# Media

url: https://www.youtube.com/watch?v=7ZU8kQNjAcc
title: Rust's next major update is coming...
type: video
author: Let's Get Rusty
ingestion_date: 2024-09-13
transcription_model: large-v2
vector_embedding: pending
chunking_status: completed
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=7ZU8kQNjAcc",
    "title": "Rust's next major update is coming...",
    "description": "Rust's next major update is just around the corner, and it's shaping up to be a game-changer! Every 3 years, Rust releases a new edition, and the highly anticipated 2024 edition is almost here. In this video, we'll dive deep into the exciting new features and improvements coming with this major update.\n\nFree Rust training: https://letsgetrusty.com/bootcamp\n\n0:00 Intro\n0:29 Generators\n2:32 Polonius\n3:41 Additional features",
    "channel_url": "https://www.youtube.com/channel/UCSp-OaMpsO8K0KkOqyBl7_w",
    "duration": 287,
    "channel": "Let's Get Rusty",
    "uploader": "Let's Get Rusty",
    "upload_date": "20240905"
  }

  This text was transcribed using whisper model: medium

   Rust's next major update is right around the corner. Every 3 years, a new major update  to Rust is released. These releases are called Rust Editions, and now we finally have more  information about the long-awaited 2024 edition. In this video, we'll cover the most exciting  changes planned in this upcoming Rust edition, and the additional features shipping in the  next 6 months. In a recent blog post, the Rust team outlined their project goals for  the second half of 2024, which includes shipping the 2024 edition. The first exciting change  in the 2024 edition is reserving the Gen keyword so that generators can be added in the future.  Generators provide a way to create iterators using imperative syntax, or in other words,  describing a sequence of actions. And the big benefit is that they can greatly simplify  the creation of complex iterators. For example, let's say we wanted to implement an iterator  that yielded prime numbers using the sieve of Eratosthenes' algorithm. Now, there are a few  approaches we can take. First, we can take the manual approach by creating a struct to manage  state, and then implementing the iterator trait on that struct. The problem is this leads to  verbose syntax and a lot of boilerplate. We have to deal with complex state management,  and the solution is less intuitive because the algorithm is obscured by the iterator  implementation details. So this is the manual approach. The second approach would be to use  combinator methods to simulate something close to the sieve of Eratosthenes' algorithm. The problem  is this code is hard to read because the algorithm is spread across multiple combinators. It's  difficult to express complex state management, and this implementation is significantly slower  than a proper implementation because with combinators, we can't actually implement a  true sieve of Eratosthenes' algorithm. The third approach is to use generators. By creating a  gen block, we're able to yield items for each iteration. The yield keyword pauses the generator's  execution and returns the value to the caller. Notice that this code is extremely concise,  very readable, and is just as efficient as the manual approach we mentioned earlier. Now,  it's important to note that in the 2024 edition of Rust, the gen keyword will be reserved,  but additional work is still required to actually implement generators. That being said, after  generator blocks are implemented, the Rust team is already thinking of additional features. For  example, supporting async generator blocks and adding the gen function or gen trifunction syntax.  In general, I'm very excited that progress is being made on this feature, and I can't wait to  try it out in nightly. The second exciting feature mentioned in this blog post is Polonius.  Polonius is Rust's next-generation borrow checking algorithm. It's an improved version of the current  borrow checker that resolves some common limitations. For example, let's say we have a function which  takes a hash map and key as input, and it either returns a mutable reference to the value if the  key exists, or inserts a default value and returns a mutable reference to it if the key does not  exist. Returning a mutable reference to value in the sum path requires that the mutable reference  to map lives until the end of the function. This prevents mutation in the none path,  even though the original mutable reference to map isn't used in the none path. The solution is to  implement a borrow checker that understands these nuanced cases. Polonius would be smart enough to  recognize that this code is memory safe and allow it to compile, meaning we can spend more time  coding and less time fighting the borrow checker. The Rust team has the goal of landing Polonius  in Nightly in the next six months, and eventually shipping Polonius to stable Rust. This means that  in the next six months we get to try Polonius on Nightly Rust, which is extremely exciting.  Some awesome additional features planned for the next six months include delivering some critical  building block features for async Rust, like support for async closures and send bounds,  unblocking Rust adoption in the Linux kernel by stabilizing a number of features, shipping cargo  script which would allow you to create a single file with Rust code and embedded dependencies,  stabilizing parallel frontend compilation which can improve compile times by up to 20%,  reducing syntactic overhead when working with reference counted data, and a few other smaller  features. The 2024 edition of Rust is expected to land in Rust version 1.85, which will be released  to beta just past the new year on January 3rd, 2025, and will reach stable Rust about a month  afterwards. If you need help becoming a Rust developer or are just curious about the opportunities,  make sure to get your free Rust training at letsgetrusty.com bootcamp. Hope you've  enjoyed the video and remember to stay Rusty.


url: https://www.youtube.com/watch?v=769VqNup21Q
title: why rust libraries may never exist.
type: video
author: Low Level Learning
ingestion_date: 2024-09-13
transcription_model: large-v2
vector_embedding: pending
chunking_status: completed
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=769VqNup21Q",
    "title": "why rust libraries may never exist.",
    "description": "Rust libraries may never exist. Sure, I know what you're thinking: sure they do. In cargo. Well... it's not what you think. In this video we talk about why Rust libraries may never actually exist, and what we can do about it. \n\ncrabi PR: https://github.com/rust-lang/rust/pull/105586\n\n\ud83c\udfeb COURSES \ud83c\udfeb Learn to code in C at https://lowlevel.academy\n\ud83d\udcf0 NEWSLETTER \ud83d\udcf0  Sign up for our newsletter at https://mailchi.mp/lowlevel/the-low-down\n\n\ud83d\ude4c SUPPORT THE CHANNEL \ud83d\ude4c Become a Low Level Associate and support the channel at https://youtube.com/c/LowLevelLearning/join\n\n\ud83d\uded2 GREAT BOOKS FOR THE LOWEST LEVEL\ud83d\uded2\nC Programming Language, 2nd Edition: https://amzn.to/3OKh3q2\nC++ Crash Course: A Fast-Paced Introduction: https://amzn.to/3qdZILK\nThe Rust Programming Language, 2nd Edition: https://amzn.to/3MHaS36\n\n\ud83d\udd25\ud83d\udd25\ud83d\udd25 SOCIALS \ud83d\udd25\ud83d\udd25\ud83d\udd25\nLow Level Merch!: https://www.linktr.ee/lowlevellearning\nFollow me on Twitter: https://twitter.com/LowLevelTweets\nFollow me on Twitch: https://twitch.tv/lowlevellearning\nJoin me on Discord!: https://discord.gg/gZhRXDdBYY",
    "channel_url": "https://www.youtube.com/channel/UC6biysICWOJ-C3P4Tyeggzg",
    "duration": 446,
    "channel": "Low Level Learning",
    "uploader": "Low Level Learning",
    "upload_date": "20240225"
  }

  This text was transcribed using whisper model: large-v2

   Rust libraries may never exist, and it's for this exact reason that when you build anything in rust,  you need to download like a thousand crates and cargo and spend the next decade of your life  compiling your project. Now, the rabbit hole on this one goes deep, so stick around until the end.  I'm low-level learning, I make videos on YouTube about programming and software security. Now,  Rust is one of my favorite programming languages, I'm a security researcher, and I honestly believe  that the features in Rust like the borrow checker and the runtime access checks will usher in a new  era of safer software. Every major system in the world is written in the C language, that's the  Linux kernel and a bunch of other really foundational software. And while C is extremely  fast, the language offers programmers too many opportunities to shoot themselves in the face  from a security standpoint. And despite the dozens of skill issue arguments and the dozens of security  features that seem to get added to the C language and the C standard libraries on a daily basis,  still remains that 70% of security vulnerabilities originate from memory issues in C. But at the same  time, I completely acknowledge that Rust isn't the most straightforward language to learn with.  The syntax is a little messy and sometimes the compiler gets mad at you. And then the compile  time takes forever. So why is that? Why does Rust take forever to compile? And why are the  binaries so huge? Now, fortunately, libraries would fix all of this. But unfortunately,  Rust libraries don't actually exist and they may never exist. So before you tell me about Cargo and  how Cargo creates our libraries, you download and hold your horses. Cargo is a package manager and  it does manage libraries. But these libraries aren't the same as libraries in languages like C.  Let me explain. Every program you write in C, for example, depends on the GNU C library or libc.  Functions that you use in every piece of code like open or read or write or close are already  written for you, luckily. And more importantly, they're already compiled for you. libc exists  as a shared object, which lives on your file system as a file that your loader can reach into  for functions that it needs to run the program at runtime. And the reason the C language is  able to do this, and specifically in Linux, is because of the definition of the ELF application  binary interface or the ABI defined for the ELF file format that adheres to function calls in a  way that are compatible with C. This ABI exposes an interface for your program, an ELF, to reach  into another ELF and find any function that it needs. The ELF ABI specifies a table of functions  or a symbol table that a program can parse specifically to find a function that is exported  by that program. And this is exactly how libc exposes function calls. This ABI also guarantees  that the data defined in one program is in the same order and in the same location as another.  So struct X with elements a, b, and c will always be in that order, a, b, and c. This allows  interoperability between not just functions, but data in libraries as well. This is where it starts  to get a little crazy. Rust does not at this time have a stable ABI or an application binary interface  to share information across multiple binaries. So cargo packages exist, but Rust libraries don't.  All the cargo package is is a blob of source that you locally compile and it combines all of that  code into one big blob of code inside of a singular ELF. So effectively, anytime you compile a Rust  program, you are compiling every cargo package together required for that project and smashing  them all into a single binary. Hence the high compile times and hence the high binary sizes.  So how do we fix this? The answer is not simple. Organizing an ABI for a language and spec like  the CELF is pretty simple, mainly because C is just a high level abstraction around assembly.  So there isn't too much information to hide, just basic types and function calls. Rust, on the other  hand, is a different beast. Structs in Rust really aren't guaranteed to be in any particular order  across program boundaries. As long as a and b are in the structure, it's fine. Also, generics create  a whole other world of problems because they're statically dispatched and built at compile time,  as well as many other complex issues with types in the language. Also, a ton of power in Rust comes  from compile time static analyzers that run checks like the borrow checker, which isn't possible if  there's a compiled binary. If I pass a mutable reference into a compiled binary, how is it  possible for the borrow checker to make sure that the reference is used in a way that is safe?  Now, I know what a lot of you are probably thinking. Wait, doesn't Rust have a C ABI  explicitly for this reason? So yes, the Rust language does allow you to create  types and functions that are exposed using the ELF ABI using the reprC syntax. reprC decorator  basically tells the Rust compiler to do what C does, order the structure the way that C would,  create symbols the way the C would or the way the ELF would, and create a foreign function interface  to call through. So doesn't that kind of solve our problem? No, not really. Using reprC doesn't allow  any of the Rust features to cross the application boundary. We can't expose a function with unique  types using the exotic typing system that Rust has. And also any function call that crosses the  reprC foreign function interface is unsafe and disables the borrow checker. reprC is great for  converting Rust code into a C library, but not for creating Rust to Rust binary objects. Now, luckily,  I'm not the only one talking about this problem. There are plenty of people much smarter than me  that have opened merge requests into the Rust Langmaster to produce their own ABIs. Now,  this problem will require the entire Rust community to get on board probably with one  ABI that is the most feature complete and makes the most sense before we can make meaningful  progress. You can go check out this pull request. I'll put the link in the description below by  Joss Triplett, which exposes the feature for an experimental feature gate to create a new API  called Crabby or Crab API, which is pretty funny. The motivation here is today developers building  projects incorporating multiple languages or calling a library written in one language from  another often have to use the C ABI, and that's reprC from before, as the lowest common denominator  for cross-language function calls. As a result, such cross-language calls use unsafe C representations,  again, reprC, even for types that both languages understand. For example, passing an instance from  Rust to another high-level language will typically use the unsafe C care star even if both languages  have safe types for counted UTF-8 strings. And like I said before, also furthermore,  higher-level data types such as Option and Rust currently require translations into C  ABI compatible types, which discourages the use of such types in cross-language interfaces. Again,  we don't have a way of communicating a generic type in Option T or Result TE. So go check out  this pull request. I think it's pretty interesting. The entire world of ABIs and how to make systems  more interoperable is really interesting to me. Now, let me know what you think down in the  comments. Will Rust libraries ever exist? Will shared objects rule the world? And will Rust  always compile into these gigantic amorphous monoliths? If you like this video, do me a favor,  hit like, hit subscribe, and then go check out this other video about an internet enabled.  I'm not going to say it, but you'll see.


url: https://www.youtube.com/watch?v=ihtAijebU-M
title: new attack leaks secrets using RAM as a radio
type: video
author: Low Level Learning
ingestion_date: 2024-09-13
transcription_model: small.en
vector_embedding: pending
chunking_status: completed
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=ihtAijebU-M",
    "title": "new attack leaks secrets using RAM as a radio",
    "description": "The RAMBO Attack on RAM is truly amazing. Some of the best research I've seen.\n\nhttps://www.covertchannels.com/\nhttps://arxiv.org/pdf/2409.02292\nhttps://www.wired.com/story/air-gap-researcher-mordechai-guri/\n\nhttps://youtu.be/CjpEZ2LAazM\nhttps://youtu.be/-D1gf3omRnw\n\n\ud83c\udfeb COURSES \ud83c\udfeb Learn to code in C at https://lowlevel.academy\n\n\ud83d\uded2 GREAT BOOKS FOR THE LOWEST LEVEL\ud83d\uded2\nBlue Fox: Arm Assembly Internals and Reverse Engineering: https://amzn.to/4394t87\nPractical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation : https://amzn.to/3C1z4sk\nPractical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software : https://amzn.to/3C1daFy\nThe Ghidra Book: The Definitive Guide: https://amzn.to/3WC2Vkg\n\n\ud83d\udd25 SOCIALS \ud83d\udd25\nCome hang out at https://lowlevel.tv",
    "channel_url": "https://www.youtube.com/channel/UC6biysICWOJ-C3P4Tyeggzg",
    "duration": 481,
    "channel": "Low Level Learning",
    "uploader": "Low Level Learning",
    "upload_date": "20240911"
  }

  This text was transcribed using whisper model: small.en

   Can you hear RAM?  Honest question.  Are you able to hear the noises that your memory makes  when you put data into the memory and take data out?  Now, I thought the answer was no,  but a researcher recently found a way  that you can listen to the electrical signals  that your RAM makes and use that  to covertly extract data out of a computer.  In this video, we're talking about the Rambo attack,  a new attack that is truly insane.  They're using electrical signals  that are created by the RAM to sneak data out of a network  that they don't have direct access to.  Let's talk about it right now.  Before we do, if you're new here, hi, my name is Ed.  This is a level learning channel  where I talk about cybersecurity, software security,  a bunch of other cool stuff.  If you like that stuff or just want to hang out,  hit that sub button.  This technique is called the Rambo attack radiation  for air gapped memory bus for offense.  Kind of a acronym, I think they probably chose Rambo  and then decided to call it this.  But basically this research is put out by this guy  named Dr. Mordechai Gury.  If I'm butchering your name, man, I'm so sorry.  This guy is a world-class gray beard giga-chat hacker  that runs this website here called covertchannels.com.  He actually runs an entire research lab  that does exclusively research on jumping air gaps.  If you don't know what an air gap is,  imagine you have a network  where you do really sensitive research,  like maybe you're Riot Games and you're working on your MMO  and you refuse to let anyone know  how little work you've done so far.  So you don't want to let hackers into your network.  So effectively, you cut all the cables  so no one can get into your network.  You don't put a switch, you don't put a firewall,  you truly don't connect it to anything.  He actually runs an entire research lab  that does air gap research exclusively.  And it's not just like one or two techniques.  This guy has, since like 2018,  figured out how to use basically anything  to extract data out of an air gap network.  Like this one, for example, obviously, GPU fan,  leaking sensitive data from air gap machines  via covert noise from your GPU fan.  Or Satan, air gap exfiltration attack  via radio signals from your SATA cables,  which are those cables that connect  your hard drive to your computer.  Like, okay, like things that I would have never thought  that someone could pull data off of, but this guy has.  So in this new concoction,  this new brainchild that he's come up with,  he figured out a way to, via an air gap workstation  that has malware previously put into it,  they use a custom piece of malware  that somebody, evil, put into this air gap network  and they're able to, via writing to RAM  in a particular sequence, create enough electrical noise  off of the RAM, which is just another piece of electronics,  just like the GPU fan or the buzzer or the LED,  that will make electrical noise.  When you write data to a piece of RAM, at the end of the day,  all you're doing is turning an electrical signal on and off.  And because there is no perfect way to do that  without putting something into the ether,  into the universe, someone else outside of that environment  can hear it.  And by transmitting data through these means,  they're able to actually transmit  at about a thousand bits per second  on a 3.6 gigahertz CPU, which is truly amazing.  I mean, for over the air, unintentional networking,  that is better than some of the original networking  that was done like at the early onset of the internet.  So like, it's just, it's truly amazing.  It's such a novel and unique way  of thinking about data transmission  because he's able to use an RF modulation scheme  by sending data to the RAM in a certain sequence  to transmit this picture of Optimus Prime  across the air into this machine.  And he uses a little software-defined radio.  This one's my BladeRF by Nuand, not sponsored,  but hit me up.  They run a special program on here  that can smell or hear the RAM signals  and take this picture down off of the air,  which is truly insane.  Now, I personally had a couple of questions  about how this worked.  And I wanna go into the paper a little bit to talk about.  Now, when I go through these papers,  all I'm trying to do is make the work  a little more digestible  for potentially the non-technical,  the less technical person.  And I am gonna turn off dark reader, so watch your eyes.  Ah, okay.  So this here is a graph of the data over time.  And the data itself is just the amplitude of the signal  that the RAM is putting out, right?  So my first question was,  how are they able to control  exactly when the signal goes off, right?  Because in my head, I was like,  oh, if you write to RAM once,  you're gonna put out a little bit of EMF,  a little bit of electromagnetic frequency,  but that happens all the time in computers.  So how are they able to differentiate themselves?  What they actually do in their algorithm here  is they decide how long they want in seconds,  one bit to be, and they just scream over the air  by writing to the RAM over and over and over again, right?  So this amplitude here is them just consistently writing  to RAM over and over again,  and that causes the data to go over the air.  And then when they wanna go to a zero  or they wanna turn off the signal,  they just stop writing.  And then the average noise floor, right,  somewhere at about like 55 decibels,  they're able to say that's where our data.  And then my other question was, wait a minute,  how are they writing directly to RAM?  Like there's an entire world of research called CPU cache  where cores, when you're doing computing,  don't actually write to RAM, right?  That'd be extremely slow.  RAM is fast, but not as fast as L1, L2, and L3 cache, right?  These systems of memory exist for data  that is going to be used over and over again.  So instead of writing it to RAM,  which takes a little more time,  you can have it in this really hyper fast  L1, L2, L3 memory cache inside the CPU core.  Now, what I didn't realize is they use  not only the move instruction in ARM,  they use the move NTI instruction.  I had to do some research to figure out what this was.  I'm gonna turn dark reader back on  because I'm going blind here.  Move NTI is store double word,  which just means write to memory using non temporal hint.  And all that means in layman's terms  is move to memory, but completely skip the cache.  It is literally a direct write to RAM  without using any of the cache layers.  So they're able to directly create this algorithm  where they're emitting these signals on demand  and thus putting the image out into the air,  and being able to pick up the traffic.  Now in this table, what they're doing  is they're demonstrating how long it takes  to download a certain kinds of information, right?  And this T value here is going to be  how long is a single bit?  If you make your single bit too short,  you introduce more noise  and could cause errors in your data.  If you make your bit time longer, there is less noise,  but there's also more time in between bits  and therefore slower transmissions.  But via this method, they were able to prove  that they could emit a 4096 bit RSA private key  and anywhere from 40 to four seconds,  they could download a password in just a couple seconds  and they could pull down an entire text document at 40K,  not huge, but not small either, in just under a minute.  And again, this is all over the air  just by shooting electrical signals into the RAM,  truly amazing.  And what's honestly even scary about this  is they effectively say in the paper,  the only way to get around this attack,  to be invulnerable to this attack,  is to work in a shielded room  or to put your compute in a Faraday cage,  which I am not doing that right now.  So very interesting work.  Another kind of funny countermeasure they talked about  is internal RAM jamming,  which literally like to bypass the fact  that your RAM makes noise they offer.  Yeah, it's fucking make more noise.  Like just randomly use a user or kernel thread  to interfere with memory  and performing read-write operations.  Now, this main approach has a main disadvantage  of interfering with legitimate memory activities,  but yeah, that's a good one or even better.  It is possible to defend against this  by using a radio jammer.  So put your computer in a Faraday cage  and then also have a bunch of other RF noise  so no one can hear you above the noise floor.  So there you go.  Just jam your RAM and then ram your jam  and that's all you gotta do.  Anyway guys, that's it for now.  Thanks for watching.  Give me a favor, go check out this guy's research,  go read his paper, go share it on socials,  and then I will see you in the next video over here.  Nope, it's over this way,  about something that I think you'll enjoy just as much.  We'll see you there.


url: https://www.youtube.com/watch?v=yLFE5IZwpJA
title: I smurfed to show why smurfs always win (while being griefed)
type: video
author: PainDota
ingestion_date: 2024-09-13
transcription_model: large-v2
vector_embedding: pending
chunking_status: completed
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=yLFE5IZwpJA",
    "title": "I smurfed to show why smurfs always win (while being griefed)",
    "description": "I'm an 8K MMR Player who got a chance to play in an in-house league where the average mmr is between 2k to 5k, so I'm kind of legally smurfing there. This is an educational video and my thought process as to how I 1v9 as a carry. \n\nCheck out my website where you can find all the details about coaching and my socials.\nhttps://paindota.com/\n\nJoin Dota Academy: https://www.skool.com/dota-academy-3470\n\n\nFor coaching, training plans & educational discussions, join my discord: https://discord.gg/DtAeFRKym4\n\nPrivate Coaching Videos:\nhttps://www.youtube.com/channel/UC8rWMk2o4KHkoMWybi0rVlA/join\n\nPatreon ( Exclusive Videos, Discord Community, Replay Reviews, Coaching, Weekly Q&A Calls)\nhttps://www.patreon.com/PainDota\n\nFollow me on:\nhttps://twitter.com/PainnDota\nhttps://www.twitch.tv/painndota \n\n\nTimestamps:\n00:00 Intro\n00:15 Early Itemization\n03:00 Laning Phase\n20:00 Mid-Game\n32:06 Late-Game\n\n\n#dota2 #carry #smurf #educational #immortal #2k #guide #paindota",
    "channel_url": "https://www.youtube.com/channel/UC8rWMk2o4KHkoMWybi0rVlA",
    "duration": 2575,
    "channel": "PainDota",
    "uploader": "PainDota",
    "upload_date": "20240326"
  }

