to the United Kingdom parliament, the parliament asked Tony Blair if someone had modified this document and Tony Blair of course said no. No one from my team had been editing, modifying or translating, cutting and so on this document. But in the end, the story told us that someone had been working with this document in the United Kingdom and more than three people had been working with the document. So it was a very big scandal because they had lied to the parliament. Do you remember that story? Yeah? Well, in the end someone had to sign his demission and it was a very big problem. This is the end of the story because after happening this everybody is aware of the metadata and nobody is publishing a document without cleaning the document before. Or nobody is sending an attachment with a PDF or dog file or XML file without cleaning it before. How many of you have sent a document the last week without cleaning it before? The rest of you have been cleaning the document or just don't send email from here? Well, let's see the story. So far everybody that has been talking about metadata has been talking about this kind of data that you can usually go to the properties dialog and then you go and see who created the document, which company is the document for. But we want to talk about some more information that is there that you should definitely not be there when you're publishing the document. We call some of this information, we call that hidden information, it's kind of metadata but you cannot actually edit. Like what is the template that you use when you created the document for the first time? What is your printer? Even if you never printed the document your printer information is going to be there. What is your database structure? Like if you do this combined mail or however it's called your, the tables and the columns that you use on the database to create those documents are going to be in this hidden information. And there's also a lot of information there that you don't know that it's there.  Go ahead. And we want to treat all these three kinds of information because at the end of the day, metadata, lost data and hidden information can become one the other. Like metadata can become lost data if the programs don't do the things the right way. Like for example when you have a doc document and you want to export that document as a PDF document some of the metadata is actually going to become information on the PDF document itself, not on the metadata of the PDF document. It's going to be attached at the bottom actually and you probably won't notice that this information is there. If you publish this document, everybody will be able to see that. When you have information on your document and you publish this document, search engines are going to index this information and they usually need to have a title for the result or some of them are getting more information like what is the file type or what is the author and they are inferring this information sometimes from metadata but sometimes like for example a .txt file doesn't have a title but Google is going to tell you a title in the result. Sometimes this title is going to be the first line of the .txt or something in the footer. If that first line or that footer you didn't know the information that was there that can be kind of a problem and it's going to be indexed. When you have one file and you embed this file into another file you go to the parent file, go to properties and you will see the metadata of this document but you have an embed document there that has metadata that you cannot edit so this metadata is becoming hidden info and so on, all this information can if you have information that you couldn't edit before and then a new version of your application lets you modify this information you can say that that hidden information is becoming metadata. All these three kinds of information are at the end of the day. This is an example of how from a .txt file you can see the author, Google did this the author of this file didn't do this Google just parsed the document and decided that DTREA is the author of this file so you can see here how lost information has become metadata for the engine. This is a very funny one. There is this publishing company they have like hundreds of books on security topics and there's quite a cool functionality on the website because if you buy one of the books you just go to the second page there's this table with codes so you go to a form in the website and with this code you can download the PDF so you can get the electronic. They are selling the books on Amazon and Amazon has this look inside and look inside is going to give you a random chapter and also the first pages of the books so you just have to go to Amazon get the look inside look at the second page go to the site enter the code which is actually always the second more examples like on the left side you have a document these two are from Novel you have a link and the link is actually pointing to she see backslash document and that's a username it's giving information from someone that was just downloading the document from home about the username of the box I really like this one on the right side this guy was copying some script from one of his servers and then when he pasted on OpenOffice OpenOffice recognized the format of a URL and then automatically creates a link so the guy sees it and there was an IP there he goes, removes the IP and he puts this IP underscore CLM but he didn't go to actually edit the link so if you do the mouse over on the link or you actually click the link this is an IP in this case this is actually an IP that you can access and you can see here more information this is started with metadata but following the link you can see that he's using Apache on Windows Windows and Apache I think this is part of the Novel Microsoft Agreement maybe The question is are people aware of this and the answer is no even after what happens with Tony Blair people are not taking care about metadata, hidden info and lost data and it's funny because you can extract a lot of information from the network infrastructure from big companies, software companies and even security companies so just as a couple of examples we are going to look into the FBI files this is a government organization and they should take care about the documents if we look for Office document into Google we can obtain more than 4,000 documents if we are able to extract one metadata one internal data from each file we are going to obtain a lot of information a lot of data from the internal network and this can be very bad for this website so we are going to use FOCA but we are going to use it later in an advanced mode now just a quick introduction FOCA friends, friends FOCA and we are going to analyze a document