  This text was transcribed using whisper model: large-v2

   Ever wondered why Smurfs own every single game regardless of how many griefers they have?  Well, this video is going to teach you exactly that. I got an opportunity to be a Smurf in an  in-house league where the average MMR is between 3 to 5k. I'll explain step by step how I carry  even when getting griefed in the middle of the game. The first thing that I always think about  is my early itemization. So in this case, in order to do that, I have to look at my lane matchup. So  when I look at their five heroes, I know that Storm is probably going to be mid, Antimage is  going to be carry and CM is going to be position five. So that leaves me with Tiny and Mirana.  So as a faceless void, I need to understand that if I don't buy the correct starting items,  I could get punished because this hero cannot jungle that well. So if my starting items are bad,  I may have to go jungle really early on and that will just completely ruin my lane.  So if you see my itemization, I don't have any tangos. I have Wraith Band components  and double branches, Quelling Blade, and Faerie Fire. This build is basically catering towards  physical sustenance and also to give me stats for last hitting. So when you look at their heroes,  Mirana and Tiny, both of them are going to do physical damage. A lot of it. In fact,  Tiny is probably going to be position three. Mirana is going to creep right clicking me.  And in terms of this lane, I don't really need a stick because Tiny's not going to give me a lot  of stick charges. He's going to use tree throw, three grab, whatever. And then he's going to try  to deny a lot of trees because he gets plus 20 damage from this. And it's very hard to last it  against this hero. And Mirana is obviously going to throw arrows and stuff. So the stick is not  that good. But in this case, like let's say, let's say there was like a Batch Rider, a Mars or  something. I may go stick, but honestly, I feel like this build is like really good. And every  pro is going this build on Faceless Void, regardless of whatever lane hit they're facing, because you  can time walk most of the damage in the early game. And later on, you can just buy Wraith Band  and then you can buy Wand after that. So you might notice that I don't have any tangos and you  probably cannot apply this in your own games because your position five might not give you  any tangos. But this since this is an in-house game, I can ask my wench to do that. But there's  a workaround around it, which is basically as soon as you get boundary wounds, instead of buying the  Wraith Band component recipe, you should buy tangos, just buy a set of tangos and you should be fine.  Faceless Void is just like a very high base damage, decent attack animation. If you have  enough damage, you can secure a lot of lasses in the lane, which you will see later on. All right.  So I'm going to try to play for the rune in a way that if my team is nearby or not, because  as a Void, I don't really have anything that I can offer in terms of runes. It's like I don't  have any stun. I don't have any slow. If I can get it for free and just like time walk away,  I'll do it. But otherwise, I would not bother taking it. All right. So as you can see here,  I'm just chilling for the runes. My team is nearby. We don't, we aren't exactly looking to kill  anyone. We're just like trying to take the rune if we can. That's about it. OK, so they come here,  they don't get the rune, so we get it. So two for two. And now I'm just going to focus on the last  hit. All right. So the thing here is that I need to understand one thing in the lane is that it's  going to be really hard for me to last it against a Tiny because he has a lot of damage. With his  tree grab, he does a lot of damage and I need to make sure I get as many lasses as possible.  So what you're going to see me do here is there's like one way, like if I let this guy hit the  creeps, it's going to be very hard for me to last it. What I do here is that you're going to see me  like try to aggro the creeps away from him. So you see, I aggro this creep away and then I time  it in a way that he has to move a bit forward in order to deny it, but he can't. So you're going  to see me aggro this creep away from his range. Like you see, like he cannot deny this because  it's out of range. Because of this, I am able to secure two lasses and I can also just like aggro  this one away, but it doesn't work. But I still managed to not get it denied. And here it's just  like, if you look at the position here, I have three creeps. Tiny has only one, which is about  to die. So if he tries to deny this, even if he does get the deny, we can pressure him because  they don't have any creeps. This Wench can stun him. I can right click him. He's going to lose a  ton of HP if he does this. And the main idea is that I try to get the lasset. I get it. I get  arrows. So I just want to instantly press time walk to get the damage. And then we're just like going  on tiny and doing a lot of damage to him. Later on, I just aggro backwards again, because I don't  want the creeps to be at that position. And here, what are you going to see here is that, so the way  lassetting works is like this tiny wants to time his attack based on the attacks of these creeps,  right? So in order to secure this. So what I'm going to do is that I'm going to draw aggro away  of these three creeps from my range creep, which is going to mess up the timing of the tiny. So I  draw aggro here and these creeps stop hitting it. And then we get a free deny,  which is something like this is like very high tactic, high level of mechanic that you can abuse  if you know how the enemy heroes work. For example, if this was like a CM who wants to press her Q,  I would do the same exact thing. You have to have an idea of how much damage their spell is going to  do. And then you have to time timely aggro so that they mess it up. Okay, I wanted to aggro,  but it didn't work because Wench aggroed, but I'm just like focused on lassing. Like if you see the  last is I'm like four, one tiny is like three, one, which should not be happening, right? But in  this case, it's happening because I'm aggroing properly and I'm not allowing the tiny to be in  position to deny it. So every hero has a minimum range, right? For example, uh, melee heroes have  a really, they have like no range. They have like a buggy type of range, which is like slightly higher  than melee range, but beyond that, they have nothing. So if you take the creeps away from them  by aggroing, they cannot do anything about it. So when you're playing as many heroes, you have to  try to do that as much as possible. So at this point, the lane is like super far pushed in.  We have like two ways to bring it back. One is by pulling and the other is that I just do it by  myself, which is that I aggro these three creeps backwards on my range and then I grow again and  then bring them here. Let's see if I do that. So I go on range, right? I'm going to try to secure this  and then I messed it up a bit so I can't bring it back. But since I did aggro backwards,  I go backwards again. So now tiny cannot deny this again, right? Because the creeps are like  super far away from him. And then because of that, I managed to get lasted. So I don't go  for this creep because it's dangerous. And when she wants to pull, I'm going to aggro backwards  again so that I can safely last this because this is like an uncomfortable position here  in comparison to this, which is like easier. I can aggro again here, bring the creeps backwards.  Since I have a lot of creeps, I feel comfortable enough to actually do damage to the tiny. So I'm  like messing up the aggro a lot here actually. Like if I do it properly, I think I don't lose a  lot of creeps. So yeah, I'm just like signaling to the bench that if this guy goes for the knife,  we have to stun him and then pressure him, which we do, right? I press my W, we do a lot of damage.  Unfortunately, I think we end up losing, but I still get a kill and I drop my band. So notice  how I don't buy a wand at all. So I get 1.75 armor from Wraithband combined with another almost one  more armor from the agility. And then I have six more agility from the band of Ulvenskir, which is  another one armor. And because of that, I have high sustenance in the lane because tiny is  constantly doing tree grab damage to me. So I'm like preparing for the lane in that regard. If I  buy a wand, it's not going to be that much value. Constantly abusing aggro and playing a orb. Okay,  so now the other thing is that they want to talk about is that which a lot of players don't do in  the lower brackets, is that they have no idea about the importance of Lotus and how to get it.  So in this case, what you see is that I'm moving towards the Lotus, right? Because the lane is  pushed in. Since the lane is pushed in, it's very hard for the enemy to contest me from taking this  Lotus, but I can very easily take it. So the solution for taking Lotus is just pushing the  lane into the enemy so they cannot contest you. If the wave is pushed into you, it's the opposite.  Then it means that you can't get it. They'll get it, right? So now you know the solution to get the  Lotus and don't be afraid of pushing the lane. It's fine to do it because you got a Lotus.  And the other thing is basically, the other thing is basically you have to be very mindful  about taking Lotus. Think of Lotus as you would think about power runes. Think of Lotus as you  would think about Roshan, stuff like that. These are neutral objectives, which means that if the  enemy gets it, I have a disadvantage. If I get it, the enemy has a disadvantage. Like for example,  if your mid laner gets a haste rune, right? He can go to a side lane and kill someone,  but if the enemy mid laner, in this case, if Storm gets a haste rune, he could come bot and  he could kill me. So Lotus is the same exact thing. Now I have this extra regen and they don't,  so I can be a bit aggressive. And it also helps against not having a want aggro backwards. Again,  you're going to constantly see me aggroing backwards so that they cannot tell us it.  So I'm just like chilling here. So at this point, I understand one thing is that the only way they  can kill me in this lane is if they stun toss into arrow me, but the arrow has to be from a  really far range. So in this case, you see that I have fair fire and healing Lotus. So I'm like,  kind of confident. I know what they want to do, which is that they want to combo me,  but the Marana is standing so close that even if she does land an arrow on me, I can pretty  much press healing Lotus and then time walk away. So Tiny goes on me, he presses his spells  and he doesn't have toss. So I end up using time walk away and Marana doesn't ever, doesn't land  the arrow. So their spells are missing. They don't have any mana and here Tiny's out of position.  Since his spells are on cooldown, I'm going to press time walk, not time walk, sorry,  time dilation, and we're going to try to kill him, but it doesn't work out.  I'm going to aggro on range again because the lane is pushed in. I wanted to come back by  killing my range creep and since he doesn't have tree grab, it's very hard for him to  secure this creep and now we're going to kill him because he came for the range creep. We  baited him into a position where he, if he goes, like for example, let's just go back, right? To  explain this better. So I aggro the creeps on the range, knowing that this guy is low HP,  no tree grab. So if he wants to secure this creep, he has to walk forward for it. And if he does,  we can kill him or we got a free deny. So it's like a win-win situation for me.  And we go on him and I got to kill. So I don't actually get a kill.  When she gets the kill, but my network is like pretty decent in terms of in comparison to tiny.  Yeah. 1600, I have almost almost 2k and also have loaded some just like the nine creeps,  aggro on range again, right? To make it easier. And then when they go on the bench,  trying to fight, trying to see whether I can do something out of this because nothing happens.  Okay. And I'm going to aggro backwards on range again, which is like standard procedure. Every  time the range creep is like out of my tower range, which means it's not inside tower. I'll  always aggro on it. Okay. Tiny is here again. We're going to try to kill him. So let's done  land it and he's dead. Okay. Pretty good, right? So far, so good. And you know, like you see that  Tiny has seven denies and he would have much, much more if I didn't aggro these creeps to a position  where he can't do that. So in lower brackets, people have no concept of aggroing. They will  never think about aggroing in a way that gets an advantage. All right. Now I'm just chilling,  aggro again. So this is like another example of how I want to aggro, right? So this is like a flag  barrier creep, which is like really important. And you can see that Tiny wants to deny this. And what  I do is like, you can see his position. He wants to deny. I aggro it backwards and it gets out of  Tiny's range. So he has to go back. It's like, if he goes here for this deny, he wouldn't get it  first place. But if he tries to go for it, the bench can stun him. He doesn't have stun, but it  basically just like a lot of creeps and he doesn't, he doesn't feel comfortable doing this.  Now I'm going to aggro backwards again. Okay. So this is like something very interesting.  What you see here is that they want to do the combo, right? And in this case,  Mirana is standing like in a decent range. So what I see is that Mirana only has  mana for like one arrow. He doesn't have mana for the leap. And if they use their combo,  they can probably try to kill me with the arrow. It's possible that it works. But what I do here  is that I ask my bench to stun this guy because I see the Tiny coming towards me.  I'm like, you need to stun this guy so that this guy cannot arrow me. And I'm now in a position  where Tiny's going to press his spells, but the Mirana is like stunned. So I just like time walk  this away. And then eventually we're like man fighting the Tiny because he doesn't have any  spells, ODTP is in, and we're eating good here. So one thing that I want to mention is that in  terms of like how you see in the title that I'm being grieved is that my mid laner has 300 pink  and he's playing, he's basically playing as a slideshow. Like his game is not working properly.  And he's like the second highest rank in my team. I'm the highest rank. He's like around 7.5k  and the rest are like low MMR. But I'm sure the fact that their mid laner, the enemy mid laner is  like 10k MMR, but he's also on like pink, but it's not as bad as the OD's pink. Okay, after the kill,  I got extra tangos for healing and I also buy the wand because in this game,  wand is like kind of crucial because I'm playing as anti-mage and anti-mage is going to  deplete my mana as much as he can. And in some situations, the wand is going to help me  and I just want to live. So now I'm just like farming. I'm like super far ahead as a void  and the wave pushes in. I'm playing for the lotus. See that lotus is gone. I feel like they already  took it and I'm going to go back here and pull. So this is like the situation where the wave is  super far pushed in and I cannot exactly farm the side camp because I'm a faceless void and I  don't have any mask. I can't farm this without losing half my HP. So what I want to do is that  in this situation, I have a lot of time, right? This wave is not going to reach air anytime soon  and I cannot farm this air, but I need to farm something without losing my HP. So what I'm going  to do is I'm going to pull this, which makes it so the creeps are tanking this camp for me.  And when they're tanking this camp for me, I get to farm this freely. And I also bring the wave  back, which is essentially me pulling. And this is like something that happens in lower bracket.  People say that, oh, my position five is not pulling. You see my position five pulling. He's  not pulling, but I'm doing it myself because I have nothing else to do. So in this case,  I can just pull, bring this wave backwards towards me where I can farm it easily. And I can also  keep up with my farm while doing something rather than wasting my time. Like I could have just  stand if you here do nothing. This wave would go here and then I would miss out on another wave  for free. Okay. Now I'm chilling here again. I can trade with a tiny because I have free spend  and we're kind of like bawling when just coming. We're going to pressure the tiny. I have chrono.  So this is like a guarantee kill, but I'm getting bashes in and we got a free kill.  I'm going to chrono this guy, but I don't get lucky with the bashes. So he ends up living.  Okay. So here's like one more thing that I want to explain. So in this game,  I max my time lock rather than my time walk, which has a very basic explanation, which is  that time walk is only good if you max it out when you can actually press it. As in if you're  playing against a hero that can't stop you from pressing time walk and he's constantly spamming  spells. Like let's say there's like some dawn breaker who cannot stun you and he's going to  constantly spam his spells or a Mars where you can just like press your Q to get all of that  damage if you max it out. Right. So in this case, they have a tiny who's going to stun toss me and  they have a Marana who was going to arrow right after that. So I cannot exactly press it. So when  I have time walk not maxed out, it's actually better for me so that I can use time lock to do  damage and to farm faster. So same situation here again, I want to pull, but this camp is  not here because I farmed it before. But then again, okay, so this is very interesting, right?  Previously, I couldn't, I didn't want to form here, which is very dangerous, right? And here,  I don't want to form this. I go backwards here, right? What you see me here is you go backwards  because there's like a few things wrong with this. One is that Tiny's going to respawn soon,  and he's going to TP in here. And I don't see Storm Spirit on the map at the moment,  which means that if I go here to farm the next wave, which is around here right now,  which is going to be here soon. If I try to farm this, Storm can TP and they can just actually kill  me with vortex and stun toss combo, and I could actually die. And so what I need to do here is  that I understand one thing is that Marana went back to base because she was really low, right?  She was really low, so she went back to base because I croned her and she was really low  before this. So I know that Marana cannot be here, but Storm can be. So what you see here is like me  pulling, but then I change my mind because I see Storm. I'm like, okay, Storm TP top. And now  Marana is not here, and Tiny cannot 1v1 me that easily. So I can stay here and farm this wave,  which is basically reading the map. I'm chilling here, press my Q, and you see he can't do much  because without Marana, there's not much he can do. So casual auto rotation doesn't do much. So  I bring the wave back. Now I'm just like focused on farming because now I have masks. So what you  see me doing here again is the same exact thing. We have pushed in. I have to farm the wave,  bring it back by pulling. I missed the pull actually. I don't know what the fuck happened.  I think I a click the creeps accidentally, which is why I didn't pull. But yeah, there's a fight  going on here. I'm going to try to protect my OD because he has Astral. I press my W and then  Marana ends up being out of position. So we kill him, which is very fortunate for me because it's  very nearby and I'm back to farming. And again, I'm playing very aggressive because Marana is dead.  Tiny alone cannot do anything to me and Storm is mid. So if Storm is not showing, I would not play  here because they could very easily stun toss vertex me here because very near to the tower,  they can TP and kill me. But since I see Storm, I don't feel scared to do this.  When you're there and we're going to end up killing Tiny again. So now we can actually  pressure this tower. As long as I'm seeing this storm, I can do whatever I want.  So as long as Storm is showing, which is very important to understand.  Okay. Now the link is over. I'm just pushing the wave in farming the side camps. I can farm here.  This is also a dangerous spot to farm because very close to the enemy tower, they can TP and kill me.  Right. Very dangerous. But since I see the storm and he's very low, I know he's not going to TP.  So I can very easily farm this. I see Marana as well. So it's very fortunate for me that I can do this.  Okay. Next wave is going to be here soon. Storm is dead. Tiny is showing here. I saw Marana here.  If Tiny is showing here, I'm assuming that Marana is also going to be here. So what you're going to  see me do is to farm the next wave again and I pressure the tower. So I'm playing very aggressive  right now because I see everything on the map and Storm is dead. So what you're going to see me here  do is that I'm going to go back because I know the Storm is going to TP here. He can't exactly  kill me, but I can't kill him either. So it's just like where he uses for me to pressure him.  So I'm just like farming the side camp and I'm just chilling here. I see Marana and Tiny top.  So not top, mid. So I can still play here. I'm just like right clicking the Storm to see that  if I can bash him, if I bash him twice, I can actually chrono and use Mask of Madness and kill  him. So I'm just like experimenting. I'm just like kind of gambling here. So I'm right clicking him.  CM comes here. I'm going to bash this guy here and then eventually I get rooted. I'm like this  guy's about to run away. So I chrono, press Mask of Madness. I get lucky with the bashes and he dies.  And I'm going to get another kill on this CM, right? Okay. So, so far I have a really good start. I  have 6.5k network at 12 minutes, which is like a combination of good laning and I have a lot of  kills. So which means that as a void, if you have this good of a start, it's usually very hard for  you to lose. And I'm just like constantly pushing the wave in, farming side camps. So this is like  a very good example of farming patterns, right? So I farm this. I could go back here and pull this,  but at this point I don't really need these creeps as a shield. And I know this, this wave is going  to come back to me anyway. And so what I want to do here is that I need to realize that I have  enough time. I have like around 10 seconds before this wave is going to be here in the safe spot.  So what I do is that instead of going for the small camp, I go for the medium camp,  it's just going to give me more gold and I can actually farm it because I have Mask of Madness.  And now I can actually go back for the wave, but I need to be, I'm a bit scared because  I don't see anyone. Like I see Storm, but I don't see Tiny. I don't see Mirana. So it's kind of  dangerous for me to be here, but then I see Storm. At mid, I actually go back. It's like, yeah,  as soon as Storm's showing, I can be very aggressive on the map because Tiny does not have blink.  As long as Tiny doesn't have blink, I'm going to see him go on me. So I go for this tower,  get it because they're showing four heroes at mid, get the tower. Now I have my Milstrom,  getting some clarities, farming here. I'm just like accelerating my farm because I don't have any,  I don't have, I don't have Chrono. So I shouldn't exactly be fighting. So in this case, like when  I'm TPing here, it's kind of bad, but it's just like the thought process of TPing here is just  like try to protect my cores, which is like doom and ODE for five stars. But I shouldn't really  TP because I don't have Chrono. So I can't really offer much in this case. So I TP in here,  nothing happens. We're just like chasing and nothing's happening. We're chasing the storm.  He has like very low mana so we can actually kill him. So I'm like, guys, go on him, go on him,  go on him. And then he gets a rune and it's like kind of hard. So he gets like, I know that this  guy has decent mana to zip away. So when you see my positioning, he can, he only wants to zip  towards his side. Otherwise he's going to die top here because he doesn't have any mana. So he zips  here and I got the kill on him again, which is like a lot of gold because he has a shriek. So we're  going to pressure this tower again because tiny, no blink and storm is that. So they don't really  have any initiation that can actually kill me. So back to farm. I have Chrono, so I might look for  a smoke, which I do with. Let's get bugged. It's bugged. I'm probably smoked here. It's bugged.  Otherwise I would not be moving like this. So we're technically smoked here. This is like a visual  bug and I'm trying to find the anti-major and I don't know if we're going to find him. I forgot  about this game a bit, but yeah, it seems like we're not going to find him. We're constantly  looking for him. I see him mid and I'm just like constantly waiting here to see that after he forms  a mid wave, he's going to go here, right? Because I see his team nearby. I don't want to chrono him  here. It could be dangerous. I might not even get the kill. And then because he has like 1400 HP,  I might not even get the kill and then I could die afterwards. I'm just like waiting for him to  be here, which is further away from this place, right? They can't save him here, but they can't  save him here. So I'm just chilling. I don't see him. I see him going towards this side. So I just  go back because I don't want to commit. I'm just back to farming. Farming is like very important.  You don't have, you don't have to force the objective. It's like, I don't want to really  press chrono. I just want to, I don't really want to look around and just like try to get a chrono.  I'm just going to wait for the opportunity where I can chrono easily, which is this one, right?  I'm just farming. The enemy is diving my tier one and I can just basically keep here and I  land a good chrono because the fight has already started for me. I have all the information that I  need. I can very easily just come here and chrono. So I go in here, chrono, get one kill,  get another kill and get another kill, right? Triple kill. And I'm just like balling right  at the moment. So usually after Maelstrom, you want to like look to buy some defensive item,  especially in this game, I could benefit a lot from a dispel and something that gives me stats.  So in this case, like a Manta would be like really good. A Lincoln's would also be really  good against Storm's combo, right? The only way I can die is that if Storm vortex me or like  if Tiny can stun toss me and then I can't time walk away. So the way Faceless Void dies,  that if he can't time walk away and usually stuns that or roots that won't allow you to do that.  So, but in this game, I have like a lot of, I have a lot of saves, right? I have Grimstroke who has  Ink Swell, who's eventually going to buy Shard, which can hard dispel me. I have ODE who can  Astral me. I have Vengeful Spirit who can swap me. So I have like a lot of things that can save  me as long as I'm playing around my team. So what I'm going to do here is I'm going to go full  Greedy because I'm super far ahead. And I have like a lot of gold. I'm just going to go for the  Mjolnir here because I feel like yeah, I can get away with it. And then after that, I'm going to  look to buy some defensive item. I don't really need BKB in this game at the moment, at least.  So what do you see me here do is that I'm buying the Manta, which is going to give me a lot of  stats, which is a good amount of HP, which saves me from the Tiny combo. And other factor is that  if I get rooted, I can just instantly, like if I get, if I press Chrono and then inside the Chrono,  the CM roots me from a very small range, then I can't hit or anything. So I need to press Manta  in order to do that. So what I do here is that I go for Manta instead of buying Linkins or anything.  I'm just basically not going Linkins because I'm going to try to play around my team where they  can do this. Okay, a fight goes on here. I'm trying to fight because I have Mjolnir. I do a lot of  damage and they're linked. So I just go in here, press my W. So in this case, it's like I'm looking  at the storm. He has a lot of mana, but the problem is if I ignore the storm, what's going  to happen is that he's going to try to, he's going to burst my Grim and he's going to have a free game.  But if I'm on top of the storm, I could get lucky with bashes and then he has to spend a lot of,  you see, like I'm just getting lucky with the bashes. And then storm is just like, he's going  to dry here because he doesn't have mana eventually. And then I just bash him. And after that,  AM Blinks on top of me. So in this case, like I can't do anything, right? If I try to run away,  I'm going to die because I'm going to run out of mana eventually. And I don't have my Q  off cooldown. So what I do is I just man up to him and I fight him. And I think I end up winning  this fight. I do end up winning it, but then Tiny has blinks, so he blinks and kills me. But overall,  I would say it's kind of worth for me that I killed their carry and their mid laner and I died.  So the difference between me and the anti mage at this point is like almost 3k gold, which is like  huge. Yeah, now I'm going to wait to respawn. This was my first death. I'm going to respawn.  I'm going to go bottom, right? So this bottom TP is not exactly the best because there's like a  lot of complications with it, which means that if I TP bottom, I can't play forward because if I try  to play forwards, they're going to try to kill me because this is the information that they have.  Right. And I'm just like chilling here. I'm watching me and I see that, okay, Storm's here,  which means that he cannot be bought instantly, which means that usually what happens in higher  brackets or like slightly higher MMR games, since this Storm is 10K MMR, he's going to try to kill  me if I show deeper in some lane. So when I TP here, I need to make sure that I'm not going for  their head because he's going to try to kill me. Like this is their perspective, right? They see me  here, right? They see that, oh, this would use this TP because I just respawned. So they're going  to be like, oh, let's try to kill this guy. So what you see me here do is that I don't go forward  after forming this. I'm going to form backwards because if I go forward, they can smoke and kill  me. So I need to be in a position where they can do that. So I'm just like going backwards.  And because of that, they can't gank me. They formed this entire jungle and now I'm going back  again. So I'm seeing this a lot. There's like a lot of information for me. And we see the Storm is  there. I'm going to like, I'm just thinking that maybe anti-mage is going to blink here and try,  and then try to chrono him because I have it, but it seems like he's not going to do it. And they're  like MLS. They want to kill me. So I'm just chilling here to push the lane in. I'm just farming  the side camp. And because I don't want to show here because Tanya is blink now. So what I do here  is that I can farm this because my team is nearby. Like I said, my swap and my dispel, I'm just like  farming this very easily because they can't do anything. And then eventually I just, I might just  take portal because these two camps are formed. This is also formed. There's nothing else for me  to farm here. If I go here, it's kind of dangerous. I'm just going to go top and then farm the side  camp here, which is completely, I'm just like basically trying to maximize the amount of farm  that I have. I'm also trying to dodge the enemy as much as I can. Okay. I don't see them on the map  again, right? So I'm not trying to farm this way because I don't see anyone on the map. So I'm going  to like portal bottom again, which is another safety spot for me, basically farming for me.  I saw the tiny top, which means that they're not looking to make a move. I see storm mid so that I  know that they're not taking to looking to make a move. This is like a very stupid mistake from me.  I was like looking at the EM and I didn't realize it's an illusion based on the attacks.  So I end up wasting my chrono and I get tipped, which is very well deserved.  And then I'm just like trying to run away here because they're going to try to kill me now. So  I just like portal top and because I feel like they want to kill me and I go here and tiny is,  I guess moonlight shed on top and they probably end up killing me here. Yep. So try to dodge them  a lot and they have like a lot of ways to kill me. And if I'm not playing near my winch or my  grimstroke, they will probably kill me with two heroes, which they did right now. So it's kind of  kind of hard. But yeah, even if I did have like Lincoln's there, I don't think I live. So I need  like stats. So I'm buying BKB right after Manta and the decision making probably behind that is  the fact that I, if I'm going to land chrono, I don't want to get stunned or like rooted or  anything. So if I have BKB, that is not an option anymore for them. So now I'm like playing passive  again. I don't want to show on the map as long as they're missing. I'm also missing. I'm not,  I'm not going to show. So the thing about faceless void and anti-mage is that if I'm not showing on  the map, anti-mage feels scared to play. If I'm not playing showing on the map, the storm feels  scared to play the game because I can chrono them and they can also catch me. So there's like  different, different thought processes going on here. They don't want to show. I don't want to  show. If I don't show, they won't show. If they don't show, I won't show, right? Because they can  also kill me. So there's like mind games when like, you see like no one's on the map is showing  and we're also not showing. So you see me not showing for the wave. I see the anti-mage show  here. So now I can just like show here, push this wave out and then I just like hide again.  So as long as I don't show on the map, this anti-mage is very scared to play the game  because I can just chrono him. And now it's like looking to play for Rosh.  We see storm nearby. We see anti-mage illusion bottom. That's an indication that anti-mage is  playing bottom, which means that we can take this fight. We end up using doom on storm, but guess  what? In low MMR games, there is no concept of dust. Sentry invincibility is basically invincibility.  So I can't exactly chrono him. I don't want to chrono him. I feel like he's dead either way.  He's out of the fight. I don't want to waste my chrono until am shows if, because if I use my  chrono, am is free to do whatever. Like if you use both doom and chrono, am is free to fight.  So I don't want to waste my chrono. So what I do instead is I just go on the tiny with the bashes  and stuns. Uh, we get two kills and I instantly call for Rosh because we have OD and I have  Mjolnir so we can very easily take Rosh. I take Rosh here. Very nice. I still have chrono. I'm  just like going back here to see that whether I can find am or someone, but since am was mid,  they end up killing my OD. But I can just like, I'm just still not showing on the map. You see,  like after I took Rosh, I did not show on the map a single time, which means that I don't want to  give the enemy the information that I'm here. Because if I show bottom, they can make a play  at mid. You saw that how anti-mage killed mid and he instantly went back because he doesn't see me.  If he saw me bottom, he would go more. He would try to go for the winch. He would try to go for  the doom, but since he doesn't see me, he can't do that. So not showing on the map is like a very  big thing here. So I'm like showing on Storm here and my team is nearby. I'm still not showing  because I want to make sure that this could be worded. I'm just like basically gambling it.  And they go on. We're just like beating the doom and Storm gets baited in. We stun him,  silence him and we go on him, glimmer cape, but he dies. Gonna try to go more and we're gonna  kill this Mirana. Possibly. I mean invincibility, right? Mirana ends up dying. Very nice. And now  I'm going to TP top. I want to try to chrono this guy, but I'm like, uh, it doesn't work. And then  just go back because there was a big wave at top as well. So I'm just like focused on farming as  well as using chrono. So since I TP top, you see this anti-mage free to play whatever and do  whatever he wants. But then because of that, they end up killing the AM because he feels very free  to play the bottom lane because I TP the top side. So my team took advantage of the fact  that he's going to play like that. So I'm just like completely moving here. It's like, I saw them  making a move at bottom. I see two heroes, possibly all of them. My team's getting out. I'm like,  yo guys, I can fight. I'm really strong. I have chronos. I'm just going to hide it. I'm going to  wait for them to show. I'm asking my OD to come as well so we can just kill them. So I'm just like  abusing fog of war. They can't see me at the moment, right? But as soon as they see me,  I also see them. And because of that, I'm just like hitting this guy. I'm not pressing my madness  at the moment because I could get rooted and whatever. So I'm just like rebidding all of them  to come in the same spot. And then I'm just going to use chrono on all two heroes and get two kills  and potentially get the other kill. So you guys might be wondering that why didn't storm just  grab you? Because I'm just going to get stunned here. It's like stun, toss, root. And now storm  can grab me. But what happens is as soon as storm is about to grab me, I instantly time walk away  and then I can just chrono and then boom storms dead. I get two kills and I'm so strong. They can't  fight me. Double kill. Very nice. You have the goal for BKB. Do I buy it? I do buy it.  Maybe I don't know. Maybe it's a bad decision, but I guess I'm playing safe because I'm like  the only guy who can carry this game because as you can see, my entire team is not doing well.  It's just me who is doing well. The rest are not doing that well. And especially because my  OD has like hyping. He can't really play the game that well. So we're tensely only on one core.  Okay. Now we're playing aggressive because they're dead and I have ages and I have BKB. So I can do  whatever I want. Kill one guy. Storm gets least here, kill him as well. Very nice. And kill tiny  here as well with the bashes. And now we can push mid. Kind of get the same, but I think I feel like  it's like kind of useless. I just want to like protect this wave. I'm just like pushing this,  taking this tower. And at this point it's like we could try to go high ground, but I guess we  should not because there's like, there's like three towers. They're going to press fortification here  and then they're going to get another fortification after I take this tier two. It's just not the best  idea to take this. So I go back, which is the correct decision. Don't want to force high ground,  even if you have ages or if you don't have it or if you're dead. So they're like going for me here.  So I see them. I want to go back. I'm trying to bid them here. Honestly, I'm like, yo, I'm going to  bid. You're going to swap me out. You see my positioning. I'm just like tanking everything.  And then he stuns them. I get an opportunity to press time walk. And when I do it, I can just very  easily press A and then storm gets leased. And then I just bash him to death, which is unfortunate  for him. And I'm just like chasing. So this whole move, like people normally people would just go  back. But you see, like, I'm just like using the fact that I have a bench near me and I have a  grimstroke near me so I can just like be it here because I have BKB as well. If things go back,  so I'm just like chilling here, not even using my chrono, right? I don't want to use my chrono on  anything that is in storm or anti-mage. So I don't have mana so anti-mage ends up getting out.  But since we kill them, we can go high ground because they're dead for a long time. They still  have fortification, but we can go high ground. OK, so this is where I actually get griefed.  This game seems like over because I'm having a really good game and I can stick one behind this.  But this is the this is the part where I'm actually going to get griefed.  So I'm taking this tower. I'm just like, yo, we're just going to stay here. It's like I'm just  telling my OD that Tiny and Mirana are up. Storm is going to be up soon. They're going to try to  burst me and I'm relying on your actual to protect me. Basically, just protect me so I can  time walk away and then we can chrono and kill them because after all, I can be aggressive.  So I'm just taking this and he he actually me for fun. So since he has a lot of ping,  he couldn't cancel it. He was just like animating it and he couldn't cancel it.  So I get actual hair into arrow into stun toss, and I just fucking die here. And since I died,  I lost. I gave them two kegled. They're going to kill OD here as well.  OD gave them another thousand gold and then they're going to kill my doom.  And that's like how much actually doom lives or what? Oh, never mind. The bench dies and the  Grimstroke dies. So we lost four heroes because of this whole fiasco. And we're like down from  fifteen K to nine K and they get more gold because we're dead. So eventually this lead is going to be  back to like we lost almost ten K gold. Just like that. And K gold is gone and now the game  is in a hard state. So the next item that I want to talk about is my butterfly. So the reason why  I chose to buy butterfly is because Anti Mage has eggs and the way he wants to fight is he's going  to deplete my mana and then go in when I can't press chrono anymore. So in order to not get my  mana depleted, I need to buy butterfly so that I can kill the illusions before they can kill me.  Not exactly kill me, but before they can get rid of all my mana, which is why I need butterfly in  this game. And butterfly is generally a lot of damage for void because since void is like a hero  who relies a lot on attack speed, this item gives you a lot of attack speed, right?  So it's actually pretty good. I can bash a lot. So I take the rune. I have backtrack talent.  I have chrono, but at this point I'm just like playing for Roche. You see like my map movement.  I'm not playing bottom, right? I'm playing top because I'm like, guys, we need to play top  because it's Roche timer and Roche is going to be top. We're going to check it and check it again.  Roche is up. Take it. So since they're not playing the right side of the map, they're going to miss  out on it, but we are playing there. Even though the lead is completely gone, right? 4k lead at 36  minutes does not mean anything. But since they're playing the wrong side of the map and I'm playing  the right side of the map, I end up taking Roche, which is like a major advantage at this point of  the game. Okay. I have ages. I'm very strong again. We're just like going in. I go here.  We doom this guy. We don't exactly doom him. We have eggs. And then again, like I said,  invincibility guys. So we're just going to get this measly CM kill and then they're doing some  things here. But he's dead and I have to push this lane out again. Pushing lanes out is like  one of the major things that you want to do because otherwise you cannot make any moves on the map.  What you see me do is that I'm constantly showing that the map, but it's when I need to push out  waves. Okay. So here's, they're getting baited kind of, I can just press chrono very easily.  I get the chrono and I kill storm. I'm going to kill the tiny as well, which is really good.  And yeah, that's fine. So I don't think we can go higher ground even with this because  the lanes are pushed into us. This is why pushing out lanes is very, very important,  but none of my teammates can do it except for me. So we have to basically understand  prepays. It's like if, if the wave is pushed in, I can't go higher ground. The wave is pushed in,  I can't make any move because I have to, someone has to show on the way to depush it  and no one in my team can do it that well except for me. So if I'm showing on the waves,  that means that the enemy is free to do whatever they want because they have information that I  can chrono them because I'm showing on the wave. So what I need to do is that I need to make sure  that the waves are pushed in beforehand. So this is where you're going to see the Manta, right?  He's going to root me. I'm going to press Manta and I can just kill him. But if I didn't have  Manta, there's a chance that she could run away, but the lane is pushed in again because  the enemy saw us doing whatever we're doing. Don't see me chasing him because it's pointless.  I can't chase him, but I'm going to push out the lane. I'm asking my team to push out this lane.  We have two lanes pushed out. Now we can actually make a move very soon. I have chrono in 30 seconds.  We're playing aggressively and push this lane out. Top is being pushed in again, but we get  doom on storm. So it's very good. Get a kill on storm. Now we can actually go high ground  because the wave is pushed in, right? My team's chasing him and I'm like, guys, we should go  high ground. Trying to go high ground. We have double card. They're going to try to kill it,  right? They're cutting the waves and everything. We have card. We should go mid.  That's a mistake on my part. I think if I have card, I should not go back,  but then again, they can just kill the card. So then again, we've got cut. We can't go high  ground again. Now my age is gone. I have to wait for next stages possibly. Otherwise it's very  risky to play this game and I see a lot of heroes here and I don't want to be the first one to go  in. I need to wait for the teammates to show, asking my team to reward this. We got to jump on  storm, but then again, storm invincible, the invisibility thing, mid lane is being pushed  in. It's very bad for us to do this. And I asked my team to go back here. I don't think this is  like a good idea. Since we're like one dead, I'm just pushing the wave in good astral. He saves me  and now I'm just like thinking that what do I'm just getting super kited here.  Storm ends up getting out. They're going on me. I have BKB, so I'm like fine and backtrack,  but it's just like a very weird situation for us to fight because we don't have heroes and they have  lanes pushed into us. So we have to go back, which is why I'm not committing here. Because if I commit  wrongly here, I could die, waste my chrono and then they can go high ground very easily. Because  if the chrono is out, anti-mage is free to do whatever he wants. It's like the biggest thing  in this game. If I'm not letting anti-mage play the game, which is that if I'm holding my chrono,  he can't do much. You see anti-mage here. I want to try to kill him. He's too fast. He gets out.  That's his anti-mage, right? He kind of counters the way Void wants to play. So I buy bloodthorn  as my next item. The explanation about bloodthorn is that I have Manta, first of all, which means  that the more units I have, the more damage I do on bloodthorn. And the fact is that anti-mage has  butterfly, right? So I could buy MKB, which gives me a lot of damage, but it's magical damage and  anti-mage is good against magical damage. So I want to buy something that does physical damage  and it's true shrike, which is what bloodthorn does. And the way bloodthorn is going to work is  that I see Storm, no dispel. I see Tiny, no dispel. I see CM, no dispel. This guy is the only one who  has a dispel. So basically I can use bloodthorn to kill people. Like if Storm jumps in, I can just  basically press bloodthorn and kill him. Like I, okay. Storm gets a really good vortex in,  but the problem is he's doomed. And I was about to chrono, but I got stunned. We killed the Storm.  Very nice. Gotta kill on CM. I'm just like waiting. So this is like the crucial moment,  which is basically, I see the anti-mage cutting this way because they understand that the fighter  is lost. We need to buy time for the Storm. If I cut this wave, they cannot push in because  Bot lane is pushing in. Bot lane is pushing in. I cut this wave, it's fine. I see him doing this,  right? And I'm like, I need to kill this guy. So I'm just like, look at my posturing, right?  The thing here is that I can see him that he's in with because he's dusted, right? But he doesn't  know that I'm here, right? He doesn't see me. So I'm taking advantage of the fact that he thinks  that he's invisible, which he's not on my screen because he has dust. So I use, look at this, like  I'm not showing from here because that would show him, but here he's like completely fogged. He  doesn't see me from behind the trees, but I see him and I take the advantage and I chrono him from  fog and I use Bloodthorn on him and he ends up dying. 100 to zero is completely dead. And now we  can go high ground because there's no one who's going to cut waves. Nothing's going to happen.  So we're going high ground. They obviously have buybacks, but we have to like force tier fours  to make sure that buyback. I have BKB. I can play Bell the buyback on two heroes. But I feel like  I'm like, guys, doesn't matter as long as a more stone doesn't buy back. We're fine.  Damn bought back. But the problem is we still have Doom and then we have BKB so we can be aggressive.  AM is going to hard commit in, but the problem is he's going to get Doom there.  He's going to get Doom. I can jump him. He gets leased as well to his own illusion.  And then I Bloodthorn him and he's dead. And now AM's out of the game. And after that,  we're just taking throne, but I feel like they can do much more here. So Storm comes in with the  axe pulls us all. He put he does an actual me. He fucks up the actual and then I die because of  that. I instantly buy back because I know AM doesn't have buybacks. I need to go back in  instantly. I go in here and I'm going to bash this guy so that he does not wait. Let's just  watch it again because that was too fast. OK, so they're going on my OD who's actually I'm going  to try to I silence the storm so that he cannot press his buttons on the OD and I bash the CM  so that his all stops and then I'm time walk this away and we're going to kill three heroes and  then the game is over. If you dream of playing so well that you look like a Smurf in your own  bracket, I offer coaching packages where I personally help you to get better. There's  an insanely valuable package that guarantees unlimited coaching sessions till you hit immortal,  which has only one slot left. If you're interested in that or educational discussions,  join my Discord linked in the description. Other than that, do make sure to subscribe  and like the video for more high quality content like this.


url: https://www.youtube.com/watch?v=cOE2miIh1_o
title: The Internet's most broken protocol
type: video
author: Fireship
ingestion_date: 2024-09-14
transcription_model: large-v2
vector_embedding: pending
chunking_status: completed
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=cOE2miIh1_o",
    "title": "The Internet's most broken protocol",
    "description": "Try Brilliant free for 30 days https://brilliant.org/fireship You\u2019ll also get 20% off an annual premium subscription\n\nThe White House recently unveiled a plan to deal with networking weaknesses in the Border Gateway Protocol. In the past, the BGP has been exploited or misconfigured to cause massive disruptions on the Internet. \n\n#hacking #tech #thecodereport \n\n\ud83d\udcac Chat with Me on Discord\n\nhttps://discord.gg/fireship\n\n\ud83d\udd17 Resources\n\nBGP roadmap https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/fact-sheet-biden-harris-administration-releases-roadmap-to-enhance-internet-routing-security/\n\nCrowdStrike Disaster https://youtu.be/H9RSeDUdkCA\nRabbit R1 Hack https://youtu.be/lkbV8oP-F44\n\n\ud83d\udd25 Get More Content - Upgrade to PRO\n\nUpgrade at https://fireship.io/pro\nUse code YT25 for 25% off PRO access \n\n\ud83c\udfa8 My Editor Settings\n\n- Atom One Dark \n- vscode-icons\n- Fira Code Font\n\n\ud83d\udd16 Topics Covered\n\n- Biggest Internet outages in history\n- What is the Border Gateway Protocol? \n- Major weaknesses on the internet\n- How are networks kept secure? \n- Cryptographic security in networking",
    "channel_url": "https://www.youtube.com/channel/UCsBjURrPoezykLs9EqgamOA",
    "duration": 253,
    "channel": "Fireship",
    "uploader": "Fireship",
    "upload_date": "20240911"
  }

  This text was transcribed using whisper model: large-v2

   The White House finally admitted it.  Our country is under attack, and we need to secure our border.  No, I'm not talking about the northern border to keep Canadians out.  I'm talking about the Border Gateway Protocol, one of the fundamental pillars holding up  the internet and global economy with duct tape and hope.  Back in 2008, YouTube went down across the entire world, and we were deprived of nigahiga  for hours.  All because some government official in Pakistan messed up a config value when trying to censor  the internet.  In 2018, Amazon Route 53 DNS traffic was hijacked and wiped out the life savings of a bunch  of crypto bros.  Then in 2021, yet another misconfiguration took out Facebook and Insta for multiple hours.  The world began to heal, but unfortunately they fixed it and came back online.  And on multiple occasions, China and Russia have intercepted US internet traffic.  But none of these incidents should have ever happened.  In today's video, you'll learn exactly how the Border Gateway Protocol works, why it's  broken, and the plan to fix it.  It is September 11th, 2024, and you're watching The Code Report.  If you're a highly experienced web developer like me, you might be feeling some imposter  syndrome for having no idea what the Border Gateway Protocol is.  Don't feel bad though, it's above our pay grade.  You see, the internet is like a Jenga tower of protocols, and one of the most sketchy  pieces in that tower is something called the Border Gateway Protocol.  The internet is made up of a collection of networks that work like their own autonomous  systems.  Like an ISP, big corporation, or government agency might all have their own networks.  Using BGP allows them to announce two things, that the network exists, and which networks  can be reached by them, allowing routers to automatically decide the most efficient path  to take.  It's almost like the post office of the internet.  At the global level, individual IP addresses get grouped together into prefixes, and then  routing tables between anonymous systems are maintained by the Border Gateway Protocol.  Like for example, all the traffic coming out of Verizon routers is one autonomous system,  and all the traffic coming from AT&T is another.  These networks are all connected together by routes, and this diagram shows how BGP  helps them find the most efficient route to take in order to send packets between these  networks.  That's all good, but the problem is that this thing was designed 25 years ago before  stranger danger was a thing, and before guys like Hans Gruber warned us of a global cyber  attack.  For one, it doesn't check to see whether a remote network announcing a traffic path  change has the authority to do so, nor does it verify messages exchanged between networks  are authentic, and it doesn't check whether routing announcements violate business policies  between neighboring networks.  It just runs on trust me bro vibes.  Normally you can trust your bros, but when there's a route leak, the attacker might return  an IP address for an illegitimate website.  Like during the Amazon Route 53 attack, anyone going to myetherwallet.com was returned an  IP address for a fake website, and when they entered their credentials, the bad guys stole  them and then used them on the real website to take all their money.  In this case it worked just like a phishing attack, but the scary thing is that the victim  didn't actually do anything wrong and just went to the website that they normally go  to.  I just paid my taxes a few days ago, which means this should all be fixed any day now.  The fix uses the resource public key infrastructure to cryptographically sign records that associate  a BGP route announcement with a correct originating AS number, which will prevent accidental or  malicious route hijacking.  The resource holder creates a signed route origin authorization so network operators  know that the advertised routes are legit.  As usual, the EU is way ahead of the game here where 70% of BGP routes have published  But that number is only 39% in the United States.  That's not good, but you can blindly trust the government to get this all sorted out  quickly and efficiently.  In my opinion, the internet is the greatest creation in the history of humankind.  It might be broken, but it can be fixed by humans who understand computer science.  And you can start building that foundation for free today thanks to this video's sponsor,  Brilliant.  Their hands-on courses will make you a little bit smarter each day.  Like the thinking and code course will challenge you to start building programs on day one  with a built-in drag-and-drop editor.  As you level up your programming skills, more advanced courses, like how large language  models work, allow you to harness the mechanics of today's most advanced technology.  But most importantly, with just a few minutes of work each day, you'll start to look at  the world like a programmer.  To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash  fireship, or scan this QR code for 30% off their premium annual subscription.  This has been the Code Report.  Thanks for watching, and I will see you in the next one.


# MediaVersion

created_at: 2024-09-12 12:00:30
prompt:
                                      <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
  Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                          **Bulleted Note Creation Guidelines**

                                          **Headings**:
                                          - Based on referenced topics, not categories like quotes or terms
                                          - Surrounded by **bold** formatting 
                                          - Not listed as bullet points
                                          - No space between headings and list items underneath

                                          **Emphasis**:
                                          - **Important terms** set in bold font
                                          - **Text ending in a colon**: also bolded

                                          **Review**:
                                          - Ensure adherence to specified format
                                          - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                      

summary:
  **Video Information**
  - **Title:** How to Play Offlane like an IMMORTAL - Advanced Offlane Guide Dota 2
  - **Author:** Unknown author
  - **Channel:** BalloonDota
  - **Uploader:** BalloonDota
  - **Upload Date:** 2024-05-03
  - **Duration:** 526 seconds
  - **Webpage URL:** https://www.youtube.com/watch?v=hJD18w7UFoQ
  - **Channel URL:** https://www.youtube.com/channel/UCYldE7tGQHjNwIVHQ7bDNoA

  **Description**
  - Immortal Dota 2 coach teaches how to master the **Offlane role**.
  - Example of a student climbing from **2k to 3k MMR** quickly.
  - Focus on fundamental concepts to perform like a **6k MMR Offlaner**.
  - **Short term coaching rates**:
    - $50 for 1 hour
    - $120 for 3 hours (25% discount, $40/hr)
  - **Long term coaching rates**:
    - $350 for 10 hours (30% discount, $35/hr)
    - $650 for 20 hours (35% discount, $32.5/hr)
    - $850 for 30 hours (45% discount, $28/hr)
  - **Coaching Links and Contacts**:
    - Fiverr: https://www.fiverr.com/yongy146/help-you-improve-in-dota-2-with-7400-mmr-coaching
    - Discord: BaLLooN#5243
    - Discord Server: https://discord.com/invite/w4PWyXDV4n
    - Paypal: siahcheonyisiahcheonyi@gmail.com
    - Patreon: patreon.com/BalloonDota

  **Video Outline**
  - **00:00 - Introduction**
  - **00:42 - Starting Items**
  - **1:01 - Bounty Rune Contest**
  - **1:20 - Laning Phase**
  - **2:34 - Laning Phase Power Spike**
  - **3:29 - Lost Lane (Recover)**
  - **3:57 - Cleanup Kills**
  - **4:25 - Early Game Phase**
  - **5:05 - Principles of DOTA**
  - **6:19 - Early Game Phase Power Spike**
  - **7:08 - Mid Game Phase**
  - **7:35 - Closure of Games**

  **Content Summary**

  **Introduction**
  - Video is for players struggling to carry games from the **Offlane position**.
  - Example of a student improving from **2k to 3k MMR**.
  - Introduction to **Dota 2 Pro Tracker** for up-to-date meta builds and hero picks.

  **Starting Items**
  - Two alternative builds: **Stats build** and **Magic Stick build**.
  - **Magic Stick build** for heroes that spam spells (e.g., Phantom Assassin, Leech).

  **Bounty Rune Contest**
  - Actions depend on **teammates**.
  - Follow teammates if they invade; otherwise, pick up the rune or block lane creeps.

  **Laning Phase**
  - Focus on keeping the lane near the tower with **good creep aggroing** and sustain.
  - Punish enemy heroes with support in **favorable trades**.
  - **Favorable trades:** 2v1 fights with good positioning, higher health, and level advantage.
  - Communicate with **position 4 support**.

  **Laning Phase Power Spike**
  - Push the lane into enemy heroes and attempt to **break their safelane tower**.
  - Happens within the **5-10 minutes mark**.
  - Key items for power spikes: **Vanguard**, **Veil of Discord**.

  **Lost Lane (Recover)**
  - Retreat to **jungle camps** if unable to push the enemy safelane.
  - Look for **cleanup kills** and good fights while farming.

  **Early Game Phase**
  - Emphasis on **area control**.
  - **Misconception:** focusing on pushing other lanes after taking one tier 1 tower.
  - Importance of **map control**, **pressure**, **XP**, and **net worth**.

  **Principles of DOTA**
  - Constantly keep the enemy safelane pushed in.
  - **Plant wards** and take away enemy resources.
  - **Bully the enemy safelaner** and starve them of resources.

  **Early Game Phase Power Spike**
  - **Hit key item timings** (e.g., blink dagger, black king bar).
  - Transition to playing more around the team.

  **Mid Game Phase**
  - **Keep lanes pushed** into the enemy's side.
  - Avoid **giving up control** by running around for kills.
  - Focus on **starting fights** and contributing to **map pressure**.

  **Closure of Games**
  - Group with the team and **push lanes**.
  - **High ground push** to close the game.
  - Summary: Emphasis on playing the lane well and **occupying the enemy's safe lane and jungle**.
  - **Item timing** for a huge power spike to contribute to fights.

  **Additional Information**
  - Music by various artists (Infraction, A Himitsu, tubebackr & MusicbyAden, Fass).
  - **Music Links**:
    - https://www.youtube.com/watch?v=iuJKYervYPs
    - https://soundcloud.com/a-himitsu
    - https://www.youtube.com/watch?v=8BXNwnxaVQE&t=0s
    - https://www.youtube.com/watch?v=SJVh_7lDf6w
    - https://uppbeat.io/t/fass/furious


created_at: 2024-09-12 22:25:26
prompt:
                                      <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
  Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                          **Bulleted Note Creation Guidelines**

                                          **Headings**:
                                          - Based on referenced topics, not categories like quotes or terms
                                          - Surrounded by **bold** formatting 
                                          - Not listed as bullet points
                                          - No space between headings and list items underneath

                                          **Emphasis**:
                                          - **Important terms** set in bold font
                                          - **Text ending in a colon**: also bolded

                                          **Review**:
                                          - Ensure adherence to specified format
                                          - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                      

summary:
  **Event Information**
  - **Webpage URL:** https://www.youtube.com/watch?v=erzkTPc9SYI
  - **Title:** Closing Ceremony - Fish_ and Cherry & Stef
  - **Channel URL:** https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA
  - **Duration:** 1137 seconds
  - **Channel:** OrangeCon
  - **Uploader:** OrangeCon
  - **Upload Date:** 20240909

  **Opening Remarks**
  - Reflecting on the day and the year
  - 300 attendees with shared passion
  - Origin of the event idea from a meeting in Amsterdam
  - Decision to create a Dutch-themed event, leading to "OrangeCon"

  **Event Planning**
  - Initial idea to hold the conference in March, later moved to September
  - Importance of teamwork among the organizers: Fizz, Cherry, and Stef
  - Challenges faced and lessons learned

  **Oopsies and Challenges**
  - Use of Pretalks platform and a security issue discovered
  - Fire at the venue affecting banner placement
  - Printing error on badges showing Cherry's name on all badges
  - QR code issue with the schedule link due to expired trial period
  - Incorrect GitHub version pushed, exposing unpublished training links

  **Special Mentions**
  - Stef's effort in wearing an orange shirt despite disliking the color
  - Formation of Stichting Ocon as a foundation for transparency and openness
  - Financial details: conference cost around 95,000 euros, revenue around 110,000 euros

  **Community and Feedback**
  - Emphasis on community support and feedback
  - Encouragement to email feedback to feedback@orangecon.nl
  - Acknowledgment of sponsors and their contributions to the event

  **Giveaway**
  - Lucky draw for a D&D version of LEGO
  - Winner: Stanislav from Ajin

  **Future Plans**
  - Date for next event: 5th of September 2025
  - Consideration of extending the event to more days or sessions

  **Thank Yous**
  - Appreciation for the volunteer crew
  - Invitation for attendees to join for a beer

  **Closing Remarks**
  - Gratitude to all attendees and looking forward to next year


created_at: 2024-09-12 23:14:50
prompt:
                                      <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
  Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                          **Bulleted Note Creation Guidelines**

                                          **Headings**:
                                          - Based on referenced topics, not categories like quotes or terms
                                          - Surrounded by **bold** formatting 
                                          - Not listed as bullet points
                                          - No space between headings and list items underneath

                                          **Emphasis**:
                                          - **Important terms** set in bold font
                                          - **Text ending in a colon**: also bolded

                                          **Review**:
                                          - Ensure adherence to specified format
                                          - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                      

summary:
  **Event Details**
  - **Webpage URL:** https://www.youtube.com/watch?v=erzkTPc9SYI
  - **Title:** Closing Ceremony - Fish_ and Cherry & Stef
  - **Channel URL:** https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA
  - **Duration:** 1137 seconds
  - **Channel:** OrangeCon
  - **Uploader:** OrangeCon
  - **Upload Date:** 20240909

  **Introduction**
  - Recap of the day's events
  - Reflection on the past year and the inception of OrangeCon
  - Initial brainstorming session in Amsterdam

  **Formation of OrangeCon**
  - **Idea Development:** Started with the concept of a Dutch-themed event
  - **Naming Process:** Inspired by the color orange
  - **Event Planning:** Initially planned for March, postponed to September for better preparation

  **Team Dynamics**
  - **Team Members:** Fizz, Cherry, and Stef
  - **Collaboration:** Emphasis on teamwork and shared vision

  **Challenges and Oopsies**
  - **CFP Platform Issue:** Security vulnerability in the Pretalks platform
  - **Venue Incident:** Small fire at the entrance of Meervaart
  - **Badge Printing Error:** Incorrect name printed on all badges
  - **QR Code Issue:** Link to schedule expired due to free trial ending
  - **Website Error:** Incorrect GitHub version pushed during developer's holiday

  **Special Mentions**
  - **Stef's Contribution:** Wearing an orange shirt despite disliking the color
  - **Foundation Status:** OrangeCon is now a foundation (Stichting Ocon)
  - **Transparency:** Commitment to openness and financial transparency

  **Financial Overview**
  - **Cost of Conference:** Approximately €95,000 excluding tax
  - **Revenue:** Approximately €110,000
  - **Profit:** Around €10,000 to be reinvested for next year's event