from the FBI it's an Excel document this document is in this URL you can download it all the documents using FOCA of course and we are going to analyze this document, just track and drop extract metadata and look the info that we got inside with only one file we can discover a lot of information two users, a printer which is shared in a network server this is an internal server so we know that this user has access to this server so we can create the ACL of this network we discover an internal domain which is not published we discover the email account the operating system which is running on... this is only from one single file so let's see what happens in the end when we analyze 4,000 documents so... is there any lawyer here that can tell us if downloading something from the web and looking inside is illegal in the US? no, in our country this is not a crime and remember, if something happened my name is... well remember, my name is Fermin well, this is Masile Defense Agency this is the people who is taking care about the Masiles they are publishing 1,000 documents and we can analyze one of these documents quickly so let's see what they have this is another Excel file drag and drop extract metadata and you can discover a user, an internal server the operating system the Windows Server and so on only from one single file so the question arises when you are sitting in front of us asking oh my god, how many files is my company publishing? are clean these documents? well, probably not because nobody is taking care about this and another big misconception is that only Microsoft Office documents store metadata and this is not true because all the Office files store metadata, hidden info and lost data so as we saw with the Tony Blair example with metadata you can get screwed up in many ways but we want to talk about fingerprinting network fingerprinting actually using metadata so this listing here is just a random search for open office documents we grep for some printers we could have grep for templates or some other files some other stuff inside the document but just looking at the printers let's see how many different stuff can we do here because what we are what we are doing here with metadata is actually using the information first thing that you can see is IPs again, this is downloaded from the web but the IPs that you have here are the internal IPs of the network you have here the example that this doesn't happen only to small companies also happen to big companies like Sun, Novel and then more stuff that you can see here is like different names that CIS admins are going to give to servers like, that's a second if you see there something like SRV2 there's probably an SRV1 so again it is started with metadata and from this data I'm going to use my tools to go get some more information there's another one there with his how many of you do that in your company? SRV1, SRV2, how many of you do that? some hands? there are another kind of system administrator show your hands if you have a Mordor server Darth Star, Luke, Leia, Han Solo, Chewaka show us words, don't be shy show us words if you do something like this no? okay so actually so doing this there is this technique which is called DNS prediction using Google and there is this guy who presented this paper is Johnny Long who said that you can go use Google Set which is a tool that as an input takes a term and as an output gives you a list of related terms so with a tool like this you can go and try to get other names so you go to the subdomain of the server that you want and then try other subdomains we included this functionality on the FOCA and then actually this is for the Sun Microsystem example there was a poland.sun.com and then FOCA went through this list and discovered Slovenia.sun.com so you can do stuff like that this is another sample of how starting with metadata you download this from the web and you see that in the metadata there is a username there's a URL there with a server name there's some more information about the PDF so you go take that piece of information make another Google search and then you get some funny message error messages and that stuff and you discover another server name you ping that server name this was from an American Express example and then you see that I mean you didn't know anything about the organization before maybe they are not even hosting the files inside the network they are hosting in a third party but you now know information about the network and you can actually ping it and access this information well in the end all kind of files store metadata you can extract metadata and hit an info from Microsoft Office documents of course but also from open office documents from PDF, from EPS from graphic documents looking into the XMP or XIF information and almost everything in this example this is a picture with GPH data but in an XIF in a picture with XIF information you can discover the device with which this picture has been taken or the data the software using this mobile to create the picture and even the data when the picture is taken this is quite funny because two months ago a girl sent me a picture and I said oh you look great and she said thank you and I said how old is this picture and she said to me oh only two months and the picture has been taken in 2006 it's true, it's true also when you have pictures embedded in office files you can access to this information if you are using FOCA all the images and look for the XIF information in this example we are going to use a file from Novel Novel is our friend and just drag and drop, extract metadata and look into the picture, the file and you can access to the XIF information and in this example you can see how this picture is copyrighted by Jonathan's story because for sure Novel has the license to use this picture in this presentation I guess but you can find metadata also in videos in this example is a video in which it's possible to discover the user name or the speaker or in a printed TST it's quite funny because almost everything, all the documents printed from notepad print in the footer the path from which this document was printed and in this case this is a real example with a girl, this is the user name so you can find metadata around you you can find metadata on the toilet after you use it this morning go ahead please so what can we found in metadata as I said a couple of times so far the point of our presentation is to get all this information to some fingerprinting of the network we are interested in users and getting who created the user, who created the document who modified the document there is going to be as we've seen before something in the path that is also the user name we have plenty of information about the users of the internal network on the documents we have