  **Community Involvement**
  - **Feedback Request:** Encouragement for constructive feedback via email
  - **Sponsors' Role:** Importance of sponsors in enhancing the conference experience
  - **Community Support:** Acknowledgment of help from various community members

  **Giveaways and Prizes**
  - **D&D LEGO Set:** Given away through a lucky draw
  - **Merchandise:** Availability of OrangeCon merchandise online

  **Future Plans**
  - **Next Event Date:** 5th of September 2025
  - **Duration Discussion:** Potentially extending the event to two days

  **Closing Remarks**
  - **Thank You:** Gratitude expressed towards the volunteers and attendees
  - **Invitation:** Invitation for a beer and to see everyone next year


created_at: 2024-09-13 12:41:55
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Event Information**
  - **Title:** TROOPERS24: 10 Years of Windows Privilege Escalation with "Potatoes"
  - **Speaker:** Andrea Pierini
  - **Event Date:** June 26th, 2024
  - **Conference:** TROOPERS24 IT security conference
  - **Location:** Heidelberg, Germany
  - **Host:** ERNW IT Security
  - **Webpage URL:** [TROOPERS24 Talk](https://troopers.de/troopers24/talks/cyzbj3/)
  - **Social Media:** 
    - [Twitter - WEareTROOPERS](https://twitter.com/WEareTROOPERS)
    - [Twitter - ERNW_ITSec](https://twitter.com/ERNW_ITSec)
    - [Infosec Exchange - WEareTROOPERS](https://infosec.exchange/@WEareTROOPERS)
    - [Infosec Exchange - ERNW](https://infosec.exchange/@ERNW)
    - [ERNW](https://ernw.de)
  - **YouTube Link:** [TROOPERS IT Security Conference](https://www.youtube.com/watch?v=rPZx1zbKJnI)
  - **Duration:** 3272 seconds
  - **Channel:** TROOPERS IT Security Conference
  - **Upload Date:** September 2, 2024

  **Speaker Information**
  - **Name:** Andrea Pierini
  - **Nationality:** Italian
  - **Profession:** Senior Security Consultant at Semperis
    - Works in the **Bridge Preparedness and Incident Response** team
  - **Interests:** Offensive security, cycling, and diving
  - **Contact:** Handles for blog posts and communication

  **Talk Overview**
  - **Purpose:** Share the journey of discovering new **potato techniques** for Windows privilege escalation
  - **Approach:** 
    - **Introduction:** What constitutes a **privilege escalation** according to Microsoft
    - **RPC Decom Trigger:** Method to find vulnerabilities using potato techniques
    - **New Findings:** Analysis of breaking safety and security boundaries
    - **Conclusion:** Summary of the findings

  **Key Concepts**
  - **Privilege Escalation:** Escalating user privileges to gain unauthorized access
  - **Security Boundary Violation:** Breaching security measures from standard user to admin
  - **Safety Boundary Violation:** Breaching non-security boundaries like service account abuse

  **Potato Techniques**
  - **Initial Techniques:** 
    - **Local NTLM Reflection Attack:** Reported in 2014, fixed in 2015
    - **Malicious COM Object:** Crafting a controlled Marshall object to trigger a privileged COM server service
    
  - **Juicy Potato:** 
    - Coded in 2018
    - Permits specifying ports and standalone implementations
    - Fixed in Windows Server 2019 and backported to 2016

  - **Remote Potato Zero:**
    - Relays NTLM authentication to a remote server
    - Bypasses **RPC signing** to relay authentication
    - Fixed by enforcing signing

  - **Local Potato:**
    - Swaps **LSAS context** to authenticate as a privileged user
    - Demonstrated by **overwriting DLLs** to gain system privileges
    - Fixed by Microsoft but still works under specific conditions

  - **Fake Potato:**
    - Newest technique discovered, pending fix by Microsoft
    - Demonstrated with a video showing privilege escalation

  - **Remote Silver Potato:**
    - Uses **DCOM configurations** and **forgotten groups** to trigger remote COM servers
    - Certification services and Windows licensing service as targets
    - Demonstrated with relays to LDAP and HTTP services

  **Conclusions**
  - **Potatoes Techniques:** Effective in breaking safety and security boundaries
  - **Microsoft Fixes:** Often partial or not implemented
  - **Future of NTLM:** Disabling NTLM will stop some relay attacks, but Kerberos can still be relayed
  - **Defender Recommendations:** Protect endpoints thoroughly to prevent these attacks


created_at: 2024-09-13 12:46:06
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Webpage Information**
  - **Webpage URL**: https://www.youtube.com/watch?v=yKY7Bvpb45M
  - **Title**: Orange Is The New Black - Fish_, Cherry & Stef
  - **Channel URL**: https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA
  - **Duration**: 115 seconds
  - **Channel**: OrangeCon
  - **Uploader**: OrangeCon
  - **Upload Date**: 2024-09-09

  **Transcription Summary**
  - The speakers started a conference for the community about a year ago
  - Initial goal was to attract 120 people but ended up with 300 attendees
  - Success attributed to community trust
  - Gratitude expressed towards attendees and volunteers
  - Brief mention of an awesome program and thanks to speakers and workshop givers
  - Introduction of Wyn Schwartzout


created_at: 2024-09-13 12:51:28
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Cybersecurity and Meta-War**

  - **Cybersecurity's changing landscape**: 
    - New attack surface is emerging, termed **meta-war**.
    - Meta-war involves **reality distortion**, changing and rebuilding perceptions.
    - Techniques and technologies used are over 100 years old, applied on a global stage.

  **Metaverse and Immersion**

  - **Metaverse**:
    - Not just about technology of immersion.
    - Defined by **storytelling** and **narratives** that create immersive experiences.
    - Examples: **Homer's storytelling**, **books**, **radio plays**, **TV shows**.
  - **Immersion**:
    - Experiences like VR and haptic feedback enhance immersion.
    - Metaverse experiences can range from simple storytelling to complex VR simulations.

  **Reality and Perception Manipulation**

  - **Reality distortion**:
    - Influencers, politicians, and advertisers manipulate perceptions.
    - Techniques used to create **digital addiction** via **like buttons** and **feedback loops**.
    - **Consensual reality** vs. **subjective reality**: the latter is easily manipulated.
  - **Information overload**:
    - Too much information leads to **disinformation** and **false narratives**.
    - People susceptible to disinformation often have preexisting **system one reactions**.

  **Technological Influence on Human Behavior**

  - **Technological influence**:
    - Modern technology can manipulate **vestibular system**, **proprioception**, and **interoception**.
    - **AI and feedback mechanisms**: 38 biosensors in new Apple earbuds for emotional and physiological data collection.
    - **Algorithmic influence**: Algorithms control the information and narratives we receive.
  - **Addiction and stress**:
    - Technology addiction is linked to **stress** and **anxiety**.
    - **AI**: Built in our own image, but we struggle with its black-box nature and biases.

  **Cognitive Defense and Cybersecurity**

  - **Cognitive immune system**:
    - Need for strengthening **critical thinking** and **critical ignoring**.
    - **Pre-bunking**: Warning about potential lies to enhance **bullshit detection**.
    - **Educational games**: Examples include **Bad News**, **Cranky Uncle**, and **Harmony Square**.
  - **Cybersecurity's role**:
    - Cybersecurity professionals are problem solvers needed for cognitive defense.
    - Collaboration with psychologists, neuroscientists, and misinformation experts is essential.

  **Challenges and Future Directions**

  - **Policy and regulation**:
    - Need for policies to manage technological influence and protect cognitive functions.
    - Importance of **algorithm transparency** and control over personal data.
  - **Public awareness and education**:
    - Educating the public on information filtering and critical thinking is crucial.
    - Recognizing and combating **cognitive attacks** and **disinformation**.

  **Conclusion**

  - **Call to action**:
    - Cybersecurity community is urged to help address cognitive manipulation challenges.
    - Need for multidisciplinary approaches to coexist peacefully with technology.
    - Importance of building **resilience** against **misinformation** and **reality distortion**.


created_at: 2024-09-13 12:54:09
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **General Information**
  - **Title:** Low Energy To High Energy: Hacking Nearby EV-Chargers Over Bluetooth - Daan Keuper
  - **Author:** Unknown author
  - **Webpage URL:** [YouTube Video](https://www.youtube.com/watch?v=KOqfjjzCLQE)
  - **Channel URL:** [OrangeCon Channel](https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA)
  - **Duration:** 1360 seconds
  - **Channel:** OrangeCon
  - **Uploader:** OrangeCon
  - **Upload Date:** 2024-09-09

  **Speakers and Company**
  - **Speakers:** Thijs Alkmaar, Daan Keuper, Khaled Nassar
  - **Company:** Computest
    - **Location:** Zoetermeer, Netherlands
    - **Services:** Pen testing, incident response, managed SOC, red teaming
    - **Department:** Research department focused on public benefit research projects

  **Pwn2Own Competition**
  - **Description:** Hacking competition different from CTF
    - **Organized by:** CDI
    - **Objective:** Finding actual zero-day vulnerabilities in existing software
    - **Reward System:** First team to demonstrate a vulnerability gets full reward; subsequent teams get lower rewards
  - **Participation History:**
    - **2021:** Zoom
    - **2022:** Industrial control systems
    - **2023:** Automotive systems (Tesla components, EV chargers)
  - **EV Chargers Hacked:**
    - Juicebox 40
    - Autel Maxi Charger
    - ChargePoint Home Flex

  **ChargePoint Home Flex Exploit**
  - **Initial Steps:**
    - Extract firmware using JTAG
    - **Previous Research:** Kaspersky (2018) found a stack buffer overflow
  - **Process:**
    - Extract firmware via hardware access
    - Discover command injection vulnerability in WLAN app
  - **Competition Outcome:** 
    - Seven entries for ChargePoint Home Flex
    - Computest was the seventh team but found a new vulnerability

  **Additional Findings**
  - **WebSocket Connection:**
    - **Library Used:** curl
    - **Configuration Issue:** SSL verify host option set incorrectly, allowing man-in-the-middle attacks
  - **SSH Connection:** 
    - **Purpose:** Reverse proxy for Telnet access
    - **Exploration:** Could log into older systems, create proxies to other hosts
  - **AWS Meta Service Access:**
    - Extracted access keys
    - Found 142 S3 buckets with read access

  **Security Implications**
  - **Potential Impact:** Control over many devices connected to cloud services, affecting the electricity grid and other critical infrastructure

  **Resources and Future Participation**
  - **Write-ups:** Full write-ups available on Computest website
  - **Next Pwn2Own:** Upcoming in October, featuring IP cameras as targets

  **Conclusion and Q&A**
  - Encouragement to participate in future Pwn2Own events
  - Open floor for audience questions (none received)


created_at: 2024-09-13 12:57:15
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Penetration Testing Auditing**

  - **Introduction**: 
    - Topic: Making penetration testing auditable
    - Speaker: Brenno de Winter, part of the CISO team of the Ministry of Health, Welfare, and others
    - Focus: Compliance and legislative requirements in the Netherlands

  **Legislative Context**:
  - **Upcoming laws**: 
    - Cyber Resilience Act
    - GDPR Article 82: Liability for software issues
  - **Frameworks**:
    - ISO 200007123 for non-Dutch
    - Baseline Informatiebeveiliging Overheid (27001 and 2) for Dutch government
    - 7510 for healthcare

  **Penetration Testing Challenges**:
  - **Current Issues**:
    - Misunderstanding of penetration testing results by companies
    - Lack of standardized definitions and frameworks
    - Companies often claim their methods are proprietary or "magic"

  **Penetration Testing Goals**:
  - **Desired Outcomes**:
    - Assurance that basic security measures are in place
    - Transparency and evidence for auditors
    - Mitigation of unknown risks

  **Penetration Testing Methodology**:
  - **Proposed Solution**: 
    - Methodology for Information Security Research with Audit Value (MEOW)
    - Includes a set of controls, procedural reports, model pen test reports, legal information, and an advisory guide
    - Emphasis on reproducibility and standardized tests

  **Penetration Testing Definitions**:
  - **Standardization**:
    - Definition and criteria for pen tests
    - Use of existing standards like OWASP testing guides

  **Penetration Testing in Practice**:
  - **Real-world Application**:
    - Example of municipal audits in the Netherlands
    - Importance of red teaming after baseline pen tests
    - Integration with regular security assessments and audits

  **Penetration Testing and Management**:
  - **Responsibility**:
    - Management is responsible for security, not just the CISO
    - Importance of clear communication and expectations between pen testers and management

  **Conclusion**:
  - **Final Thoughts**:
    - Collaboration and standardization are key to effective penetration testing
    - Continuous improvement and adaptation to new laws and frameworks are essential

  **Q&A Insights**:
  - **Common Vulnerability Scoring System (CVSS)**:
    - Use of CVSS version 4.0 for context-based scoring
  - **Comparison with Other Standards**:
    - Difference between MEOW and OWASP ASVS
  - **Responsibility for Software Security**:
    - Management's role in determining when to retest software

  **Additional Resources**:
  - **Books and Guides**:
    - Upcoming advisory guide available on October 18th
    - Encouragement to join groups and contribute to ongoing efforts

  **Key Takeaways**:
  - **Importance of Standards**:
    - Use of established guidelines and standards to ensure clarity and consistency
  - **Focus on Assurance**:
    - Providing concrete evidence and transparency to auditors and stakeholders


created_at: 2024-09-13 13:00:59
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Event Details**
  - **Title:** The Registry Rundown - Cedric Van Bockhaven & Max Grim
  - **Webpage URL:** [Video Link](https://www.youtube.com/watch?v=MxDq552Di3Y)
  - **Channel:** OrangeCon
  - **Uploader:** OrangeCon
  - **Upload Date:** 2024-09-09
  - **Duration:** 1823 seconds
  - **Channel URL:** [Channel Link](https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA)

  **Introduction**
  - Cedric Van Bockhaven and Max Grim are **Red Teamers** and **Offensive Developers** at **Outflank**, now part of **Fortra**.
  - Both have technical backgrounds and interests in **home automation** and **hardware hacking**.

  **History of Windows Registry**
  - **First created:** Windows 3.1 for storing **com-based components** and **configuration data**.
  - **Transition:** From .ini files to the registry around Windows 95 and NT.
  - **Hierarchy:** Includes hives like **HKEY-LOCAL-MACHINE** and **HKEY-USERS**.
  - **HKEY-LOCAL-MACHINE:** Stores computer-specific settings and configuration data.
  - **HKEY-USERS:** Contains user-specific information, with subkeys for each user.
  - **HKEYCLASSESROOT and HKEYCURRENTUSER:** Virtual mappings to real data, not actual hives.

  **COM Classes and Registry**
  - **COM:** Framework for application and component interaction, both locally and over the network (DCOM).
  - **COM Class Registration:** Stored in the registry under **HKEYCLASSESROOT**.
  - **Usage Example:** **InternetExplorer.application** class can navigate to specific URLs via COM.

  **Remote Registry Interaction**
  - **Remote Registry Protocol (MSRRP):**
    - Handled by the **remote registry service**, auto-start on servers but disabled on clients.
    - Allows remote registry interaction via **SMB named pipe** (pipe\\winreg).
    - Accessible by any domain user, not just local administrators.
  - **WMI (Windows Management Instrumentation):**
    - Uses DCOM and RPC, requires local admin permissions on the remote machine.
    - Interacted with via **root simv2 namespace** and **std regprof class**.
    - Tools: PowerShell's GetWMIProject, WMI Explorer, and a custom extension for Impacted.

  **Reconnaissance and Exploitation**
  - **Credential Dumping:** Using tools like secret dump.py and Mimikatz.
  - **Persistence:** Adding entries to the run key in the remote system.
  - **COM Hijacks:** Often used for **UAC bypasses**.
  - **Reconnaissance:**
    - **HKEY-LOCAL-MACHINE (HKLM):** Requires local admin for remote access, contains valuable system information.
    - **HKEY-USERS (HKU) and HKEYCLASSESROOT (HKCR):** Accessible by domain users, contains user and class information.
    - **.default key:** Contains historical login data for users.
    - **Allowed Paths:** Certain HKLM keys accessible without full admin rights.
    - **Example:** Enumerate services, drivers, and software like EDRs remotely.

  **Vulnerabilities and Information Disclosure**
  - **HKLM Key Existence Leak:**
    - Using remote registry protocol to check key existence via response codes.
    - **Script:** Enumerates keys to identify installed software.
  - **Remote File Existence Check:**
    - Checking if a file exists on a remote system via registry operations.
    - **Usage:** Identify installed programs and files for reconnaissance.

  **Abusing ADCS (Active Directory Certificate Services)**
  - **ADCS:** Microsoft's PKI implementation, often misconfigured.
  - **Certificate Templates:** Cache stored locally on domain-joined computers, accessible by domain users.
  - **Tool:** **regcertify** to export and analyze certificate templates for vulnerabilities.

  **Malicious Use Cases**
  - **Relaying Attacks:** Using registry RRP interface for NTLM authentication relaying.
  - **Lateral Movement:**
    - **COM Hijack:** Under **HKCU** for non-admin users, targeting applications like **Microsoft Word**.
    - **Service Triggering:** Remotely start services that instantiate COM objects for code execution.
  - **Citrix Exploit:** Bypassing RDP access control by performing a COM hijack.

  **Summary**
  - **Registry Usage:** For reconnaissance, relaying, and lateral movement.
  - **Resources:** Google Project Zero research and Pavel Yusifovich blog posts for detailed registry information.

  **Conclusion**
  - Comprehensive overview of Windows Registry exploitation techniques with practical examples and demonstrations.


created_at: 2024-09-13 13:05:01
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - Speaker: Erwin Paternotte
  - Focus: Introduction to OT (Operational Technology) security for beginners

  **Speaker Background**
  - Current Role: CTI specialist at NCC
  - Previous Experience: 20 years in penetration testing and ethical hacking
  - Combined Expertise: Threat intelligence and hands-on OT system testing

  **Purpose of the Talk**
  - Addressing the disconnect between perceived and actual threats to OT systems
  - Encouraging proactive measures to secure OT systems

  **Differences Between IT and OT**
  - **Legacy Systems**: OT systems are often designed decades ago with safety, not security, in mind
  - **Priorities**: Availability is most important, followed by integrity; confidentiality is less critical
  - **Physical Impact**: Incidents in OT can have real-world physical consequences

  **Threat Actors in OT**
  - **Ransomware**: A significant threat due to untargeted attacks impacting IT-connected OT systems
  - **Hacktivism**: Diverse groups targeting internet-connected OT devices, often with low complexity attacks
  - **Espionage**: Targeting critical infrastructure to gather information and maintain long-term access
  - **Sabotage**: Highly targeted attacks, often by state-sponsored actors, prepositioned to disrupt critical systems

  **Common Vulnerabilities in OT**
  - **Lack of Asset Inventory**: Many OT environments lack updated network diagrams and asset overviews
  - **Firewall Configurations**: Often poorly configured with many "any-any" rules
  - **Remote Access**: Dependency on suppliers for remote maintenance poses security risks
  - **Shared Network Infrastructure**: IT and OT often share network switches, virtualization solutions, and Active Directory, increasing risks
  - **Unpatched Systems**: Many OT systems are not regularly patched due to operational constraints
  - **Weak Management Protocols**: Many OT devices have default passwords and insecure management protocols

  **Network Design and the Purdue Model**
  - **Layered Approach**: Importance of segmenting networks to protect insecure OT protocols
  - **DMZ Implementation**: Often missing or improperly configured between IT and OT
  - **Proper Segmentation**: Critical to prevent direct connections from IT to OT and ensure secure data flow

  **Security Testing in OT**
  - **Risk of Testing**: OT systems are less resistant to security testing, requiring cautious approaches
  - **Assessment Approach**: Combining architectural reviews with light security testing to avoid disruptions
  - **Common Findings**: Outdated network drawings, poor firewall configurations, and insecure remote access setups

  **Improving OT Security**
  - **Asset Inventory**: Essential first step to understanding and securing OT environments
  - **Vendor Collaboration**: Work with suppliers to develop secure configurations and maintain systems
  - **Network Architecture**: Implement proper segmentation and DMZs to protect critical systems
  - **Awareness and Training**: Educate stakeholders on OT security best practices and threat landscape

  **Conclusion**
  - **Effort Required**: Improving OT security is not hard but requires consistent effort and focus
  - **Threat Intelligence Role**: Helps prioritize security efforts and understand risks
  - **Proactive Measures**: Essential to make life harder for attackers and protect OT environments


created_at: 2024-09-13 13:08:29
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Overview of Presentation**

  **Authors and Affiliations**
  - **Authors**: Rik Van Duijn & Wesley
  - **Company**: Zolder, a cybersecurity company
  - **Experience**: Over 10 years in pen testing; creators of defensive solutions like Attic

  **Research Focus**
  - **Topic**: Security research on **AITM (Adversary in the Middle)** phishing attacks
  - **Goals**: Prevention, detection, and understanding of MFA (Multi-Factor Authentication) bypassing techniques

  **Problem Overview**
  - **Increase in MFA AITM attacks**: Bypassing MFA on Microsoft 365 accounts
  - **Historical Context**: Evolution from simple phishing to more sophisticated attacks like using **Evil Jinx**

  **Techniques and Tools**
  - **Evil Jinx**: Open-source tool for AITM attacks
  - **VNC in Browsers**: Streaming VNC sessions in browsers to simulate real websites
  - **Evil Puppet**: Generic AITM framework
  - **Cloudflare Workers**: Serverless computing used for phishing attacks

  **Current Threats**
  - **Microsoft 365 Attacks**: Significant increase in phishing attacks
  - **Booking.com Attacks**: Phishing targeting hotel operators with legitimate-looking messages
  - **Token Replay Attacks**: 111% increase in token replay attacks

  **Detection and Prevention Techniques**
  - **Detection System**: Use of custom CSS in Microsoft 365 login pages to detect phishing attempts
  - **Prevention Techniques**: 
    - **Phishing-resistant MFA**: Use of POS keys and YubiKeys
    - **Device Compliance**: Ensuring only compliant devices can access the network

  **Implementation Insights**
  - **Reverse Proxy Techniques**: Forwarding requests and modifying responses to capture credentials
  - **Custom Branding CSS**: Adding CSS to Microsoft login pages to detect phishing attempts
  - **Detection Results**: Significant number of detections across various tenants

  **Threat Landscape and Future Trends**
  - **SaaS Services for Phishing**: Increase in providers offering phishing services
  - **Customization of Phishlets**: Growth in customized phishing solutions
  - **Bank Phishing**: Expected increase in automated bank phishing using AITM techniques

  **Conclusion**
  - **Ongoing Threat**: Expectation of continued increase in AITM phishing attacks
  - **Need for Enhanced Security Measures**: Importance of using advanced MFA techniques and improving detection methods

  **Call to Action**
  - **Free Detection Tool**: Availability of a free tool to detect AITM attacks on Microsoft 365

  **Closing Remarks**
  - **Gratitude**: Thanking the audience for their attention and participation


created_at: 2024-09-13 13:11:58
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - Speaker: Cas van Kooten
  - Topic: **Languages**, specifically **programming languages**
  - **Fascination with languages**: People know multiple languages, languages are related, easier to learn new ones with more knowledge
  - **Programming languages**: Similar principles, easier to learn multiple languages

  **Call to Action**
  - **Learn as many languages as possible**: Modern or ancient (e.g., C)

  **Offensive Development**
  - **Perspective**: Red team viewpoint but useful for blue teamers as well
  - **Cas van Kooten**: Red teamer at a big bank, calls himself a **malware linguist**

  **Offensive Security Tooling (OST)**
  - **Race between red and blue teams**: Continuous improvement and adaptation
  - **Development capability**: Necessary to modify or create tools

  **Options for Offensive Tooling**
  - **Purchase tools**: Commercial options available, often evasive by design
  - **Adapt open source tools**: Modify to avoid fingerprints, saves development time
  - **Develop own tools**: Complete control, fun, but time-consuming

  **Offensive Development vs. Malware Development**
  - **Offensive development**: Encompasses all tools supporting offensive operations
  - **Malware development**: Subset of offensive development, runs on target systems

  **Importance of Developer Mindset**
  - **Bad code**: Impacts others, stability, and security
  - **Best practices**: Commenting, structuring, minimizing repetition
  - **AI assistance**: Tools like Copilot can help with idiomatic code

  **Choosing a Programming Language**
  - **Considerations**:
    - **Interpreted or compiled**
    - **High level or low level**
    - **Performance**
    - **Portability**: Cross-compilation capability
    - **Prevalence**: Helps in evasion
    - **Developer experience**: Community support, compiler assistance

  **Typing in Programming Languages**
  - **Defines variable types**
  - **Importance**: Prevents unexpected behavior

  **Example Languages**
  - **Rust**:
    - **Successor to C**: Safe, low-level language
    - **Borrow checker**: Ensures data ownership
    - **No garbage collection**: Performance advantage
    - **Verbose errors**: Helpful for debugging
    - **Clippy linter**: Helps write well-structured code

  - **Go**:
    - **Useful for both target systems and servers**
    - **Concurrency mechanism**: Go routines
    - **Standard library**: Extensive, no need for additional installations
    - **Simple syntax**: Easy to learn, portable and performant

  **Conclusion**
  - **Explore and learn new languages**
  - **Adopt good developer practices**
  - **Build own tools** for better control and understanding


created_at: 2024-09-13 13:16:49
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Video Information**
  - **Title:** Attacking Primary Refresh Tokens Using Their MacOS Implementation - Dirk-Jan Mollema & Olaf Hartong
  - **Duration:** 2360 seconds
  - **Channel:** OrangeCon
  - **Uploader:** OrangeCon
  - **Upload Date:** 20240909
  - **Webpage URL:** [YouTube Video](https://www.youtube.com/watch?v=T92verdYJAQ)
  - **Channel URL:** [OrangeCon Channel](https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA)

  **Presenters**
  - **Olaf Hartong:**
    - Security researcher and detection engineer at Falcon Force
    - Active on Twitter
  - **Dirk-Jan Mollema:**
    - Founder of Outsider Security
    - Researcher of Microsoft products and protocols
    - Active on Twitter

  **Primary Refresh Tokens (PRTs) Overview**
  - **Definition:** Single sign-on tokens used to access various services
  - **Usage:** Valid to sign in to anything the account can access
  - **Mechanism:** Links user identity to device identity
  - **Protection:** Session key protected by TPM on Windows and secure enclave on macOS

  **Research Findings**
  - **New Protocol Versions:** Found undocumented versions different from Microsoft's documentation
  - **Secure Enclave:** TPM implementation on macOS, crucial for PRT protection
  - **Device-bound vs Device-less PRTs:** Different implementations on macOS and their respective security implications

  **MacOS Implementation**
  - **Edge Browser:** Uses a device-less PRT stored in the keychain
  - **Intune:** Utilizes a device-bound PRT with a secure enclave
  - **Platform SSO:** Recent feature leveraging Apple’s native SSO extension

  **Technical Details**
  - **Windows vs macOS:**
    - Windows: Uses RSA keys and TPM
    - macOS: Uses elliptic curve keys and secure enclave
  - **PRT Protocol Versions:**
    - PRTv2: Standard on Windows
    - PRTv3: Introduced for macOS with JSON web keys
    - PRTv4: Advanced security with elliptic curve Diffie-Hellman

  **Security Implications**
  - **Keychain Storage:** PRT and session keys stored in macOS keychain, with additional iCloud risks
  - **Session Key Protection:** Secure enclave ensures higher security for PRTv4
  - **Elliptic Curve Cryptography:** Used in PRTv4 for enhanced security

  **Phishing Vulnerabilities**
  - **Device-less PRT Phishing:** Can be phished using attacker-in-the-middle techniques
  - **Demo:** Showed how to phish for device-less PRTs and upgrade them to device-bound PRTs

  **Defensive Measures**
  - **Conditional Access Policies:** Restrict device registration and token lifetimes
  - **Detection Mechanisms:** Monitor for abnormal device registrations
  - **Microsoft's Efforts:** Working on patching vulnerable flows and improving token security

  **Conclusion**
  - **Ongoing Research:** Continued exploration of OAuth specifications and security improvements
  - **Acknowledgments:** Thanks to the audience for their attention and engagement

  **Important Terms:**
  - **Primary Refresh Tokens (PRTs)**
  - **Secure Enclave**
  - **TPM (Trusted Platform Module)**
  - **Elliptic Curve Cryptography**
  - **Device-bound PRT**
  - **Device-less PRT**
  - **Conditional Access Policies**
  - **OAuth**


created_at: 2024-09-13 13:20:15
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - Orange is the speaker at OrangeCon.
  - Presentation topic: Confucius Attack.

  **Apache HTTP Server**
  - Open source project nearly 30 years old.
  - Enables **CGI** by default, increasing the attack surface.
  - Integrates perfectly with **PHP**.
  - Complexity in setting up PHP due to multiple modules and directives.

  **Common Directives**
  - **addHandler** and **addType** can both run PHP.
  - **addType** proven to be vulnerable, allowing attackers to disclose PHP source code remotely.

  **Vulnerabilities and Risks**
  - Apache sites tend to have massive environments.
  - Many servers still use Apache with third-party web services.
  - Rewrite rules and CGI can lead to vulnerabilities.

  **Research Focus**
  - Examined relationships and interactions between Apache modules.
  - Modules can accidentally modify crucial fields, creating security risks.
  - Developed three types of attacks named **ConfusionAttack**.

  **FileName Confusion Attack**
  - Occurs when different modules handle the file name using different standards.
  - **RewriteModule** treats substitution results as URLs.
  - **Proxy Module** behavior can bypass file-based access control.
  - Using a question mark (**%3f**) can truncate paths and access unintended files.

  **Document Root Confusion Attack**
  - Apache tries to open both paths with and without the document root.
  - Allows access to files outside the web root, especially in `/usr/share`.
  - Combine with path truncation to access nearly the entire `/usr/share`.

  **Handler Confusion Attack**
  - Exploits legacy conversion in Apache where content type can become a handler.
  - Modules can override content type, leading to source code disclosure.
  - **Local redirect response** in CGI can control content type, invoking arbitrary handlers.

  **Exploits and Demonstrations**
  - Disclose server-side source code.
  - Access sensitive information via symbolic links.
  - Achieve **RCE** using SSRF and CRF injections.
  - Practical scenarios include accessing restricted files and exploiting default configurations.

  **Conclusion and Takeaways**
  - Maintaining open source projects like Apache is challenging.
  - **Question marks** can truncate paths and bypass access control.
  - Hidden traps in rewrite rules can access the system root.
  - Controlling response headers can invoke internal handlers.

  **Future Work**
  - Explore different distributions for more vulnerabilities.
  - Apply discussed techniques to bug bounty hunting.


created_at: 2024-09-13 13:20:30
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Event Details**
  - **Title:** Closing Ceremony - Fish_ and Cherry & Stef
  - **Author:** Unknown author
  - **Webpage URL:** [https://www.youtube.com/watch?v=erzkTPc9SYI](https://www.youtube.com/watch?v=erzkTPc9SYI)
  - **Channel URL:** [https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA](https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA)
  - **Duration:** 1137 seconds
  - **Channel:** OrangeCon
  - **Uploader:** OrangeCon
  - **Upload Date:** 20240909

  **Event Introduction**
  - Celebratory opening with emphasis on how the event started a year ago.
  - Mention of brainstorming and planning during an informal meeting in Amsterdam.
  - Emphasis on the Dutch identity and the color orange as central themes.

  **Event Challenges and Resolutions**
  - **Oopsies and Issues:**
    - **CFP Platform Pretalks:** Issue with stored content scripting, responsibly disclosed by a participant.
    - **Venue Fire:** Small fire at the entrance, resolved by ordering beach flags instead of using the banner.
    - **Badge Printing Error:** Incorrect name printed on all badges, fixed with stickers.
    - **QR Code Issue:** QR codes on badges expired due to a trial period ending, resolved by purchasing an annual subscription.
    - **GitHub Version Error:** Wrong version of GitHub pushed, fixed with community help.

  **Team Dynamics and Contributions**
  - Importance of teamwork highlighted through the creation of the event.
  - Acknowledgment of the team members: Fish, Cherry, and Stef.
  - **Special Mentions:**
    - Stef's reluctance to wear orange but did so for the event's visibility.
    - Formation of the Stichting Ocon foundation for transparency and community engagement.

  **Event Financials**
  - **Costs and Revenue:**
    - Total cost: 95,000 euros (ex-tax)
    - Revenue: Approximately 110,000 euros
    - Resulting in a small profit to fund next year's event.

  **Community Involvement**
  - Emphasis on community feedback and involvement.
  - Encouragement for attendees to provide constructive feedback via email.
  - Appreciation for sponsors and their contributions to the event's success.

  **Future Plans**
  - Announcement of next year's event date: 5th of September 2025.
  - Discussion on potentially expanding the event to multiple days or increasing training sessions.
  - Call for community support and involvement in future events.

  **Closing Remarks**
  - Gratitude expressed towards the volunteer crew and attendees.
  - Invitation for everyone to enjoy a beer and see them next year.


created_at: 2024-09-13 14:14:05
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Webpage Information**
  - **Webpage URL**: https://www.youtube.com/watch?v=8FAqOkgte8o
  - **Title**: Securing Devices Or Profit? Examining The Device Security Of A Network Appliance Vendor - Hal Martin
  - **Channel URL**: https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA
  - **Duration**: 1671 seconds
  - **Channel**: OrangeCon
  - **Uploader**: OrangeCon
  - **Upload Date**: 20240909

  **Transcription Information**
  - **Transcription Model**: Whisper model: large-v2
  - **Transcription Text**: 
    - Repeated text: "you you you ..." (repeated numerous times)


created_at: 2024-09-13 14:18:11
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Speaker Introduction**
  - Thijm Gommers
  - Offensive cybersecurity operations, research, and innovation at ABN Amro Bank
  - Previous role at Northwave Cybersecurity
  - Performs digital forensics for Dutch TV show "Hunted"
  - Author of exploits and malware on GitHub (username: Thijm)

  **Presentation Overview**
  - **Three Key Topics:**
    - **Tokens and privileges in Windows OS**
    - **User Account Control (UAC) and its interaction with tokens and privileges**
    - **Component Object Model (COM) in Windows**

  **Tokens and Privileges in Windows**
  - **Login Process:**
    - WinLogon spawns Logon UI when Ctrl+Alt+Delete is pressed
    - Logon UI forwards credentials to WinLogon and then to LSAS (Local Security Authority Subsystem Service)
    - LSAS creates a token for the user upon successful authentication
    - WinLogon uses the token to spawn UserInit process, which starts explorer.exe

  - **Token Structure:**
    - Contains **Security Identifier (SID)**, group security IDs, and integrity level labels
    - **Privileges:** SE shutdown, SE load driver, etc.
    - Privileges can be enabled, disabled but present, or not present

  **User Account Control (UAC)**
  - **How UAC Works:**
    - Introduced in Windows Vista
    - On login, LSAS returns two tokens: a filtered token (medium integrity) and an elevated token (high integrity)
    - Explorer.exe runs with the filtered token; elevated tasks prompt UAC for the elevated token

  - **Integrity Levels:**
    - Objects (processes, files, directories) have integrity levels (medium, high)
    - To modify an object, the process must have the same or higher integrity level

  **Bypassing UAC Using COM Objects**
  - **COM Overview:**
    - Client-server model for interprocess communication
    - COM objects can be hot-swappable, reducing the need for recompilation
    - Different programming languages can interact via COM

  - **Auto-Elevation via COM:**
    - Certain COM objects can auto-elevate using elevated tokens
    - PSAPI checks for valid Microsoft binaries; this check can be spoofed

  - **Example: CMSTP Lua COM Object:**
    - Used by LockBit ransomware for UAC bypass
    - Shell exec function allows command execution with elevated privileges
    - Spoofing process environment block to appear as explorer.exe for elevation

  **Demo and Tools**
  - **Demo:**
    - Demonstrated running a command with elevated privileges without UAC prompt
    - Showed how to enable all privileges in a process

  - **Tools Provided:**
    - Source code for UAC bypass and COM object communication
    - QR code for downloading source code and presentation

  **Q&A Session**
  - **Questions Discussed:**
    - Reporting the technique to Microsoft: Not reported, technique used by LockBit
    - Detection by antivirus software: Possible through monitoring COM object methods, specific antivirus capabilities not confirmed

  **Conclusion**
  - Encouraged audience to download source code and try the techniques
  - Invited further questions on social media


created_at: 2024-09-13 14:22:28
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Speaker Introduction**
  - Name: Jan-Jaap Korpershoek
  - Profession: Red Teamer and Reverse Engineer at Northwave Cybersecurity

  **Talk Objective**
  - Provide a primer into **Kernel Driver Vulnerability Research** for Windows Kernel Drivers
  - Equip attendees with knowledge and tools for starting their own research

  **Topics Covered**
  - **Context about Offensive Use of Kernel Drivers**
    - Importance of kernel drivers in system security
    - Differences between user mode and kernel mode
    - Recent news demonstrating the power of kernel drivers in attacks

  - **Research at Northwave**
    - Team introduction: Alex, Thijm Gommers, and Jan-Jaap Korpershoek
    - **Statistics**: 
      - Database of ~5,000 drivers
      - Manually analyzed 80 drivers
      - Found 35 vulnerabilities in 24 drivers
      - 12 could be used for privilege escalation
      - 4 could disable EDR
    
  - **Vulnerability Highlights**
    - Ivanti Pulse Secure: Privilege escalation in VPN client
    - Macrium: Privilege escalation in backup software
    - LogMeIn: Privilege escalation in remote desktop software

  **Research Steps**

  **Gathering Drivers**
  - **Sources**:
    - Microsoft Update Catalog
    - Vendor websites
    - Driver Identifier software
    - VirusTotal
    
  **Filtering Drivers**
  - **Criteria**:
    - Most recent versions
    - Signature filtering
    - Drivers needing no special permission
    - Automated analysis tools

  **Loading Drivers onto Test System**
  - Types of drivers: Plug-and-play and legacy drivers
  - Recommendation: Start with legacy drivers, specifically device drivers

  **Interacting with Drivers**
  - **Finding Device Calls**:
    - Look for strings in the driver
    - Use WinObject tool
  - **System Calls**:
    - CreateFile to open the device
    - DeviceIoControl to interact with it

  **Reverse Engineering**
  - **Driver Entry Function**:
    - Creating a driver device
    - Setting up handlers for create, read, write, and device control events
  - **Device IO Control Handler**:
    - System buffer
    - IO control code
  - **Analyzing Assembly**:
    - Mapping C code to assembly
    - Finding the device IO control handler

  **Common Vulnerabilities**

  **Dangerous Legitimate Functionality**
  - **Examples**:
    - Dell driver allowing read/write to kernel memory
    - Terminating a process
    - Physical memory mapping

  **Buffer Overflow**
  - **Examples**:
    - Macrium backup software
    - Registry key overflow

  **Data Leak**
  - Exploiting uninitialized buffer

  **Kernel Handle Leaks**
  - Lack of proper handle flag setting

  **Method Direct**
  - Concurrent user writes and kernel reads

  **Automated Tools**
  - **Popcorn**: Finds dangerous legitimate functionality
  - **VMware Threat Analysis Unit Tool**: Improved design over Popcorn using IDA scripts

  **Conclusion**
  - **Impact**: Kernel driver vulnerabilities are powerful tools for attackers
  - **Research Importance**: Significant percentage of drivers are vulnerable
  - **Audience Contribution**: Encouragement to start their own research


created_at: 2024-09-13 14:27:21
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Presentation Overview**
  - First talk after lunch by Timothy Hjort
  - Title: "An Angel, Python, Root And Config Walked Into A Bar..."
  - Speaker works at Outpost 24, a Swedish cybersecurity company
  - Focus on automating vulnerability detection

  **Speaker Introduction**
  - Name: Timothy Hjort
  - Background in vulnerability research
  - Holds a Master of Science in Engineering Computer Security
  - Interested in hardware and software architecture

  **Main Topics**
  - **Focus of Talk**: Consequences of subpar patching and poor software design
  - **Device in Focus**: Zyxel NAS 326

  **Key Vulnerabilities Discussed**
  - Unauthenticated Python code injection
  - Remote code execution via config upload
  - **Backdoor**: NSA Rescue Angel

  **Research Process**
  - Initial task: Finding a known vulnerability (CVE-2023-27992)
  - Methods: Unpacking firmware, decompiling binaries, and testing
  - **Discovery**: Interesting binaries with suspicious strings (e.g., OpenBackdoor.sh, NSA Rescue Angel)

  **Detailed Analysis**
  - **Device Handling**: Web server requests and authentication mechanisms
  - **Authentication Flaw**: Whitelist checking for substrings leading to bypasses
  - **Backdoor Functionality**: Executing callbacks and enabling SSH server

  **Specific Exploits**
  - **Python Code Injection**: Using eval on user input
  - **Authentication Bypass**: Exploiting endpoint restrictions and bypassing checks
  - **Local Privilege Escalation**: Using sudo without password for root access

  **Patching Issues**
  - Repeated vulnerabilities due to poor patch implementations
  - **Zyxel's Response**: Quick fixes but recurring issues

  **Key Takeaways**
  - **Quick Patches**: Ineffective and lead to repeated vulnerabilities
  - **Zyxel's Cooperation**: Positive response despite the device being end-of-life

  **Audience Questions**
  - **Open Source Code**: Confirmation that servers deliver Python bytecode, reversible to original code
  - **NSA Rescue Angel**: Likely a support account, not related to NSA
  - **Applicability to Other Devices**: Potential for similar vulnerabilities in other Zyxel devices
  - **MAC Address Entropy**: Assessing brute force feasibility
  - **Authentication Module Origin**: Developed by Zyxel

  **Conclusion**
  - **Final Thoughts**: Importance of thorough and effective patching to prevent recurring issues
  - **Appreciation**: Thanks to the audience and Zyxel for their cooperation


created_at: 2024-09-13 14:33:11
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Talk Introduction**
  - Welcome to the talk "All Cops are Broadcasting: Breaking Tetra After Decades in Shadows" by **Wouter Bokslag** and colleagues **Jos Westeros** and **Carlo Meijer** from **Midnight Blue**.
  - Overview of past achievements: breaking vehicle immobilization systems, finding vulnerabilities in **BlackBerry QNX**, and breaking a hardened variant of the **Mifare Classic chip**.

  **Overview of Midnight Blue Services**
  - Threat modeling
  - Reverse engineering
  - Vulnerability research
  - Secure software development
  - Lifecycle consultancy
  - Red teaming and capability development

  **What is Tetra?**
  - **Tetra** is a globally used **radio technology**.
  - Competes with **P25**, **DMR**, and **Tetrapole**.
  - Standardized in the mid to late 90s by **Etsy**.
  - Used primarily for **voice communications** and also suitable for **data communications** like **SMS** and **machine-to-machine communications**.
  - Relies on **secret proprietary cryptography**.
  - Broadly used by **police forces** worldwide, except in the **United States** and **France**.
  - Use cases include **military and intelligence**, **critical infrastructure**, and **industry**.

  **Misconceptions about Tetra**
  - Tetra is often thought to be an **open standard**.
  - It's a **public standard** but contains **secret cryptographic functions** held by **Etsy**.
  - Manufacturers must protect the **algorithms** against **exfiltration** through hardware or software countermeasures.

  **Tetra Security**
  - **TAA1 suite**: Implements **authentication**, **key management**, and **identity encryption**.
  - **TEA suite of algorithms**: Used for **data encryption**.
  - Different TEA flavors for different use cases: **TEA1**, **TEA2**, **TEA3**, and **TEA4**.

  **Project ReTetra**
  - **Gekhoff's principle**: A crypto system should be secure even if everything but the key is public.
  - **Objective**: Open Tetra for public reviews after 25 years.
  - **Approach**: Reverse engineering a **Motorola MTM5400** radio to extract secret cryptography.
  - **Process**: Exploited a **format string vulnerability** to gain control over the **application processor** and **digital signal processor**.

  **Stream Cipher in Tetra**
  - **Key stream generator**: Takes a **key** and **initialization value** to generate a stream of bits for encryption.
  - **TEA 1 to 4**: All follow the same high-level design.

  **Vulnerabilities in TEA1**
  - **Key initialization function** compresses the 80-bit key into 32 bits, making it vulnerable to **brute force attacks**.
  - Demonstrated cracking TEA1 using a **1998 consumer hardware** in 13 hours.

  **Attacks on TEA2 and TEA3**
  - Attack involves **overpowering the legitimate signal** and sending spoofed frames to modify the perception of **network time**.
  - Allows the reuse of key streams for decryption.

  **Demonstration of Practical Attack**
  - Demonstrated a **decryption oracle attack** to recover a text message, applicable to voice communication and data.
  - Used a **Tetra base station** turned into an attack platform to validate the attack.

  **Additional Findings**
  - **Anonymization attack**: Identifies who is talking to whom.
  - **Session key pinning attack**.
  - **Vulnerabilities in Texas Instruments chip** and **Motorola firmware**.
  - Found a **backdoor password** in Motorola base station.

  **Use in Critical Infrastructure**
  - TEA-1 backdoor affects **critical infrastructure** like **SCADA telecontrol systems**.
  - Still in use in some **European countries**.

  **Targeting of Tetra Networks**
  - **NSA** and **GCHQ** have targeted Tetra for interception, proving its legitimacy as a target.

  **Future of Tetra**
  - New algorithms: **TAA2 authentication suite** and **TEA527 error interface encryption ciphers** with longer keys.
  - Transparency in making algorithms public.

  **Conclusion**
  - First in-depth security analysis of Tetra.
  - Published secret algorithms and found multiple vulnerabilities, including a backdoor.
  - Patches are available for some issues, but more work is needed for asset owners.
  - Mission-critical technologies are not being assessed enough.


created_at: 2024-09-13 14:38:02
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - Speaker: Jeroen van Beek
  - Topic: IT security incidents involving credential stuffing
  - Example incidents: Taylor Swift ticketing (Ticketmaster and Snowflake hack), Uber's GitHub breach

  **Taylor Swift Incident**
  - **Company Involved:** Ticketmaster
  - **IT Provider:** Snowflake
  - **Incident:** Snowflake hacked, leading to a credential stuffing attack
  - **Issues Identified:** 
    - No mandatory **multi-factor authentication** for administrators
    - Exposed credentials reused by attackers
    - Breach affected over **half a billion accounts**
  - **Ongoing Threat:** Attackers likely to exploit other companies similarly affected

  **Uber Incident**
  - **Incident:** Settlement for $148 million due to IT security breach
  - **Security Flaws:** 
    - No mandatory **multi-factor authentication** for developers
    - Password reuse across services led to breach
  - **Outcome:** Hacker accessed Uber GitHub, found AWS S3 bucket credentials
  - **Impact:** Exposed 60 million user accounts and 600,000 driver data files
  - **Additional Issue:** Uber paid hackers $100,000 to keep quiet

  **Credential Stuffing**
  - **Definition:** Using known username and password combinations to gain unauthorized access
  - **Historical Context:** Shift from exploiting OS and software flaws to account takeovers
  - **Current Trend:** Increase in breach data availability, decrease in attack complexity and cost
  - **Verizon Report:** Emphasizes the importance of focusing on credential abuse

  **Scattered Secrets Services**
  - **Breach Data Provision:** Provides companies with breached credentials related to their domains
  - **Additional Password Control:** Checks for password reuse and advises against it

  **Data Acquisition and Analysis**
  - **Sources for Raw Data:** Breach Forums, file sharing services, Telegram channels
  - **Data Extraction:** Emails and password hashes
  - **Analysis and Cracking:** Enriching raw data to extract valuable information

  **Historical Context of Password Security**
  - **Early Password Storage:** Plain passwords in the 60s, still occasionally used
  - **Basic Hashes:** MD4, MD5, SHA1, SHA2
  - **Dedicated Password Crackers:** Tools like John the Ripper
  - **Fixes:** Salting, key stretching (e.g., MD5 script, SHA 512 script), bcrypt, sCrypt, and Argon2

  **Advanced Password Cracking Techniques**
  - **Hardware Evolution:** CPUs to GPUs to FPGAs
  - **Current Best Practices:** Use of fully configurable algorithms like sCrypt and Argon2
  - **Efficient Cracking:** Use best platforms (e.g., GPUs, high core count CPUs, FPGAs)
  - **Tricks:** Example of using legacy fast hashes to crack slow hashes (e.g., Ashley Madison breach)

  **Observations and Results**
  - **7 Billion Passwords Recovered:** Large datasets analyzed and cracked
  - **Credential Reuse:** Common within organizations, facilitating breaches
  - **Credential Stuffing Defense:** Basic measures can significantly deter attackers
  - **Old Data Usage:** Even old breaches like LinkedIn 2012 still yield new passwords

  **Examples and Case Studies**
  - **Hookers.nl:** Operators claimed no passwords were stolen; data showed otherwise
  - **Snowflake Users:** Example of poor password policies (e.g., "Snowflake23!")
  - **Ava Yenix Case:** Demonstrating how old breached passwords are still used

  **Legal Implications**
  - **GDPR Exceptions:** Protecting computer networks and automated systems
  - **Cyber Crime Laws:** Debate on whether breached data is considered non-public

  **Conclusion**
  - **Website for Breach Checks:** Free community accounts available for checking if accounts were breached
  - **Final Note:** Importance of adhering to strong password practices and multi-factor authentication


created_at: 2024-09-13 14:42:43
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Webpage Information**
  - Webpage URL: [YouTube Video](https://www.youtube.com/watch?v=Ev3GeR-oRNk)
  - Title: **Graph API Mastery: Logs To Real World Attacks - Shiva P & Parthiban R**
  - Channel URL: [OrangeCon Channel](https://www.youtube.com/channel/UCgJoGNj3B2Mt2F3TUblcoOA)
  - Duration: **1796 seconds**
  - Channel: **OrangeCon**
  - Uploader: **OrangeCon**
  - Upload Date: **20240909**

  **Presentation Overview**
  - **Introduction**:
    - Discuss newly introduced log source: **Microsoft Graph API Activity Logs**
    - Goal: Familiarize with the log source for **threat hunting** using Graph API Activity Logs

  **Speakers' Background**
  - **Parthiban**:
    - Over **10 years** in security
    - Senior Intelligence Analyst at **Atlassian**
    - Previous roles at **Symantec** and **Microsoft**
    - Interests: **Food** and **friends**
  - **Shiva**:
    - Over **10 years** in security
    - Senior Security Researcher at **Dart**
    - Previous roles at **Symantec** and **Anaplan**
    - Interests: **Gaming**

  **Agenda**
  - Fundamentals of **Microsoft Graph API**
  - Key fields for **threat hunting** or **investigation**
  - Utilization of Graph API logs with other data sources
  - KQL functions useful for investigation
  - Real-world attack scenarios
  - Baselining and auditing in Graph API logs

  **Microsoft Graph API Overview**
  - **Graph API**:
    - Interacts with various **M365 services**
    - Single endpoint for applications like **OneNote, OneDrive, Calendar**
    - Examples: Get latest **emails** from Outlook, list files in **OneDrive**

  **Graph API Authentication and Permissions**
  - **Authentication**:
    - Requires application registration in **Azure portal**
    - Uses **OAuth protocol** with client ID and access token
  - **Permission Schemes**:
    - **Delegated Access**: User must be present and signed in
    - **App-only Access**: App acts on its own with assigned permissions

  **Log Collection and Cost Consideration**
  - **Not collected by default**: Must be enabled by admin
  - Available to **EntroID P1 or P2 license holders** only
  - **Cost estimation** required before enabling logs
  - Enable logs in **Azure portal** under **EntroID** and **diagnostic settings**

  **Key Fields in API Logs**
  - **Application ID**: Unique identifier for applications
  - **IP Address**: Source IP address
  - **Request Method**: Type of activity (GET, POST)
  - **Response Status Code**: Indicates success (200 series) or error (400 series)
  - **Request URI**: Endpoint being queried

  **Combining Logs with Other Data Sources**
  - **User ID**: Join with identity info for more context (email, names, SPNs)
  - **Active Directory Risk User**: Provides risk context for user ID
  - **Cloud App Event Logs**: Useful for identifying file names during investigations

  **Useful KQL Functions**
  - **Parse URL**: Splits URL into multiple fields (domain, subdomain, ports, parameters)
  - **Geo IP Information**: Provides geolocation information from source IP address

  **Real-World Attack Scenarios**
  - **Reconnaissance**:
    - Use of Graph API for data gathering and privilege elevation
    - Tools: **Graphrunner** and **Azure Hound**
  - **Compromised Service Principal**:
    - Example: Application with role management read/write directory role
    - Query to detect role assignment activities
  - **Internal Lateral Movement**:
    - Phishing attempt leading to token compromise
    - Use of **delegated permission** app to send emails
  - **Mailbox Access**:
    - Abuse of app permission **mail.read.all**
    - Query for applications reading emails
  - **File Access on SharePoint and OneDrive**:
    - Permissions: **files read/write** and **sites read/write**
    - Query for download activities and file identification