operating systems we have printers both local printers, remote printers from the path we have a lot of information to internet servers, NetBio servers we know the protocols that they are using for printing and for sharing files we do things like, if something is like slash slash or backslash name of something slash whatever the tool is going to semantically analyze that path and that information to know what in this path might be a server and then try stuff as we said before database structures device information from pictures, all that stuff that we send how can you track this metadata while just looking into it most of the time it's either strings sometimes it's binary and binary you can just open an hexadecimal editor and then see the row hexadecimal you have a couple of examples there like xeditor or vintex or you can use some special tools that have been created so far you can use it as an interactive readers for images or libestractor which is a tool that will take office documents and read the information there or this other like this is a screenshot of libestractor it's taking a doc document and you can see the history of the document there are some users that stuff you can use metagoo field too which is a tool that is actually going to take the domain going to Google get all the information libestractor and then present you with that information this tool is being created for another Spanish guy so it's great and of course you don't need even a tool you can just use in Google because as Palaco told at the beginning of the presentation Google has its own metadata so we can discover an FBI user just looking into Google for something like this looking into TTL for the war documents and you can see the users in Medraniac, Callaway your user from the United Nations your user from the Scotland jar your user from the Caribbean area remember not American cars in Italy and of course your user from the White House no no you have to be kidding me no no it's true can we get the user from the White House? yes we can of course so the problem with the tools that existed they only extracted metadata and they didn't do it well they left a lot of metadata there that they didn't show they absolutely didn't look at the other kinds of information that we've been telling so far they didn't do anything with the information they just say this is the information this is what we found there so you do your stuff and doing that with 4000 files is a tough task so this is an example of how you can take Excel file you use the Libestractor tool and you get there like one couple of users the software that was used and that's it with R2 you get an internal email printer, some more stuff that wasn't there so we just created a tool that looks at absolutely every metadata that you can find another example because Libestractor is not very good either with XML files office documents are XML so there's almost anything there in this file being analyzed and a lot of information with the tool that we created this is another very good thing that our tool has the point is that the tool that I mentioned before is going to Google and it's going to download office documents and for that it's going to do the file type column whatever problem is that Google implementations for this is wrong because what they are actually looking at is the extension so if you have one servlet or PHP script or something that is reading the file from the disk to serve it the extension of the script is going to be .do or .php but the file itself is going to be PHP the thing is that Google knows it because if you look at the screen on the left side they know there is a PDF file or file type PDF they won't show you these kind of files so we decided to use both Bing and Google for doing the search if you do examples of this you will get like I think we have a screenshot you have 67 next if you see there just using Google you have 63 documents and you discover nine kinds of software same domain you use Bing and documents you discover ten kinds of software so you combine both you have much better results so joining all these stuff we got FOCA FOCA is a tool that is going to collect all the files from the from the internet it's going to load automatically it's going to extract all the metadata hidden info and lost data and after doing this you can create more or less a map of the network so let's see this working and we are going to do it with the missile defense agency for instance so this is quite simple the project name, the domain and the folder to store the files and once you do this you have your doc for office 2007 documents open office pdf and also work perfect documents because it was great and of course you want to customize your search joining more than one to mine you can type your comments here and if you are working on a network share you can drag and drop and all the files will be here so extract all metadata and the tool is going to analyze all this document if you are working on an internet with document management system such as SharePoint or whatever this tool could be very dangerous because that documents store a lot of information can be and anyone this tool can access to a lot of information well the tool is going to create a list with the users this is the users of the missile defense agency well you can extract, export all this user to a file which is good because you can create a dictionary to attack some login page or whatever the folders the folders with the internal servers software emails you can drop a line to them and of course you can join all this information and just click in analyze metadata the foca is going to cluster all this information and draw the map of the network more or less it's not exactly the map but more or less and you got the operating system this is the list of personal computers and in the end you got the servers and you can look for another servers this is the headquarters this enough you can do the same with the FBI for instance in this example we analyzed more than 3,000 documents and no it's not a crime it's public we'll read documents, public documents but in other ways for those of you that are penetration testers to get to something similar to this you have to first get access to the network and then you have to maybe find some SNMP server with a public key for community to this like users, printers all that stuff and this is just a Google search and a Bing search from home you got a lot of information, you can see which the information about this computer for instance the users and the document used to infer this computer and you can of course track in the documents and find out which software is using in this example eSquad I suppose they got the license and so on well, you can do the same with Nobel, Missiles and a lot of places well, it's