  **Recommendations**
  - Regularly audit intra-applications using Graph API
  - Create baselining and monitoring processes for new applications and permissions
  - Use data tables to list permissions and privileges for app IDs

  **Recap**
  - Overview of **Graph API** and obtaining logs
  - Key fields and correlatable tables
  - Real-world attack scenarios and test scenarios
  - Importance of baselining and auditing applications

  **Conclusion**
  - Encouragement to explore contributions and articles by other researchers

  **Q&A Session**
  - Confirmed real-life incidents involving Graph API attacks
  - Discussion on baselining applications and permissions monitoring
  - Manual baselining recommended for initial setup

  **Additional Resources**
  - QR code for article and queries
  - Microsoft documents for first-party applications

  **Closing Remarks**
  - Invitation to ask further questions and connect with the speakers


created_at: 2024-09-13 16:32:55
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Overview of Louis Barrett's Talk**

  **Introduction**:
  - Title: "Louis Barrett - Small Language Models for Application Security - Beyond ChatGPT"
  - **Speaker:** Louie Barrett, full stack security researcher at Scale AI
  - Focus: Implementing **small language models** to enhance **application security** workflows

  **Speaker Background**:
  - Experience leading **product security** at Scale AI
  - Previous roles in **detection engineering** and **incident response** at Segment Twilio
  - Passion for building security tools and solutions

  **Purpose of Presentation**:
  - Enable security teams to unlock cutting-edge capabilities
  - Apply **language models** to security challenges
  - Overview of language models, their history, and current capabilities

  **Language Models**:
  - Definition: **Large language models** (LLMs)
    - **Trained** on massive data sets
    - Produce **coherent human language**
    - Examples: GPT-3, GPT-4

  **Evolution of Language Models**:
  - Before 2020: **Limited practical use** in security
  - 2020: Release of **OpenAI's GPT-3** and the explosion of AI development
  - 2023: **Open-source revolution** with models like Meta's LLaMA

  **Capabilities of Language Models**:
  - **Text generation**: Generate human-like text
  - **Text summarization**: Extract key points from large texts
  - **Question answering**: Provide answers based on internal data
  - **Classification**: Categorize data into specified categories

  **Design Patterns in Language Models**:
  - **Conversation apps**: Chatbots, personal assistants (e.g., ChatGPT)
  - **Writing apps**: Business copy, marketing copy
  - **Process automation and analysis support**: New pattern development

  **Challenges with Large Language Models**:
  - **Reliance** on commercial LLMs
    - Issues with **data privacy**, **data sovereignty**, and **information security**
  - Risks of data leaks and over-reliance

  **Small Language Models**:
  - **Small models (<30 billion parameters)** are more manageable
  - **Open-source models** like Mosaic ML and Mistral AI
    - Perform comparably to GPT-3
    - **Cost-effective** and **scalable**

  **LMAP Maturity Scale**:
  - Levels 1-5 to evaluate complexity of applications
    - **Level 1**: Basic one-to-one interaction
    - **Level 2**: Extended context with chat design patterns
    - **Level 3**: Retrieval augmented generation (RAG)
    - **Level 4a**: Language model-based agents
    - **Level 4b**: Multi-model consensus
    - **Level 5**: Long-term memory and true cohort systems

  **Real-World Use Cases in Application Security**:
  - **Security design reviews**: Summarizing and analyzing design documents
  - **Threat modeling**: Collaborative process to identify and mitigate risks
    - Reduce burden on security teams with language models
  - **Code reviews**: Analyze PRs, file diffs, commit messages
    - Improve speed and accuracy of reviews
    - Consistent quality and scalable process

  **Building LM Applications**:
  - **Design requirements**:
    - Integrate into existing workflows
    - Maintain data privacy and security
    - Audit decisions made by models
  - **Ingredients**:
    - Small language model, server, CI webhook host, orchestration host, retrieval index host
    - System prompt templates, model configuration
  - **Implementation**:
    - Use libraries like PyTorch, Hugging Face Transformers
    - Deploy using workflow engines like AWS Step Functions or Temporal

  **Conclusion**:
  - Emphasize the potential of small language models in improving application security
  - Encourage adoption and experimentation with open-source models


created_at: 2024-09-13 17:17:38
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction to Incentives in Security**

  - **Crazy incentives drive security into no man's land**
  - **Security misalignment:** Hard work may lead to going backwards
  - **Examples and analysis:** Various instances illustrating misaligned incentives

  **Examples of Misaligned Incentives**

  - **Streaming Incentives:**
    - Example of young women streaming in an undercrossing for better location features
    - **Result:** Unusual and unexpected behaviors driven by incentives

  - **Definition of Incentives:**
    - **Wikipedia definition:** Anything that persuades a person to alter their behavior
    - **Economic perspective:** Higher incentives lead to greater effort and performance
    - **Misalignment with security:** Economic incentives differ from security incentives

  - **Twitter's Two-Factor Authentication:**
    - **Elon Musk's decision:** Stopped SMS-based 2FA for non-paying users
    - **User choice:** Pay for security or opt for less secure options
    - **Result:** Potentially less security for users

  **Misaligned Incentives in Security Tools**

  - **Nessus Reports:**
    - High number of vulnerabilities leading to a false sense of urgency
    - **Example:** Nessus recommending disabling proxy modules on a proxy server
    - **Core problem:** Bad policies and processes, not individual vulnerabilities

  - **Inflated Numbers in Reports:**
    - **Example:** Report claiming 14 million cyber attacks blocked daily
    - **Reality:** Bullets, not actual attacks
    - **Incentive:** Companies inflate numbers for better sales

  **Dashboards and Misleading Information**

  - **Dashboard Issues:**
    - **Example:** Norse dashboard showing animated IP attacks
    - **Kibana example:** Poor information representation with pie charts and color blocks
    - **Promise vs. Reality:** Dashboards promise actionability but often provide ready information

  - **Survivorship Bias:**
    - **Example:** World War II bomber bullet analysis
    - **Dashboard analogy:** Focus on irrelevant blocked attacks rather than real threats

  **Bug Bounty Hunters and Penetration Testers**

  - **Bug Bounty Hunters:**
    - **Incentives:** Personal fame and monetary rewards
    - **Specialization:** Often focused on specific types of vulnerabilities like cross-site scripting
    - **Result:** Spotty coverage

  - **Penetration Testers:**
    - **Follow-up contracts:** Incentive to maintain a good relationship with clients
    - **Result:** Reports often balanced and not overly critical, leading to limited security insights

  **Business Incentives and Security Risks**

  - **Anthem Breach:**
    - **Centralization:** Incentive to consolidate for higher margins
    - **Result:** Cluster risk and large-scale data breaches

  - **Crisis Communication:**
    - **Example:** Wizeka credit card company breach
    - **Incentives:** Be transparent vs. be secretive
    - **Result:** Often choose secrecy, leading to delayed communication

  - **Ransomware:**
    - **Pay or not to pay:** Immediate relief vs. strengthening criminals
    - **Cyber insurance:** May make companies more attractive targets

  **Web Application Firewalls (WAFs)**

  - **Commercial vs. Open Source:**
    - **Comparison:** Commercial WAFs often perform worse than open-source solutions like the OWASP ModSecurity Core Rule Set (CRS)
    - **Example:** AWS WAF vs. Azure (using CRS)
    - **Incentives:** Commercial WAFs avoid false positives to maintain business, leading to weaker security

  **Conclusion**

  - **Two levels of bad incentives:**
    - **Relaxed attitude:** Carelessness leads to weak decisions
    - **Deliberate actions:** Financial gain prioritized over security

  - **Call to action:** 
    - **Raise the alarm:** Identify and address misaligned incentives in security decisions
    - **Evaluate incentives:** Understand the motivations of vendors, consultants, and stakeholders


created_at: 2024-09-13 17:23:54
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Speaker Introduction**
  - Dirk Jemollema, security expert from the Netherlands
  - Seven years in security, started his own company last year
  - Focuses on research, consultancy, and training
  - Given talks at various conferences like DEF CON
  - Writes tools to understand and test protocols
  - Active on a blog and Twitter

  **Azure AD Device Identities**
  - Topics covered: Device identities, their importance, technicalities, tokens, implementation issues, and Microsoft’s resolutions
  - **Azure AD**: Identity platform for Microsoft 365, Azure Resource Manager, and other apps
  - **Zero Trust Architecture**: Includes user and device identities for security enforcement

  **Device Identity Registration**
  - Devices get identities when registered or joined to Azure AD
  - **Intune**: Microsoft's mobile device management solution to manage device settings and compliance
  - **Conditional Access Policies**: Restrict access to resources to only compliant corporate devices

  **Device Join Flow**
  - **Autopilot**: Ensures devices are pre-registered when purchased
  - Device generates two public-private key pairs: **Device Key** and **Transport Key**
  - **Public Keys** sent to Azure AD; **Private Keys** remain on the device
  - Device registration involves an HTTP post request with JSON, including authorization header, certificate signing request, transport key, OS version, device type, hostname, join type, and device ticket

  **Primary Refresh Tokens (PRT)**
  - **PRT Flow**: Device requests a nonce, sends signed data to Azure AD, receives a PRT in response
  - PRT includes a session key, encrypted with the transport key
  - **TPM (Trusted Platform Module)**: Secure cryptographic operations, protects private keys and session keys

  **Attacking the PRT Mechanism**
  - **Regular User**: Can request single sign-on data
  - **Administrator**: Can dump LSAS memory to steal PRT and session key
  - **TPM**: Protects keys, but attackers can pre-calculate derived keys using random bytes

  **Microsoft's Fixes**
  - Key derivation function updated to include a nonce, preventing pre-calculation attacks
  - **KDF Version 2**: New key derivation function using SHA256 hash of context and body of JSON web token

  **Research Scenario**
  - **Single Sign-On Attack**: Using single sign-on tokens to register devices without admin privileges
  - **Device Ticket**: Used to override devices, device retains original properties and compliancy status
  - **Microsoft’s Response**: Patches to prevent device registration using single sign-on tokens and ensuring overwritten devices do not retain compliancy status

  **Conclusion**
  - **TPM Protection**: Not foolproof; new research can bypass TPM protection
  - **Tools**: Open-source tools like RhoTools and RhoTX available for research and experimentation
  - Reported issues to Microsoft, resulting in patches and fixes

  **Q&A Highlights**
  - **TPM Key Protection**: Microsoft uses layers below TPM for access controls, restricting keys to system use
  - **Embedded Devices**: Identity system for embedded devices not covered in this research
  - **Revoking Old Keys**: Old primary refresh tokens still work even if device identity is overridden
  - **Attestation in Device Registration**: Not required by Azure AD, separate from Intune requirements

  **Final Notes**
  - Research and tools available on the speaker’s blog and GitHub
  - Open-ended research with ongoing improvements in device identity security


created_at: 2024-09-13 17:29:14
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Talk Overview**
  - **Title**: "Targeted Social Engineering Attacks: Weaponizing Psychology by Christina Lekati"
  - **Speaker**: Christina Lekati, background in psychology and cybersecurity
  - **Duration**: 2746 seconds
  - **Channel**: scrt.insomnihack

  **Speaker Background**
  - **Name**: Christina Lekati
  - **Education**: Degree in psychology
  - **Experience**: Trainer and consultant at Cyberiske GmbH, Zurich
  - **Specialization**:
    - Social engineering awareness training
    - Open source intelligence vulnerability assessment for high-value targets
  - **Affiliation**: Member of the OSINT Curious project

  **Case Study: Marcella Flores**
  - **Source**: Proofpoint report
  - **Profile**: Fake Facebook account targeting aerospace defense industry employees
  - **Method**:
    - Initial contact in 2019, long-term engagement
    - Built trust over a year without immediate action
    - Transitioned from social media to phone and WhatsApp
    - Used pandemic context for engagement
  - **Outcome**:
    - Sent a malicious Google Drive link disguised as a diet survey
    - Target downloaded malware named LEMPO
    - Malware established persistence, performed reconnaissance, and extracted sensitive information

  **Evolution of Social Engineering Attacks**
  - **Trend**: Shift from quick hit-and-run to long-term, tailored campaigns
  - **Psychological Exploitation**:
    - Targeting human needs such as love, affection, and belonging
    - Building trust and relationships over extended periods
  - **Techniques**:
    - Mass phishing emails still prevalent but less effective
    - Increasing use of deepfakes and elaborate mind games
    - Customized and personalized approaches for higher success rates

  **Human Vulnerabilities in Cybersecurity**
  - **Perception**: Human nature often misconstrued as a weakness
  - **Reality**: Exploitation of inherent human traits and behaviors
  - **Common Tactics**:
    - Phishing emails with time pressure and awkward grammar
    - Sophisticated campaigns involving detailed reconnaissance and psychological manipulation

  **Case Study: Mia Ash**
  - **Target**: Telecommunications, government, defense, oil, and financial services in Middle East and North Africa
  - **Method**:
    - Original phishing campaign failed
    - Created a fake profile, Mia Ash, to establish relationships based on common interests
    - Escalated communication to different platforms
    - Delivered a remote access tool via a work email attachment
  - **Outcome**: Successful exploitation and malware installation

  **Defensive Measures**
  - **General Rule**: No one is exempt from social engineering attacks
  - **Techniques Used by Attackers**:
    - **Elicitation**:
      - **Flattery**: Compliments to gain trust
      - **Familiarity and Tribe Instinct**: Establishing common ground
      - **Empathy and Complaints**: Sharing problems to elicit sensitive information
  - **Guidelines**:
    - **Defense Counterintelligence and Security Agency**:
      - **Avoidance**: Know what information should not be shared
      - **Suspicion**: Be wary of persistent inquiries
      - **Boundaries**: Do not disclose unauthorized information

  **Handling High-Value Targets**
  - **Factors to Consider**:
    - **Criticality**: Importance and impact of the role
    - **Recognizability**: Public profile and information availability
    - **Accessibility**: Ease of approach and engagement
    - **Vulnerability**: Observable weaknesses
    - **Knowledge**: Ability to detect and handle threats

  **Training and Awareness**
  - **Importance**: Effective training crucial for defense
  - **Quality**: Interactive and engaging training preferred over passive formats
  - **Culture**: Foster a security mindset within the organization
  - **Simulations**: Practical exercises to reinforce good practices
  - **Neuroplasticity**:
    - **Concept**: Ability to create new behavioral pathways
    - **Application**: Training can make security responses automatic

  **Additional Resources**
  - **Defense Counterintelligence and Security Agency**: Elicitation guide
  - **Christina Lekati's Article**: Detailed information on social engineering attacks and kill chains


created_at: 2024-09-13 17:33:41
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Talk Overview**
  - Title: "Turn And Face The Strange: Ch-Ch-Changes In Ransomware Techniques by Lindsay Kaye"
  - Speaker: Lindsay Kaye, Senior Director of Advanced Reversing Malware Operations and Reconnaissance Group at NC Group at Recorded Future
  - Focus: Observations on ransomware TTP changes over the past couple of years

  **Ransomware Evolution**
  - **Innovations Observed**:
    - New lockers spin up and spin down
    - Feature additions to existing lockers
    - New deployment and spreading methods
    - Use of new programming languages: Golang, Rust, Python
    - Additional extortion methods
    - Targeting additional types of hardware

  **Deployment Techniques**
  - **Using MSPs and Benign Tools**:
    - Harder to detect than custom malicious tools
  - **Lateral Movement**:
    - Using SMB shares, CIFS, and NFS
  - **Impersonation Tokens**:
    - Allow lockers to spread themselves

  **Optimization Techniques**
  - **Intermittent Encryption**:
    - Encrypt every other megabyte for faster encryption
  - **Filling Ecosystem Gaps**:
    - Blackmatter and Conti introduced Linux and ESXi lockers after Reval and DarkSide disbanded
  - **User-Friendly Panels**:
    - Bitcoin mixers, support tickets, and victim moderation

  **Extortion Techniques**
  - **Innovative Methods**:
    - DDoS attacks on non-paying victims
    - Contacting board members, customers, and media
    - Printing ransom notes on physical printers

  **Security Flaws**
  - **Encryption Flaws**:
    - DarkSide and Blackmatter had flaws allowing decryption without payment
  - **False Flag Attribution**:
    - Groups like LockBit and Xiao Ransomware attempt to misattribute attacks

  **Advanced Techniques**
  - **Return-Oriented Programming (ROP)**:
    - Implemented by Play ransomware to make reverse engineering harder
  - **Automated Obfuscation**:
    - Garbage code insertion and string obfuscation
  - **Intermittent Encryption**:
    - Encrypting parts of files to speed up the process

  **Alpha Ransomware**
  - **Rebranding History**:
    - Formerly Darkside, then Blackmatter, now Alpha
  - **Notable Features**:
    - First major ransomware written in Rust
    - ARM locker for targeting NAS devices
    - AlphaMorph obfuscation toolkit

  **LockBit Ransomware**
  - **Variants**:
    - LockBit Black and LockBit Green
  - **Notable Features**:
    - Steelbit for automated data exfiltration
    - Recruiting insiders for initial access
  - **Leaked Builder**:
    - Leaked LockBit Black code allowed for customizable configurations

  **False Flag Operations**
  - **Examples**:
    - LockBit claims to be based in China
    - Yanlu Wang and Xiao Ransomware attempts at false flagging

  **Hunting Ransomware**
  - **Techniques**:
    - Look for automated obfuscation artifacts
    - Check for language or string inconsistencies
    - Analyze anti-debugging and anti-analysis techniques
    - Track changes in crypto algorithms
    - Stay updated on affiliate news and builder leaks

  **Conclusion**
  - **Key Points**:
    - Importance of facing strange and unique aspects for tracking ransomware
    - Signature creation for automated techniques
    - Staying vigilant on new trends and evolutions in ransomware techniques


created_at: 2024-09-13 17:40:24
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Event Overview**
  - **Title:** A Ticket Worth Waiting 65 Years For by Charlie Bromberg
  - **Channel:** scrt.insomnihack
  - **Duration:** 3099 seconds
  - **Upload Date:** 20230411

  **Introduction**
  - A story about a penetration test experience
  - Mention of a long to-do list of research materials
  - Focus on two key topics: **Diamond Ticket** and **Resource-Based Constrained Delegation (RBCD)**

  **Active Directory and Kerberos Overview**
  - **Active Directory Components:** ADDS, ADCS, ADFS, ADSS
  - **Network Authentication Protocols:** NTLM and Kerberos
  - **NTLM:** Three-way handshake, uses NT and LM hashes
  - **Kerberos:** Ticket-based, TGT (Ticket Granting Ticket), service tickets

  **Ticket Forging Techniques**
  - **Silver Tickets:**
    - Requires knowledge of the target service's long-term key
    - No communication with KDC, harder to detect
    - Used for lateral movement or privilege escalation
    - **Detection Notes:** No KDC communication

  - **Golden Tickets:**
    - Requires KRB-TGT long-term key
    - Allows requesting any service ticket
    - High detection probability, easy to mess up the pack
    - **Detection Notes:** High probability of detection and pack errors

  - **MS14068 Vulnerability:**
    - Requires valid credentials and a vulnerable KDC
    - **Process:** Obtain TGT for a standard user, forge pack, insert into valid TGT
    - **Detection Notes:** Patched vulnerability, not a logical abuse

  - **Diamond Tickets:**
    - Requires active credentials
    - Uses valid ticket, replacing values on the fly
    - **Detection Notes:** Lower probability of pack mismatch

  **Advanced Kerberos Techniques**
  - **S4U2SELF and S4U2PROXY:**
    - Extensions for Kerberos delegations
    - **S4U2SELF:** Obtain a service ticket for oneself on behalf of another user
    - **S4U2PROXY:** Obtain a service ticket for another service

  - **User-to-User Authentication (U2U):**
    - Allows obtaining a service ticket for a user
    - **Process:** Bob requests Alice's TGT, uses it to obtain service ticket to Alice

  - **Combining S4U2SELF and U2U:**
    - Allows obtaining a service ticket on another user for oneself
    - **Use Cases:** SPN-less RBCD, unpack-the-hash, Sapphire Ticket technique

  **Sapphire Tickets**
  - **Process:**
    - Combines valid pack with another valid pack of a powerful user
    - Produces a legit TGT with legit pack
    - **Detection Notes:** Legit ticket and pack, harder to detect

  **Implementation Examples**
  - **Silver Tickets:**
    - Use SID and target service's long-term key to forge ticket
    - Example with SecretsDump for credential dumping

  - **Golden Tickets:**
    - Use SID and KRB-TGT long-term key to forge ticket
    - Example with domain controller access

  - **MS14068:**
    - Example with unprivileged user credentials
    - Use PyKEK script to forge ticket

  - **Diamond Tickets:**
    - Use valid credentials to forge ticket on the fly
    - Example with Ticketer

  - **Sapphire Tickets:**
    - Use S4U2SELF + U2U to obtain powerful user's pack
    - Forge TGT with valid credentials and impersonate flag

  **Conclusion**
  - **Summary:** Forging tickets and various Kerberos attacks require understanding of Active Directory and Kerberos structures
  - **Detection and Mitigation:** Analyze forged tickets, network traffic, and suspicious behaviors
  - **Acknowledgements:** Contributions from researchers and existing articles on the topic

  **Q&A Session**
  - Discussion on the best ticket technique for cross-domain attacks
  - Emphasis on the importance of stealth and understanding the underlying techniques


created_at: 2024-09-13 17:45:27
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction of Speakers**
  - Charlotte Lindsay: Chief Public Policy Officer at the Cyber Peace Institute
  - Emma Raffray: Chief Research and Analysis Officer at the Cyber Peace Institute

  **Aim of Discussion**
  - Discuss **harms and impact methodology** developed by the Institute
  - Introduction to the **Cyber Peace Institute**
  - **Approaches to measuring harms and impacts**
  - Examples: **health attacks on healthcare sector**, **attacks in Ukraine**
  - Future direction and importance of the methodology

  **Cyber Peace Institute Overview**
  - **Non-governmental organization** based in Geneva
  - **Independent and neutral**
  - Focus on building **stability in cyberspace** and accountability against threat actors
  - Support for **vulnerable communities** affected by cyber incidences
  - **Multidisciplinary expertise** with an evidence and data-driven approach
  - **Cyber Peace Builders Program**: Supporting humanitarian and non-governmental organizations to build cyber security resilience
  - Ongoing analysis of **cyber threat landscape** affecting vulnerable communities
  - Use insights to inform **policy and legal discussions** at the United Nations and other forums

  **Importance of Measuring Harm**
  - Current focus on **operational or financial impact** of cyber attacks
  - Lack of standard methodology to understand **harms to people**
  - Need for **metrics, tools, and frameworks** to track harm over time
  - Importance for **policy-making** and **supporting victims**

  **Distinguishing Impact and Harm**
  - **Impact**: Operational disruption, financial costs, physical damage, geotemporal factors
  - **Harm**: Physical and psychological harm, community and societal impact, reputational damage, environmental impact

  **Case Study: Hospital Cyber Attack**
  - **Operational disruption**: Systems offline, financial costs, physical infrastructure damage, duration and scope of attack
  - **Human impact**: Effects on patients and healthcare professionals, community and societal implications, reputational damage, environmental impact

  **Existing Literature and Studies**
  - **ICRC report**: Cyber operations in armed conflict, traditional notions of impact, risk assessment
  - **Private sector reports**: Business impact, public relations, insurance, intellectual property
  - **Unidea report**: Taxonomy of malicious cyber incidents, victim profiles, targeted assets, effects and harms, threat actor gains
  - **Academic studies**: Classifications of harms (physical, psychological, emotional, economic, political, governmental, reputational, cultural)

  **Challenges in Data Collection and Analysis**
  - Difficulty in accessing data on **psychological harm**
  - Complexities in **collecting qualitative** and **quantitative data**
  - Need for collaboration with multiple **stakeholders** and **sectors**

  **Cyber Attacks in Ukraine**
  - Documentation of **1,330 cyber attacks** since the beginning of the conflict
  - Quantitative data: 21 attacks per week, 87 threat actors, 23 sectors impacted, 45 countries
  - Qualitative aspects: Impact on **energy**, **financial**, **media**, and **transportation** sectors

  **Importance of Measuring Harms in Conflict**
  - Busting preconceptions about who is affected
  - Using data to inform **normative discussions** at the UN and other forums
  - Reducing impact and increasing **accountability**
  - Raising **public awareness** about cyber risks
  - Addressing the **psychological impact** on victims and organizations

  **Methodology Development**
  - **Identification of indicators of harm** based on data collection
  - Different categories of harm: **Geographical, societal, operational, human, and legal impacts**
  - Weighting indicators to compare incidents
  - Engaging with the community to refine and strengthen the methodology

  **Future Steps**
  - Engage with **cybersecurity experts**, **governments**, **international organizations**, **private sector**, **civil society organizations**, **academia**, and **insurance**
  - Aim to make the methodology a **reference point**
  - Will make methodology public later in the year

  **Conclusion**
  - Importance of continued engagement and feedback from various sectors
  - Aim to build a comprehensive methodology to measure the harm and impact of cyber attacks


created_at: 2024-09-13 17:50:03
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Title and Author Information**
  - Title: No title available
  - Author: Unknown author

  **Video Details**
  - **Webpage URL**: https://www.youtube.com/watch?v=vTnEehai3lE
  - **Title**: Modern Adventures With Legacy Protocols by Yannay Livneh
  - **Channel URL**: https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA
  - **Duration**: 2132 seconds
  - **Channel**: scrt.insomnihack
  - **Uploader**: scrt.insomnihack
  - **Upload Date**: 20230411

  **Introduction**
  - **Presenter**: Yanai Livneh
  - **Talk Title**: Modern Adventures with Legacy Protocols
  - **Research Timeline**: Since 2018
  - **Key Topic**: IP spoofing
  - **Award**: Pony Award for the most under-hyped research

  **Research Overview**
  - **Affiliation**: Independent research, not affiliated with employer
  - **Scope**: Low-level embedded systems, browsers
  - **Structure**: Background motivation, IP and IP spoofing, research methods, struggles, successes, demo, findings, disclosure procedure, future research

  **IP Spoofing Basics**
  - **IP Definition**: Internet Protocol, sending packets on the internet
  - **Packet Information**: Contains source and destination addresses
  - **Flaw**: Source IP is not verified, leading to potential misuse

  **Potential Problems with IP Spoofing**
  - **Authentication Bypass**: Services can be deceived by spoofed IP addresses
  - **Denial of Service**: Overloading servers by sending spoofed packets

  **Research Examples**
  - **OBD Tracker**: Vulnerable to IP spoofing, allowing firmware upgrades and control over car systems
  - **Red Team Exercise**: Exploiting local file inclusion (LFI) and TCP injection to gain remote code execution (RCE) on a target server