enough, go back there is also an online version but it's only for one file but in this URL you can download this tool, FOCA is free so you can download it from this URL and start to play with it just today how to fix this problem with metadata as as your users to clean the documents before publishing them is what you have to do or get some low cost engineer to clean the documents, get some stuff there's a couple of solutions to go one by one cleaning your documents, if you're using Microsoft Office 2007 there is this kind of inspector so you go to the properties, run the inspector and then it will tell this thing here, this thing here this thing here, this shouldn't be there if you want to publish the document so do you want me to remove it? it's better if Microsoft Office 2007 is in Spanish and then you remove this information if you are using 2003 version you need to have this adding which is called remove hidden data and it's going to do pretty much the same the problem is that it's not doing it quite well, it is actually removing a lot of information but it's not removing all the information this is a cool example to see how metadata you cannot leave anything there in this case the OLE streams the Microsoft Office is using if you see the structure there, there is just two bytes of information with a small number of them and then we created the tool on the right, the table on the right to identify to map operating systems to version operating systems and software in cloud inversions to those two little numbers so even if you are running the inspector or the plugin, Microsoft Office you need to get to leave those bytes there, those little two bytes there and then we will just read those numbers and get the information so we have a demo for these two we are going to create a new project new project and we are going to use for instance this document this one is a binary office document and we are going to focus focus rules, extract metadata and we got a lot of information in this case this document is being created with Office XP from Windows XP we got two users from noble ok so now we are going to clean this document with Office 2007 before to do this we are going to create a copy and then we are going to use Office 2007 so we are going to inspect the document and Office 2007 is going to tell us that there are personal information storing it, hidden info so we are going to remove all the information inspect again and everything is clean so it's perfect so now we are going to save the document close it and drag and drop it to the foca so now in the foca we are going to analyze this document and as you can see now actually it's possible to discover that this document it's being manipulated with Windows Vista which is my operating system and with the Microsoft Office so it's good but it's not perfect that you can still recognize the operating system from the user the same happens with OpenOffice documents they include an option to clean the document and I'm not sure if I should say that they do it right or wrong because what they do I don't really understand I think that they remove the information that was there but then they put the information of the OpenOffice that you are using to remove the other information so I don't really get it so just go ahead demo of these two so we created this OO Metastructure tool which actually does it right this is free it's at Codeplex you can download it and use it so we have a demo of how the tool works and it is in Spanish because in Spanish it's better but you are welcome to translate it and to port it to something that is not Windows I'm here so now we are going to do the same but we are going to analyze this document this document is from Novel so first of all let's analyze the Metadata storing it with FOCA so extract Metadata and as you can see this document is a poem with a lot of information servers, user paths, mails and it's been created with Windows 32 using an OpenOffice 2.3 and that's all so now we are going to use the OpenOffice to clean all the personal information from this file to do this we are going to open the document open the document it has macros so now we are going to tools options security it's in Spanish but I'm translating options and there is an option which is select to remove all personal information when saving which we are going to do is just accept and save this document with another name copy ok so now we are going to analyze this new file with FOCA this one with FOCA drag and drop document is here extract Metadata and it's quite strange because now the information is that this document has been edited with Windows 32 and my machine is 64 bytes bit I don't know why but it's my OpenOffice version and of course this is my printer so it's a mix between the old information and the new information so in order to fix this we create MetaStrictor so drag and drop the file now Metadata delete Metadata and if we analyze this document right now with FOCA we are going to obtain nothing which is good so it's quite simple you really have to give this tool to your users and they will go through the 5,000 documents, remove everything ok that's all and you will fire it in one month more or less well you cannot trust your user and if you don't trust your user you can use a special tool this is a tool for IIS this tool is a plugin which is going to delay all Metadata from documents or sending to the client but the original remains the same so it's just to protect the files in your website and you can use another option after cleaning all the documents you have to back Google to delete all documents cache because store all the documents in its servers so first of all you have to clean your documents take it off from your website then go Google and using the webmaster tool say please Google delete this file because it has my printer server it has my user account please delete it and of course don't trust your users try to because if not you are going to be working on your system your platform it can be liners or windows or whatever and your user is going to pay attention or not it's a tough task to clean all documents but don't complain about your job because there are of course worse jobs in the world so working security is not that bad so don't complain and of course if any of you is wondering if this presentation has metadata of course it is full of metadata this is the metadata of this ppt and that's all thank you for your attention


Hersey, good run here by the Rocker inside in. It's going to break for him actually, the Italian who bends it. Good block from Sikker, yeah! The Wanderers have been missing. A lethal striker in the past month or so. One chance, one goal, the Wanderers in front. Well, it's a super goal, and that's what strikers drive on. That's what you want from your striker.