  **Mitigations and Challenges**
  - **BCP38 Guideline**: ISPs should filter forged IP packets
  - **Implementation**: Widely adopted by ISPs and cloud providers
  - **IPv6 Tunneling**: Used as a workaround for IP spoofing

  **Research Approach**
  - **Initial Steps**: Sending simple IP packets, using Scapy for Python
  - **IPIP Protocol**: Tunneling IP over IP to bypass filtering
  - **Internet Scanning**: Using ZMap to find IPIP brokers

  **Findings**
  - **Vulnerable Hosts**: Approximately 150,000 hosts support IPIP
  - **IP Spoofing Capability**: Most hosts can be used for IP spoofing
  - **Martian Packets**: Some devices forward private or localhost IP addresses

  **Disclosure Process**
  - **Challenges**: Identifying device owners, fingerprinting, and scanning costs
  - **Help from Akamai and CIRCC**: Assistance with scanning and disclosure
  - **Company Responses**:
    - **Digi**: Professional but unresolved legal issues
    - **Cisco**: Initially denied, later acknowledged after device crashes
    - **HP**: Poor communication, no effective PGP usage
    - **HackerOne**: Internet bounty program, minimal recognition

  **Future Research**
  - **Full TCP Connection**: Establishing a connection to internal networks
  - **Martian Packet Spoofing**: Exploiting private and localhost IP addresses
  - **Protocol Scanning**: Investigating other protocols like GRE
  - **Packet of Death**: Potential for unauthenticated kernel crashes

  **Conclusion**
  - **Contact Information**: Availability for questions and further discussion
  - **Additional Resources**: Twitter account for related content and updates


created_at: 2024-09-13 17:56:48
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Presentation Overview**
  - Title: "Pentesting By The Numbers: What Data Analysis Tells About What We Do"
  - Author: Charl Van Der Walt

  **Introduction**
  - Focus on **security consultants**, **penetration testers**, and **vulnerability management specialists**
  - Analogy: Morning in Africa with **lions** and **antelope** to describe the constant running in security

  **Vulnerability Management**
  - **18,000 new CVEs** per year
  - Average of **19 unique findings** per host
  - Firms patching between **5-20%** of known vulnerabilities
  - Larger organizations patch fewer vulnerabilities

  **Data Analysis and Findings**
  - Three datasets: **Bullwatch security advisories**, **customer scans**, and **penetration tests**
  - Difference between advised vulnerabilities and actual vulnerabilities seen/exploited

  **Penetration Testing Insights**
  - Penetration testing not always emulating real adversaries
  - **Penetration testing reports** often stored in Word documents
  - Use of **Natural Language Processing (NLP)** to extract data from reports

  **Vulnerability Scanning Services**
  - Utilized multiple scanners: **Qualys**, **Rapid7**
  - Findings aggregated into Nucleus platform
  - Data anonymization and demographic information collection

  **Vulnerability Findings**
  - On average, **18-19 findings** per host
  - Vulnerabilities categorized as **low**, **medium**, **high**, and **critical**
  - **Average time to remediate**: 215 days

  **Penetration Testing Data**
  - Types of tests: **web applications, external assessments, internal assessments, red teaming**
  - **CVSS per day** metric developed to normalize findings
  - Comparison of severity between scanning and penetration testing

  **Reporting and Exploited Vulnerabilities**
  - **Ransomware top 10 vulnerabilities**: Only half seen in client data
  - **KEV (Known Exploited Vulnerabilities)**: 860 vulnerabilities, 52% never seen in client data
  - **EPSS (Exploit Prediction Scoring System)**: High accuracy in predicting exploited vulnerabilities

  **Challenges in Penetration Testing**
  - Disconnect between reported vulnerabilities and actual exploited vulnerabilities
  - **Penetration testers** not always reporting high-probability exploited vulnerabilities

  **Industry Specific Insights**
  - Differences in vulnerability management across industries
  - Some industries have higher CVSS per day metrics

  **Effectiveness of Risk Assessment**
  - Drop in reported vulnerabilities over time
  - Possible reasons: **Improved security**, **better development practices**, **VPN testing constraints**

  **Real-World Example: LastPass Compromise**
  - Series of compromises leading to significant data breaches
  - Use of a known CVE in Plex media server

  **Conclusion**
  - Questioning the effectiveness of current penetration testing and scanning practices
  - Importance of advising clients accurately on threats

  **Questions and Discussion**
  - Audience questions on **CVEs**, **industry performance**, and **context in vulnerability reporting**
  - Discussion on the need for improved vulnerability scoring and reporting systems


created_at: 2024-09-13 18:01:00
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - Talk about **Inglourious Drivers**
  - Typo homage to **Quentin Tarantino's Inglourious Basterds**
  - Focus on **kernel drivers**

  **Speaker Background**
  - **Omer Tsarfati**, Senior Security Researcher at **CyberArk Labs**
  - Over **eight years** of security research experience
  - Hobbies: **Basketball**, **video games**, **research**

  **Presentation Overview**
  - **Windows driver framework**
  - **Common mistakes** by driver developers
  - **Specific problematic driver**
  - **Finding more vulnerabilities** using **total**
  - **Mitigations** for the vulnerabilities

  **Short Story: Gaming Laptop**
  - **MSI gaming laptop** and **FPS importance**
  - **Dragon Center** program for controlling cooling fans
  - Created own program to control fans
  - **User mode application** communicates with **kernel driver**

  **Privilege Level Architecture in Windows**
  - Four levels: **Sandbox process**, **Non-admin processes**, **Admin processes**, **OS kernel**
  - **Kernel drivers** interact with hardware

  **Security Perspective on Drivers**
  - **Access and permissions** to the driver
  - **Communication with the driver**
  - **Driver creates device object** with security descriptor
  - **Symbolic link creation** for user space access

  **Driver Communication**
  - **Dispatch routines** using **major function**
  - Five common major functions: **create**, **close**, **read**, **write**, **device Iocontrol**

  **IO Request Packets (IRP)**
  - **IRP structure** generated by IOManager
  - Important fields: **Request mode**, **Input/output buffer**, **IO status information**
  - **IO control code (IOctal)**: 32-bit number used as identifier

  **Common Developer Mistakes**
  - **Method neither**: Buffers reside in user mode, need **try except block**
  - **Probing for read/write** to avoid crashes
  - **Method buffer**: Buffers copied securely to kernel memory, need validation
  - **Direct IO**: Uses MDL, needs **try except block**
  - **Common bugs**: Buffer overflows, arbitrary kernel read/write, info leaks

  **Example: MSI Driver Issues**
  - **Buffer overflow** due to lack of validation
  - **No stack canaries** used
  - **Low-level access** to IO ports and memory

  **Example: Razer Synapse Driver Issues**
  - **Port read/write primitives**
  - **Arbitrary MSR writes**: Can achieve arbitrary code execution
  - **Race condition** in security descriptor application

  **Further Research and Findings**
  - Used **ViewersTotal** to find similar drivers
  - Found **114 vulnerable drivers** from major vendors
  - **Mitigations**: Enable **Hyper-V**, use **antivirus**, avoid **WinIO codebase**

  **Conclusion**
  - Recommendations for **end users** and **developers**
  - **CVs** obtained during research
  - **Contact information** for further questions


created_at: 2024-09-13 18:06:05
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - USBValve: Expose USB Activity On The Fly by Cesare Pizzi
  - Presentation by **Cesare Pizzi** from **Sorrent Lab**
  - Focus on **USB security** and **malware spreading via USB**

  **Cesare Pizzi's Background**
  - Works for **Sorrent Lab** in IT security
  - Advocate for **open source software**
  - Contributor to projects like **Volatility**, **Persistent Sniper**, **C2s**, **PickEasy**, **Resploit**, and **CNUAL**
  - Active on **GitHub** and **Twitter** (Redshift)

  **Problem Statement**
  - **USB drives** still a security issue in **2023**
  - Common belief: **Malware spreading via USB** is outdated
  - Reality: Many **malware** still use USB for spreading

  **Examples of Malware Using USB**
  - **Mistclock**
  - **Raspberry Robin**
  - **NJRat**
  - **Try2Cry**
  - **PlugX**

  **Reasons USB is Still Used for Malware**
  - **Ease of implementation**: Easier than network spreading
  - **Lack of precautions**: USB drives exchanged without caution
  - **Spillover**: USB can bypass network segmentation

  **Development of USBValve**
  - **Purpose**: Provide visibility on USB activity when inserted
  - **Hardware**: Built on **Raspberry Pi Pico** and **OLED screen**
  - **Cost**: Approximately $10

  **Design Choices**
  - Chose **Raspberry Pi Pico** for its documentation and support
  - Emulates everything in **RAM** to avoid using an SD card
  - Compatible with **RP2040 platforms** and **TinyUSB library**
  - Created a custom **PCB** for compactness and robustness

  **Functionality of USBValve**
  - **Firmware**: Based on **TinyUSB library**
  - **File System**: Crafted to avoid false positives
  - Exposes more space than available in RAM for monitoring purposes

  **Field Testing**
  - Tested with various **malware**:
    - **NGRAT**: Uses **autorun.inf** for execution
    - **Try2Cry**: Ransomware using enticing filenames
    - **Raspberry Robin**: Complex malware using **LNK files**
    - **PlugX**: Uses **XDBG DLL** for spreading

  **Usage and Detection**
  - Insert **USBValve** into a PC to monitor activity
  - Displays messages on **OLED screen** for immediate feedback
  - Identifies benign and suspicious activities using specific markers

  **Advanced Debugging**
  - Provides **SCSI-level monitoring** through **COM port**
  - Can be used with **Jlink debugger** for full firmware access

  **Customization**
  - Users can build their own file system using provided scripts
  - Encourages collaboration through **GitHub** for project improvement

  **Open Source and Community**
  - **USBValve** is fully open source
  - Published on **GitHub** with **building instructions**
  - Credits given to **TinyUSB Project**, **Adafruit**, and others

  **Conclusion**
  - Encourages experimentation with USBValve on various devices
  - Open to questions and further discussions via **GitHub** or **Twitter**


created_at: 2024-09-13 18:11:33
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Hacking Your Jump Rope Or Your Coffee Machine**

  **Introduction**
  - Axelle Apvrille, works for Fortinet
  - Focus on **Android malware** and **connected objects**
  - Lead organizer of a phone CTF in the south of France, dedicated to connected objects
  - Today's discussion: smart coffee maker machine and jump rope

  **Devices Overview**
  - **Coffee Machine**: Connected via **Bluetooth Low Energy (BLE)**
  - **Jump Rope**: Also a **BLE** device
  - Integrated into challenges for phone CTFs in 2019 (coffee machine) and 2022 (jump rope)

  **Hacking the Coffee Machine**
  - **Three Points of Attack**: **Hardware**, **Communication**, **Smartphone**
    
  **Hardware Reconnaissance**
  - Open coffee machine:
    - Buttons, mechanisms, PCB
    - **STM chip** (8-bit microcontroller) and **BLE chip**
  - Documentation:
    - Instruction manual: **Reset to factory settings**
    - Service manual: Detailed repair information

  **BLE Communication**
  - Tools: **Ubertooth**, **Adafruit LE Sniffer**
  - Sniffing challenges: **Flash firmware**, **Patch Wireshark**
  - Smartphone approach: Use **NRF Connect**, **GATTool**, or **Bluetooth Control**

  **BLE Services and Characteristics**
  - **List services**: Use smartphone apps or laptop tools
  - Standard services: **Generic Access**, **Generic Attributes**
  - Custom services for the coffee machine

  **Authentication and Authorization**
  - BLE Security modes: **Level 1 (low)**, **Level 2 (moderate)**, **Level 3 (high/authenticated encryption)**
  - Authorization: Requires writing an **authorization code**

  **Smartphone Sniffing**
  - **Rooted device**: Enable **Bluetooth snooping**
  - Transfer PCAP to Wireshark

  **Customizing Coffee Settings**
  - **Class CupSizeVolume**: Different ranges for **ristretto**, **espresso**, **lungo**
  - **Class CupSizeOperations**: Specify **CupSize** and **CupVolume**
  - Brew command: Specify **delay** and **coffee type**

  **Summary and Demonstration**
  - Pairing, authorizing, customizing, and brewing steps
  - Video demonstration of 90 milliliters coffee brewing

  **Additional Capabilities**
  - **Recipes**: Build custom coffee recipes
  - **Remote control**: Use a **Raspberry Pi** to act as a BLE relay
  - **GitHub**: Code for remote coffee brewing available

  **Hacking the Jump Rope**
  - Similar BLE device, focused on **communication**
  - **System logs**: Valuable information in Android logs

  **Live Demo**
  - **Logcat**: Logs Bluetooth packets
  - **Chinese characters**: Translate for understanding

  **Understanding BLE Communication**
  - Three modes: **Number countdown**, **Time countdown**, **Free jump**
  - Commands: Specify **mode**, **target**, **CRC**

  **Challenges and Solutions**
  - **Validation**: Manual validation, web server, firmware modification, or fake jump rope
  - **Fake jump rope**: ESP32 board with BLE services

  **Takeaways**
  - **Hackers**: Inspect Android logs
  - **Developers**: Remove debug logs, avoid pairing if possible, use BLE encryption
  - **Manuals**: Provide detailed repair manuals and parts information

  **Final Thoughts**
  - Hacking as a positive activity
  - **Infection risk**: Limited in current devices, but caution needed for connected devices with storage

  **Conclusion**
  - Questions and discussions on hacking and connected devices


created_at: 2024-09-13 18:18:03
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Event Overview**
  - Title: **The Latest Startups In Cybersecurity & How To Become A Cyber Entrepreneur? by Trust Valley Startups**
  - **Webpage URL:** [YouTube Video](https://www.youtube.com/watch?v=x5IyXJthNo0)
  - **Channel URL:** [scrt.insomnihack](https://www.youtube.com/channel/UCGdJZb8OWZPrRK8PuEeoZuA)
  - **Duration:** 3245 seconds
  - **Channel:** scrt.insomnihack
  - **Uploader:** scrt.insomnihack
  - **Upload Date:** 2023-04-11

  **Introduction by Lénique Pedron**
  - **Director of Trust Valley**
  - **Participants:** Olivier Crochat, executive director of C4DT, EPFL
  - Event divided into two parts:
    - Pitch of startups
    - Discussion on becoming a cyber entrepreneur

  **Trust Valley Overview**
  - **Private-public partnership** for digital trust and cybersecurity
  - **Founded by:** Republic of Geneva and Vaud
  - **Collaborations:** NCS, Luxembourg government, EPFL, private sector (e.g., SMB, SME, ACRT, Koudelski)
  - **Mission:** Foster trust, innovation, and collaboration in the economy
  - **Programs:** Tech Fortress, a booster for startups

  **Tech Fortress Program**
  - **Objective:** Facilitate go-to-market for startups
  - **Success:** Over 100 startups supported, 200 million raised, 50% from Switzerland, 40% from foreign countries
  - **Value:** 100k budget, best-in-class cybersecurity startups, scouting with EPFL, private sector, canton, army
  - **New Vertical:** Digital governance and P-STEC

  **Startup Pitches**

  **Cognitech (Gilles Rosset)**
  - **Specialization:** Real-time monitoring and risk assessment of information systems
  - **USP:** Real-time aspect, user-friendly for non-technical users
  - **Target Audience:** SMEs to large companies

  **ClearSky (Stefano Zamuna)**
  - **Product:** ClearMind - transforms conversations into digital documents locally
  - **Advantages:** Secure, no internet connection needed, saves time, improves focus
  - **Applications:** Medical, legal, law enforcement, board meetings

  **Autena (Dejan Milenovic)**
  - **Mission:** Combat counterfeiting with IoT and blockchain
  - **Technology:** Traceability and authenticity platform as a service
  - **Industries:** Pharma, food and beverage, luxury, sport
  - **Recognition:** Won the Global Mobile Award

  **Another Way (Arnaud Gardin)**
  - **Product:** Dashboard to assess risk from human vulnerabilities (e.g., social networks, dark web)
  - **Target Audience:** Enterprises, potential B2C market
  - **Achievements:** Forum Internationale de la Cybersecurité Prize, working with Ministry of Interior for Paris 2024 Olympics

  **Alchemia (Philippe Huguet)**
  - **Solution:** AI-powered data factory for real-time data analytics
  - **Efficiency:** 10 times faster, 10 times less resources
  - **Applications:** Any data source, structured or unstructured, IoT, sensors

  **Panel Discussion: How to Become a Cyber Entrepreneur**

  **Participants:**
  - **Laurent Balmeli:** Strong Network
  - **Sapporo Team:** Series A entrepreneurs
  - **Aurelien:** Rumia

  **Key Insights:**
  - **Importance of Accelerator Programs:** Essential for mentoring, network, and visibility
  - **Funding:** Critical to raise money early, choose the right investors
  - **Team Building:** Essential to have a complementary and motivated team
  - **Customer Trust:** Building trust with customers is crucial
  - **Market Dynamics:** Cybersecurity market is crowded but opportunities exist

  **Advice for Aspiring Cyber Entrepreneurs**
  - **Laurent Balmeli:** Focus on team building, find the right partners
  - **Philippe Huguet:** Trust is key, both internally and externally
  - **Aurelien:** Take the first step, leverage networks and opportunities

  **Conclusion**
  - Emphasis on trust, innovation, and collaboration within the cybersecurity ecosystem
  - Encouragement to leverage support programs and networks for entrepreneurial success


created_at: 2024-09-13 18:21:48
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Talk Introduction**
  - Welcome to the talk on visibility and security of the **CI-CD ecosystem**
  - **Agenda**: Set context, discuss attack surface, methodology, introduce **CI-CD Guard**, deep dive into architecture and workflow, demo, future roadmap

  **Speaker Introduction**
  - **Pramod Rana**: Application Security Manager at **NetScope**
  - Involved in **security testing** and **DevSecOps**
  - Author of three open source projects: **Omniscient**, **ViewPrioritizer**, **SecDependent Editor**
  - **OWASP Pune chapter lead** and **OSCP**

  **CI-CD Ecosystem Overview**
  - **Code base** stored centrally
  - Solution converts code base to deployable entity stored centrally
  - Solution deploys deployable entity into various environments
  - Importance of **security integration** in each phase of the **SDLC**

  **Key Concepts**
  - **Ecosystem**: No component or technology is independent; a compromise affects the entire ecosystem
  - **Visibility**: Awareness of repositories, third-party GitHub actions, Jenkins servers, and job nodes
  - **Relationship**: Understanding the connections between different components in the CI-CD pipeline

  **Attack Surface**
  - **Jenkins server vulnerabilities**: Default/weak credentials affecting binaries
  - **Self-hosted runners**: Vulnerable or malicious third-party actions leading to misuse (e.g., cryptocurrency mining)
  - **SSO and compromised users**: Impact across technologies due to lack of MFA or social engineering attacks

  **Methodology for CI-CD Security**
  - **Making software secure and robust by default**: Shared responsibility between software provider and consumer
  - **Implementation in environment**: Importance of secure configuration
  - **Continuous monitoring**: Detecting and responding to incidents

  **CI-CD Guard Project**
  - **Graph representation**: Components as nodes, relationships as edges
  - **Security aspects**: Identifying misconfigurations, providing recommendations
  - **Relationship analysis**: Using graph theory for intuitive understanding

  **Architecture and Workflow**
  - **Node database schema**: Detailed breakdown (workflow, job, step, command, runner, action)
  - **Scan engine**: Independent scripts for security scans
  - **Analysis engine**: Identifying relationships between technologies
  - **Output**: Data fed into **Neo4j** database, JSON format for other tools
  - **Web UI**: Visualizing data and custom filtering

  **Demo Highlights**
  - **Recorded demo**: Due to sensitive information
  - **Environmental variables**: Used for authentication
  - **Command line output**: JSON format for compatibility with other analysis tools
  - **UI visualization**: Different node colors, edges representing relationships

  **Future Roadmap**
  - **Expansion**: Adding more technologies
  - **Focus on analysis**: Building comprehensive relationship analysis
  - **Intuitive visualization**: Enhancing search engine capabilities and metadata usage

  **Q&A Session**
  - **Project repository**: Will be updated with code
  - **Vulnerabilities detected**: Basic insecure configurations, outdated plugins, lack of MFA, etc.
  - **Information sources**: API calls to target technologies with superuser access
  - **Database customization**: JSON output can be redirected to other technologies (e.g., RDF database)

  **Conclusion**
  - Thank you message and invitation for further questions and feedback


created_at: 2024-09-13 18:27:17
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction to ICS and Purdue Model**
  - **Industrial Control Systems (ICS)**: Found in various industries like transport, aeronautics, automobile, military, defense, and utilities.
  - **Components of ICS**: Sensors, actuators, programmable logic controllers (PLCs), supervision network, SCADA network.
  - **Purdue Model**: A conceptual model with different levels for ICS components.
    - **Level 0**: Sensors and actuators
    - **Level 1**: PLCs
    - **Level 2**: Supervision network (Windows workstations, servers)
    - **Level 3**: Orchestrator of the system (not in all plants)
    - **Level 3.5**: DMZ
    - **Level 4**: Enterprise network

  **Challenges of Traditional Secure ICS Architecture**
  - **Traditional Rigidity**: Use of DMZs for interconnections, proxy servers, and firewalls.
  - **Adaptation to New Usages**: Need to consider cloud, IoT, and machine learning integrations.

  **Case Studies: Power Plants vs. Solar and Wind Farms**
  - **Power Plants/Refinery**:
    - Large plants, single location, many on-site workers.
    - High volume of standard assets (PLCs, sensors, actuators, Windows workstations/servers).
    - Complex industrial processes.
  - **Solar and Wind Farms**:
    - Distributed sites, usually unmanned.
    - Few assets, operated from the cloud.
    - Simple operations, mainly for energy management.

  **Secure Architecture for Power Plants**
  - **Standard ICS Network Architecture**: Based on Purdue Model.
  - **Key Elements**:
    - **DMZs**: Between OT (Operational Technology) and IT networks.
    - **Firewalls**: Between OT-DMZ and DMZ-IT.
    - **No direct IT-OT communication**.
    - **Protocol Break**: Use of relay servers.

  **Challenges with Solar and Wind Farms Using Traditional Architecture**
  - **Distributed Sites**: High connectivity needs, use of public networks.
  - **Inefficiency**: Traditional architecture doesn't scale well for many small sites.

  **Proposed Architecture for Distributed ICS**
  - **SD-WAN Technology**: Software Defined Wide Area Network.
    - **Creates virtual WAN** through VPN IPsec tunnels.
    - **Integrates different physical networks** (internet, satellite, radio).
  - **Key Components**:
    - **SD-WAN Edges**: At each location.
    - **DMZ Hosted in Cloud**: Firewall zones, central services.
    - **Network Filtering**: For secure communication.
    - **Detection**: IDS functionality in firewalls.

  **ICS Classification Methodology**
  - **Purpose**: Classify ICS based on risk to define cybersecurity requirements.
  - **Impact and Likelihood**: Factors include attacker's level, functionality, connectivity, access control.
  - **Risk Matrix**: Places ICS on matrix to determine classification.
    - **Class 3 (High Risk)**: Forbids cloud use, private network only.
    - **Class 2 (Moderate Risk)**: Allows cloud under certain conditions.

  **Use Case Catalog and Architecture Patterns**
  - **Purpose**: Concrete operational guidelines for different ICS use cases.
  - **Components**:
    - **Description**: Details of the use case.
    - **Network Architecture Diagram**: Visual representation.
    - **Technical Guidelines**: Specific security measures.
  - **Examples**:
    - **Remote Control of Industrial Applications**: Distributed sites communicating through the internet.
    - **Energy Optimization Solution**: Cloud-based application for command and control.

  **Key Success Factors for Use Case Catalog**
  - **Co-construct with Business**: Involve all stakeholders.
  - **Communication and Promotion**: Ensure awareness and use.
  - **Regular Updates**: Reflect evolving business needs and technologies.

  **Centralized OT Infrastructure**
  - **Benefits**: Better control, uniformity, and resource management.
  - **Considerations**: Decide on central vs. regional DMZs based on company needs.

  **Final Takeaways**
  - **Adaptation**: Secure architectures need to evolve with new usages.
  - **Key Factors for Decision**: Functionality, impact, level of exposition.
  - **Documentation**: Essential for supporting secure architecture decisions.
  - **Balance**: Maintainability and scalability of architectures are crucial.

  **Questions and Concerns**
  - **Latency and Communication Breakdown**: Central DMZ vs. regional DMZs.
  - **Integration of IT Solutions in ICS**: Use of docker containers, virtual machines, machine learning.
  - **Practical Implementation**: Use IT cybersecurity practices for OT when applicable.


created_at: 2024-09-13 18:33:27
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Speaker Introduction**
  - Dimitrios Valsamaras from Greece
  - Engaged in **computer security** since 2002
  - Former member of a reverse engineering group in Greece
  - Career started as a **network security engineer**
  - Experience in development and security
  - Worked with **Microsoft's threat intelligence team** as a senior security researcher
  - Led a team conducting malware reviews for the **Google Play Store**
  - Personal interests: father of two, plays music (guitar, piano), sings

  **Presentation Outline**
  - **Android user interface**: overview of main components
  - **GUI confusion attacks**: techniques and behavior
  - **Universal overlays**: specific CVE addressed and permissionless approach
  - **Defensive takeaways**: protecting Android apps

  **Android Graphics Architecture**
  - **Components**: Windows, view objects, surface objects, surface flinger, hardware composer
  - **Window manager**: decides order, focus, position of windows
  - **Window behavior**: appearance, transition, animation
  - **Window types**: based on Z-order, privileged types require special permissions

  **Window Types and Permissions**
  - **Type alert window**: requires system window permission
  - **SDK 23**: permissions approved by default for apps targeting lower SDKs
  - **Example of window types**: deprecated or aggregated under a single type

  **Window Behavior and Exploitation**
  - **Touch events**: windows can consume or dispatch touch events
  - **Flags**: flag not touchable for click-through capability
  - **Free-floating windows**: persist based on the process, used by malware

  **Main Issue in Android UI**
  - **Multiple apps**: running simultaneously, only one interacts with the user at a time
  - **User interface imitation**: no explicit info showing UI origin, leading to potential imitation and phishing

  **GUI Confusion Attack Techniques**
  - **Overlay attacks**: concealment of messages, tricking users
  - **Task hijacking**: abusing task affinity and allow task reparenting
  - **Activity switching**: bringing malicious activity to the foreground

  **Examples of GUI Confusion Attacks**
  - **Type toast window**: used to perform overlays without permission
  - **Type presentation window**: used in the Flav99 adware
  - **Task hijacking**: injecting malicious activity into a secure app’s task
  - **Activity switching**: using APIs to bring malicious activity to the foreground

  **Demonstrations**
  - **Demo 1**: Observing the foreground and hijacking a banking app activity
  - **Demo 2**: Transparent activity integrating with the YouTube app UI

  **Single-Step and Multi-Step Decision Dialogs**
  - **Single-step dialogs**: permissions dialogs for private info and devices
  - **Multi-step dialogs**: access to services like accessibility, device admin, system settings

  **Mitigation Strategies**
  - **Check for obscured events**: using flags to detect and reject obscured touch events
  - **Hide overlay windows**: method to protect activities from system alert windows

  **Conclusion**
  - **Design issue**: difficulty in identifying the interacting app
  - **UI integration**: combining top activity UI with underlying activity UI
  - **Click-through capability**: adding and using it to hijack decision dialogs

  **Q&A Highlights**
  - **Mitigations**: checking motion events, using flags for critical decision screens
  - **Protection for common users**: installing apps from trusted sources, understanding permissions
  - **Use cases for overlays**: legitimate uses like messenger bubbles and picture-in-picture mode


created_at: 2024-09-13 18:39:34
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - Speaker: Leo Juszkiewicz
  - Event: Insomniac ICRT
  - Location: Lausanne, Switzerland
  - Topic: Attacking and Defending GraphQL

  **Speaker Background**
  - **Name**: Leo Juszkiewicz
  - **Origin**: Mexico
  - **Hobbies**: Chili, Swiss chocolate, soccer/football
  - **Certifications**: OSCP, OSCE, CPPT, EMAP, EWPT, PTX
  - **Current Role**: Application Security Architect at Dario Health, New York
  - **Education**: Pursuing MSc in Cybersecurity from the University of London

  **Agenda**
  - Overview of **GraphQL**
  - Terminology
  - Comparison with **REST APIs**
  - Real exploit scenarios
  - Attack vectors
  - Remediation and defense strategies

  **GraphQL Basics**
  - **API**: Allows data exchange between applications
  - **REST API**: Traditional method with multiple endpoints and methods (GET, POST, PUT, DELETE)
  - **GraphQL**: Open-source data query and manipulation technology, created by Facebook in 2012, released in 2015
  - **Advantages**: Flexibility, efficiency, strongly typed language, reduced over-fetching and under-fetching

  **GraphQL Terminology**
  - **Schema**: Defines the structure of data queries
  - **Object**: Type of operation to be retrieved or delivered
  - **Field**: Specifies values for an object
  - **Operations**: Three main types
    - **Query**: Read-only operation
    - **Mutation**: Modify data
    - **Subscription**: Push notifications, often used with WebSockets
  - **Directives**: Modifiers like **skip** and **include**
  - **Fragments**: Reusable pieces of code
  - **Introspection**: Query the server's schema and types for debugging, often enabled by default

  **GraphQL vs REST API**
  - **GraphQL**: Single endpoint, uses POST methods, avoids over-fetching/under-fetching, strongly typed, flexible
  - **REST API**: Multiple endpoints, uses multiple methods (GET, POST, PUT, DELETE), prone to over-fetching/under-fetching, less flexible
  - **Caching**: Easier with REST, more complex with GraphQL due to dynamic response content

  **Usage Statistics**
  - Widely adopted by companies like Facebook, GitHub, Pinterest, Coursera, Shopify
  - Millions of repositories created with GraphQL

  **Exploit Scenarios**
  - **Shopify**: Vulnerability in email mutation endpoint, exploited by changing customer emails without authorization
  - **Common Attack Vectors**:
    - **Injections**: SQL and others
    - **Denial of Service (DoS)**: Nested queries, excessive fragments
    - **Cross-Site Request Forgery (CSRF)**: Especially with GET methods
    - **Authentication/Authorization Bypass**: Privilege escalation
    - **Field Enumeration**: Discovering field names through suggestions
    - **Error Handling**: Revealing too much information

  **Defensive Strategies**
  - **Disable introspection**: Especially in production environments
  - **Avoid preloading queries**: In JavaScript libraries
  - **Use only POST requests**
  - **Set query depth limits and timeouts**: Prevent DoS attacks
  - **Calculate field heights**: Limit the number of fields
  - **Return generic errors**
  - **Sanitize and validate all fields**

  **Q&A Session**
  - Importance of **authorization** on which fields can be queried by which users
  - **Enumeration**: Accessing the schema through introspection or brute force
  - **Tools for Attacking GraphQL**: Burp Suite with InQL extension, Graph Wolf, WFuzz, SecList

  **Conclusion**
  - Emphasized the importance of securing GraphQL endpoints and properly validating user inputs.
  - Encouraged the audience to use available tools for both defending and testing GraphQL implementations.


created_at: 2024-09-13 18:56:01
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction**
  - First talk ever by Thomas Bygodt
  - Topic: Modern electronic lockpicking
  - Focus on physical design vulnerabilities and Bluetooth Low Energy (BLE)

  **Background**
  - Senior security editor for OneCyberDefense since 2017
  - Interests: IoT, hardware, reverse engineering
  - Brief history of locks:
    - Ancient Egypt: Simple wooden locks
    - 1951 lock controversy: Mr. Hobbs picked unbreakable locks

  **Physical Vulnerabilities**
  - Goal: Access without brute force
  - Steps:
    - Find a physical entry point
    - Understand lock hardware and communication
    - Reverse engineer firmware to find vulnerabilities
  - Example lock analysis:
    - Main board: Nordic processor ARM Cortex M4 32-bit
    - Motor board: STM8 microcontroller
    - Debug ports and connectors accessible
    - Weak or no protection on processors

  **Reverse Engineering Process**
  - Extract firmware using OpenOCD
  - Use tools like nrefident and GDB to analyze memory and configuration
  - Findings:
    - Easy access to hardware and datasheets
    - Lack of protection on debug ports
    - Weak processor protection

  **Communication Analysis**
  - Use logical analyzer to study signals
  - Identify wake-up signals, requests, and responses
  - Convert signals to hexadecimal for easier analysis
  - Replay attack possibility due to unencrypted communication

  **Firmware Analysis**
  - Extract important data using datasheets and memory dumps
  - Identify key structures and functions (e.g., EasyFlash)
  - Use tools like Gidra and custom scripts for deeper analysis
  - Findings:
    - Plaintext passwords, including master passwords
    - Non-random master passwords

  **Attack Implementation**
  - Create custom firmware with attack code
  - Use existing hardware for initialization
  - Demonstrate unlocking a door in less than 8 seconds

  **Second Lock Analysis**
  - Similar design but different processor (Nordic NRF-51)
  - Vulnerability in Cortex-M0 allows memory read/write
  - Same communication issues: unencrypted, no replay attack protection

  **Bluetooth Low Energy (BLE) Vulnerabilities**
  - Use of plaintext BLE communication
  - Encryption implemented in software, not protocol
  - Key findings:
    - Fixed keys derived from login key
    - Six-character login key easily brute-forced
    - Communication can be decrypted and manipulated

  **BLE Attack Demonstration**
  - Brute-force login key to decrypt communication
  - Unlock BLE-enabled devices in less than 20 seconds
  - Vulnerability affects all devices using the same BLE SDK

  **Responsible Disclosure**
  - Difficulties with physical vulnerability disclosure
  - Successful communication with BLE SDK creator
  - Maximum reward received for responsible disclosure

  **Conclusion**
  - Importance of proper security measures in smart locks
  - Encouragement to research and verify security of smart devices
  - Q&A session: Clarification on attack setup and time required

  **Q&A Highlights**
  - Drilling and connecting attack card takes approximately 2 minutes
  - Replace drilled parts to cover traces of attack

  **Final Remarks**
  - Thanked audience and organizers
  - Encouraged further questions and discussions


created_at: 2024-09-13 22:14:08
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Introduction:**
  - This video offers a comprehensive guide for **Dota 2** players, specifically focusing on the **offlane** role during the **early game phase**.

  **Winning the Lane:**
  - Prioritize pushing the enemy's **safe lane** to apply pressure and disrupt their farming.
  - Ensure constant **warding** around the enemy's safe lane and jungle, taking control of the area.
  - Invade the enemy jungle, establishing dominance and hunting enemies with your team.
  - Protect your wards with sentries and by calling for support.
  - Connect the dots by efficiently transitioning between waves and camps, maximizing farm.
  - Maintain control of the enemy's safe lane and jungle to deplete their resources.
  - Identify threats and adjust your farming path accordingly, pushing your limits safely.
  - Utilize **scan** to check for danger when pushing forward.

  **Dota2ProTracker:**
  - A recommended resource for up-to-date meta builds and hero picks.

  **Losing the Lane:**
  - When facing a disadvantage, focus on recovery by selecting the right farming routes, such as ancient camps or pulling the big camp.
  - Connect the dots by minimizing pauses and maximizing farm efficiency.
  - Avoid unnecessary interruptions and chasing kills; prioritize pushing waves and farming.
  - Use spells efficiently to kill creeps quickly.
  - Always have **clarities** and **TPs** available for mana and mobility.
  - Identify open lanes and use TP to farm efficiently.
  - Show up for clean-up fights and avoid unnecessary risks.
  - Track amplification and use scan to ensure safety.
  - Adjust your item timing based on game pacing.

  **Conclusion:**
  - Emphasizes that a losing lane can become a winning lane with proper adjustments and ganks.
  - Summarizes the key points of the guide and encourages viewers to ask questions in the comments.


created_at: 2024-09-13 22:25:50
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Increasing Leads and Progressing the Game:**
  - **Progressing the game** involves taking **objectives**, namely towers and Roshan.
  - **Increasing your lead** means accruing more gold and XP than your opponent.
  - Taking objectives permanently increases your **map control** and limits the opposing team's movement.
  - After winning a fight, take an objective or fix your lanes to set up for the next objective.

  **The Box Concept:**
  - The **box** is the **losing team's area of control**.
  - The team ahead wants to **shrink the box** by taking objectives and limiting the enemy's movement.
  - The team behind wants to **push out the box** and increase their area of control.
  - A team cannot control the entire map, so take advantage of their positioning.
  - Use wards and scouts to gain vision and catch heroes that leave their box.
  - Capitalize on the opponent's mistakes, especially at higher MMRs.

  **High Ground Strategies:**
  - Only push high ground with a **significant advantage**, such as a hero number advantage or the Aegis.
  - Be aware of possible **buybacks** and have a plan to respect them.
  - Avoid pushing into key high-ground heroes like Tinker and Sniper; instead, fight them outside their base.

  **Conclusion:**
  - Emphasizes the importance of map control, vision, and capitalizing on advantages.
  - Provides strategies for increasing leads, progressing the game, and pushing high ground.
  - Part three of the series will focus on making good plays.


created_at: 2024-09-13 22:29:56
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Increasing Leads and Progressing the Game:**
  - **Progressing the game** involves taking **objectives** such as towers and Roshan.
  - Alternatively, progress can be made by **setting up the map** and gaining **map control**, which will help increase your lead.
  - **Increasing your lead** means accruing more gold and XP than your opponent over time.
  - Taking objectives permanently increases your map control and limits the opposing team's area of movement.
  - After winning a fight, take an objective or fix your lanes to set up for the next fight and gain information.

  **The Box Concept:**
  - The **box** is the **losing team's area of control**.
  - The team ahead wants to **shrink the box** by taking objectives, while the losing team wants to push it out.
  - A team cannot control the entire map, so use this to your advantage by spreading out and increasing your area of control when losing.
  - When ahead, **corral the enemy** into the area behind their remaining towers to make taking objectives easier and gain information.
  - Have good **vision** and **wards** to catch and kill heroes that leave their box.
  - Respect **buybacks** and be aware of key high-ground heroes like Tinker and Sniper.

  **High Ground Strategies:**
  - Only push high ground with a significant advantage, such as a hero number advantage or the Aegis.
  - Be mindful of possible buybacks and have a plan for how to respond.
  - It's usually best to respect the buyback, push high ground, and then back off if they buy back.
  - Play the box and control the map. Fight enemies when they leave their box/base.

  **Conclusion:**
  - This video offers strategies for increasing leads, progressing the game, and taking the high ground in Dota 2.
  - Part three of the series will focus on making good plays.


created_at: 2024-09-13 22:33:03
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Rust's Adoption of C++ Features**
  - The video discusses Rust's adoption and innovation of three C++ features.

  **First Feature: Resource Management Model**
  - C++ introduced the **RAII** (**R**esource **A**cquisition **I**s **I**nitialization) pattern, which ties **resource management** to the **lifecycle** of objects.
  - Resources like **memory**, **database connections**, and **file handles** are acquired and released in the object's **constructor** and **destructor** functions, respectively.
  - RAII ensures **reliable resource management**, **cleaner code**, and a reduced risk of **resource leaks**.
  - Rust has adopted RAII as a core language feature, providing improvements in **safety** and **ease of use**.

  **RAII Improvements in Rust:**
  - Rust prevents accidental memory management issues that can occur in C++ due to the use of `new` and `delete` operators.
  - The compiler enforces the validity of **references**, guaranteeing they point to **valid memory** and eliminating issues like **null pointer dereferences**.
  - Rust's RAII is called the **ownership model**, with extra checks called the **borrowing model**, ensuring **memory safety**.

  **Second Feature: Zero-Cost Abstractions**
  - The principle of **zero-cost abstractions** ensures that high-level abstractions like **generics** and **collections** impose no **runtime overhead** compared to low-level code.
  - This provides a **better developer experience** without sacrificing **performance**.
  - C++ and Rust examples demonstrate how abstractions like **iterators** simplify code while maintaining efficiency.
  - Rust enhances this principle by emphasizing **memory safety** and **thread safety**.

  **Third Feature: Generic Programming**
  - C++ uses **templates** for generic programming, allowing flexible and reusable code that works with any **data type**.
  - Rust modernizes generics with a **cleaner syntax** and tight integration with its **trait system**, providing clearer **error messages**.
  - Rust's generics maintain the zero-cost abstraction principle, with compiled code being as efficient as hand-written functions for each type.
  - Rust's **ownership system** ensures memory and thread safety for generic functions.

  **Rust's Limitations and Future**
  - Rust faces limitations in terms of **ecosystem** and **compatibility** compared to the well-established C++.
  - While industry **adoption** is growing, Rust needs to expand its ecosystem and improve compatibility with existing codebases to truly compete with C++.
  - Optimism remains high for Rust's future as ecosystem and compatibility enhancements are made.


created_at: 2024-09-13 22:34:50
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Rust's Upcoming Major Update:**
  - A new edition of Rust is released every 3 years.
  - The highly-anticipated **2024 edition** is expected to be released soon.

  **Generators:**
  - The **Gen keyword** will be reserved for future implementation of **generators**.
  - Generators simplify the creation of complex **iterators** using **imperative syntax**.
  - They offer a more concise, readable, and efficient alternative to the manual approach or combinator methods.
  - The Rust team plans to support **async generator blocks** and add **gen function** or **trifunction syntax**.

  **Polonius:**
  - Polonius is Rust's **next-generation borrow checking algorithm**, improving on the current borrow checker.
  - It resolves limitations by understanding **nuanced cases** and allowing memory-safe code to compile.
  - The Rust team aims to **land Polonius in Nightly** within the next 6 months and eventually ship it to stable Rust.

  **Additional Features:**
  - Critical building block features for **async Rust**, like **async closures** and **send bounds**.
  - Unblocking Rust adoption in the **Linux kernel** by stabilizing several features.
  - Shipping **Cargo script** for creating single files with embedded dependencies.
  - Stabilizing **parallel frontend compilation** for up to **20% faster compile times**.
  - Reducing **syntactic overhead** when working with reference-counted data.
  - The 2024 edition is expected for release in **Rust version 1.85** on **January 3rd, 2025**.

  **Conclusion:**
  - The upcoming Rust update includes exciting features and improvements, offering enhanced functionality and performance.
  - Free Rust training is available at **letsgetrusty.com/bootcamp**.


created_at: 2024-09-13 22:35:13
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Rust's Upcoming Major Update:**
  - A new edition of Rust is released every 3 years.
  - The highly-anticipated **2024 edition** is expected to be released soon.

  **Generators:**
  - The **Gen keyword** will be reserved for future implementation of **generators**.
  - Generators simplify the creation of complex **iterators** using **imperative syntax**.
  - They provide a more concise, readable, and efficient alternative to the manual approach or combinator methods.
  - The Rust team plans to support **async generator blocks** and add **gen function** or **trifunction syntax**.

  **Polonius:**
  - Polonius is Rust's **next-generation borrow checking algorithm**, improving on the current borrow checker.
  - It resolves limitations by understanding **nuanced cases** and allowing memory-safe code to compile.
  - The Rust team aims to **land Polonius in Nightly** within the next 6 months and eventually ship it to stable Rust.

  **Additional Features:**
  - Critical building block features for **async Rust**, like **async closures** and **send bounds**.
  - Unblocking Rust adoption in the **Linux kernel** by stabilizing several features.
  - Shipping **Cargo script** for creating single files with embedded dependencies.
  - Stabilizing **parallel frontend compilation** for up to **20% faster compile times**.
  - Reducing **syntactic overhead** when working with reference-counted data.
  - The 2024 edition is expected for Rust version 1.85, with a **beta release** on January 3, 2025, and a stable release about a month later.


created_at: 2024-09-13 22:37:03
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **Why Rust Libraries May Never Exist**
  - The large number of **crates** and long **compilation** times required when building projects in Rust are due to the absence of traditional **libraries**.
  - Rust's **package manager**, Cargo, doesn't provide the same type of libraries as those found in C, despite managing libraries.

  **C Libraries**
  - C programs rely on the pre-written and pre-compiled **GNU C library** (**libc**).
  - **libc** is a **shared object** file that contains functions like **open**, **read**, **write**, and **close**, which are easily accessible at **runtime**.
  - The **ELF ABI** (Application Binary Interface) for the **ELF file format** enables C to expose an interface for programs to access functions from another ELF file.
  - The ELF ABI ensures **interoperability** between functions and data in libraries by guaranteeing the same **order and location** of struct elements.

  **The Absence of Rust Libraries**
  - Rust currently lacks a stable **ABI** (Application Binary Interface) to facilitate **information sharing** across multiple binaries.
  - Cargo packages are simply source code blobs that are compiled locally and combined into a single large blob of code within an ELF file.
  - This results in lengthy compilation times and large binary sizes for Rust programs.

  **The Challenge of Creating Rust Libraries**
  - Developing an ABI for Rust is more complex than for C due to the language's unique features and struct **ordering flexibility**.
  - **Generics** in Rust, which are statically dispatched and built at compile time, further complicate the creation of an ABI.
  - Rust's powerful **compile-time static analyzers**, such as the **borrow checker**, are not compatible with pre-compiled binaries.

  **The C ABI in Rust**
  - Rust does offer a C ABI using the **reprC syntax**, allowing the creation of types and functions compatible with the ELF ABI.
  - However, the reprC approach does not support Rust's unique typing system or its safety features, such as the borrow checker, across application boundaries.
  - While reprC is useful for converting Rust code into a C library, it falls short for creating Rust-to-Rust binary objects.

  **Proposed Solutions and Challenges**
  - Several individuals have proposed **merge requests** to the **Rust Langmaster** to develop new ABIs, but a unified community effort is needed.
  - Joss Triplett's proposed **Crabby API** (or Crab API) aims to address the limitations of using the C ABI for cross-language function calls.
  - The current lack of a safe and efficient way to communicate generic types, such as **Option T** or **Result TE**, across language boundaries remains a challenge.

  **Conclusion and Discussion**
  - The video concludes by encouraging viewers to share their thoughts on the future of Rust libraries and the potential for shared objects to dominate the landscape.
  - Viewers are also invited to like, subscribe, and check out another video on a related topic.


created_at: 2024-09-13 23:14:56
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **The RAMBO Attack:**
  - Allows listening to **electrical signals** from **RAM** to **covertly extract data** from a computer.
  - Utilizes electrical signals created by RAM to exfiltrate data from a network without direct access.
  - Developed by **Dr. Mordechai Gury**, a renowned researcher specializing in **air gap** security.

  **Air Gap Research:**
  - Involves networks physically isolated from external connections for enhanced security.
  - Dr. Gury's lab focuses exclusively on finding methods to bypass air gap security.
  - Previous research includes extracting data via **GPU fans** and **SATA cables**.

  **The Attack Methodology:**
  - Requires malware to be installed on an air-gapped workstation.
  - Malware writes to RAM in a specific sequence, generating electrical noise.
  - This noise is then captured and decoded to extract data, achieving a transmission rate of **1000 bits per second**.
  - An **RF modulation scheme** is employed to transmit data, such as an **image**, over the air.

  **Technical Details:**
  - The use of the **Move NTI** (store double word) instruction ensures direct writes to RAM, bypassing CPU cache.
  - By controlling the duration of writing to RAM, the researchers can differentiate between **bits** (ones and zeros).
  - The length of a single bit impacts the transmission speed and error rate.
  - Successful exfiltration of an **RSA private key**, **passwords**, and a **text document** demonstrated.

  **Countermeasures:**
  - Working in a **shielded room** or placing the computer in a **Faraday cage** to block electromagnetic signals.
  - **Internal RAM jamming**: Interfering with memory read-write operations by introducing additional noise.
  - Utilizing a **radio jammer** to create RF noise and mask the RAM signals.

  **Conclusion:**
  - The RAMBO attack highlights an innovative and unconventional approach to data exfiltration.
  - The effectiveness of the attack underscores the importance of shielding or jamming measures to protect sensitive data.


created_at: 2024-09-13 23:31:34
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  - **Video Overview:**
      - The video provides insights into the game Dota 2, with a focus on the player's strategy as a "Smurf" in an in-house league.
      - It offers an educational perspective on the thought process and gameplay decisions made by the player.
  - **Player Introduction:**
      - The player, "PainDota," is an 8K MMR player who got the opportunity to play in an in-house league with an average MMR of 2K-5K.
      - They emphasize the educational aspect of the video, aiming to teach viewers how to carry and win games.
  - **Game Context:**
      - PainDota is playing as a **Faceless Void**, a hero with high base damage and a decent attack animation.
      - The enemy team composition includes **Storm Spirit**, **Anti-Mage**, **Crystal Maiden** (CM), **Tiny**, and **Mirana**.
  - **Early Itemization:**
      - PainDota's starting items include **wraith band components**, **double branches**, **quelling blade**, and **faerie fire**.
      - This build focuses on physical sustenance and provides stats for last-hitting.
      - They forgo purchasing **tangos** as their position five player can provide them.
      - The build is effective against physical damage heroes like Tiny and Mirana.
      - PainDota emphasizes the importance of understanding lane matchups and adjusting itemization accordingly.
  - **Laning Phase:**
      - PainDota focuses on last-hitting and denies, utilizing creep aggro to gain an advantage over the enemy Tiny.
      - They push the lane to secure the **Lotus** and gain an advantage over the enemy.
      - By pulling creeps and using their abilities strategically, they are able to secure kills and gain an early lead.
      - Their mid laner experiences technical difficulties, creating a challenging situation.
  - **Mid-Game:**
      - PainDota continues to farm and push lanes, taking advantage of their strong start.
      - They make strategic decisions based on enemy hero movements and abilities, such as Tiny's lack of blink.
      - The player emphasizes the importance of not showing on the map to create uncertainty for the enemy team.
      - They make judicious use of their ultimate ability, **Chronosphere**, to secure kills and objectives.
  - **Late-Game:**
      - PainDota builds offensive and defensive items, including **Manta**, **Black King Bar** (BKB), and **Butterfly**, to counter the enemy team's strategies.
      - They focus on pushing lanes and making strategic plays, taking advantage of their strong position.
      - However, their team experiences a setback due to a griefing incident, losing their lead and creating a challenging situation.
      - The player adapts by purchasing a **Bloodthorn** to counter the enemy Anti-Mage's strategy.
      - They utilize their abilities and items effectively to secure crucial kills and push for the enemy throne.
  - **Conclusion:**
      - The video offers valuable insights into the decision-making process and strategies employed by a high-level player.
      - PainDota emphasizes the importance of understanding hero matchups, itemization, map awareness, and ability usage to gain an advantage and carry games.
      - They offer coaching services and encourage viewers to subscribe for more educational content.


created_at: 2024-09-14 00:12:38
prompt:
[cell repeats an earlier one in this file: 1835 characters]

summary:
  **The Border Gateway Protocol:**
  - The **White House** unveils a plan to address weaknesses in the **Border Gateway Protocol** (**BGP**), which has been **exploited** and **misconfigured** in the past, causing major **internet disruptions**.
  - Recent incidents include:
    - YouTube outage in 2008 due to a misconfiguration by a Pakistani government official.
    - Amazon Route 53 DNS traffic hijacking in 2018, resulting in financial losses for crypto users.
    - Facebook and Instagram outage in 2021 caused by another misconfiguration.
    - Interception of US internet traffic by China and Russia on multiple occasions.

  **How BGP Works:**
  - The internet consists of multiple **autonomous systems** (AS), such as ISPs, corporations, and government agencies, each with its own network.
  - BGP allows these systems to announce their existence and reachable networks, enabling routers to determine the most **efficient paths** for data transmission.
  - BGP maintains routing tables between ASes, grouping IP addresses into prefixes.
  - For example, Verizon and AT&T routers have their own ASes, with BGP helping find the best routes between them.

  **BGP's Weaknesses:**
  - BGP was designed over **25 years ago** without adequate security measures:
    - It does not verify the **authority** of remote networks announcing traffic path changes.
    - It lacks **authentication** of messages exchanged between networks.
    - It does not check if routing announcements violate **business policies** between networks.
  - This trust-based system is vulnerable to **route leaks**, where attackers can return IP addresses for illegitimate websites, as seen in the Amazon Route 53 attack.

  **The Plan to Fix BGP:**
  - The proposed solution involves using **Resource Public Key Infrastructure** (**RPKI**) to cryptographically sign records associating BGP route announcements with correct originating AS numbers.
  - RPKI prevents accidental or malicious **route hijacking** by verifying the legitimacy of advertised routes.
  - While the **EU** has already implemented RPKI for 70% of BGP routes, the US lags behind at only 39%.

  **The Importance of the Internet:**
  - The internet is a remarkable human creation, despite its flaws.
  - With computer science expertise, we can fix these issues and ensure the internet's longevity.
  - Sponsorship by **Brilliant**, an online learning platform, is mentioned, offering courses in programming and technology to build a strong foundation.

  **Conclusion:**
  - The video concludes by emphasizing the value of the internet and the need for continuous improvement and security.


