Started great. All right. Thank you everybody. Hello.
I'm so glad to hear everybody. I'm going to have to leave
early, of course again. So I'll have to come back and and hear
the rest of it at near the end because I do have a a class to
teach tonight at 10:00 o'clock. But we do have other mentors and
leads that will be helping out.
Tonight we have Lucas Greenwood, Tariq Marji, which I love your
last name, by the way. Tariq. Christopher Shook and Josiah
Sprunger, who will be speaking this evening. So let's start off
with Lucas.
This evening, if you are ready.
Yeah, sorry. I just walked in the door.
Ohh, you want we can jump to somebody else if you're not
ready.
Yeah, maybe I can start.
OK, go right ahead. Go ahead, drink.
Now I can see OK, just let me share my screen.
OK.
How could you see my screen?
Yep.
Yes.
Alright, so and this is a project I'm going to talk about.
One of the penetration testing type called Metasploit Framework
as a team member. My purpose is to to do an ethical hacking
which is which is an unauthorized attempt to gain
unauthorized access to computer system application and data.
That.
The the Red Team is focuses in puzzle solving and detective
work. My goal as a pediatrician to start not to hacking a
machine.
Not to be an evil guy and the bad guy, just look at iteration
testing to help the client to improve their security through
remediation of any weaknesses that I I I discover.
So Metasploit interface I'm going to start with the
interface is a collection of exploits.
And actually it's a collection of exploits.
And as we can see in the screenshot here, it it does have
two more than 2000 exploits.
More than 500 payloads, evasions, axillary encoders post
are not.
Which can be used through a command line included in the
calling Linux.
So this Metasploit is written and Robbie language and has been
in development for many years.
OK. And the middle split use, we can use it, as I said, we can
use it in for good and for evil for good. We can use it for for
identifying the weaknesses, inform the stakeholders
highlights needed changes, protect information and
organization and strengthen the provision for evil. We can
identify the weaknesses and inform the attackers. Actually
instead of the stakeholders, we can't inform the attackers that
we found a vulnerability in the specific target.
There is a specific ports are open, so go go ahead and attack
these things.
And the higher target to exploits compromise information
that we can do ransomware, taking an information and
encrypt them. I'm asking for paying for for this.
Uh and we and we weaknesses the provision.
And.
Uh, little sploit framework capabilities has contents of
intelligence gathering, network scanning, vulnerability
scanning, exploitation and post exploitation. So intelligence
gathering, I mean I what I mean of that, it works together. The
detailed information about the target of this thing and we want
to do it without revealing our our intentions. There are two
types actually there are active and passive active.
You are probing the target by actively interacting with them
to get information. We might have an account on their
website.
Uh, for the purpose of gathering information from the inside.
But the passive intelligence gathering where we are gathering
information without interacting with the target, we might read a
document.
That's.
That's been provided by by the target check public information
sources. Maybe I can use Google search just to gather
information.
Uh, I'm not interacting directly with the target, so this this
this type is called passive. Maybe I can look at the domain
information, use third party scanning service and other
sources of information. All of these ways that can help us to
find a potential. Any potential vulnerability in the target
website.
Second thing, there was a network scanning. This allows to
unify Unilife host inside the network by of course getting you
the IP address and getting the network subnet and getting
getting all the information after the intelligence
gathering.
So I can check for open network ports, network services that's
running on the target system we can use.
Ascended scan TCP scan that that provide 3 way handshake to the
target. We can do UDP scan we we can't find the common at more
interesting UDP ports in use. Also we can use in map which is
included with Metasploit framework.
In my app, by the way, in map is a tool that outside is a if the
Metasploit.
That does a better job and network scanning.
So third thing, vulnerability scanning. Once a target system
is scanned and services have been identified, we can look on
vulnerability scanning technique.
So some scanning technique we can use.
And something we can't use a model such as axillary which can
detect if a specific service doesn't require authentication
acquired user credentials can be tested using several auxiliary
login modules. Exploitation. We can use codes that takes
advantage of a specific vulnerability once the exploit
is successful, then we can use something called payload. The
payload is a code that we can inject it to the target machine.
In order to to do some to gain access to the system or we can.
For example, use.
Uh reverse TCP that we can create a shell through this
code.
And finally, there is a post exploitation. Once the exploit
and payload code are successfully gained access to
the target. Now we're post exploitation activity come into
play. Post exploitation is a tool that automates the
collection of information from the system. Like I can't collect
the credential of the like credential data modification of
the system. I can escalate the privilege through post
exploitation.
So the component of Metasploit, there is a module.
Emergence containers. Connor exploit payloads, some of them
we have talked about actually.
And so everyone depends on the other one. So the first step we
can do scanner, we can scan the the target then exploit the
correct.
Uh, that correct exploitation code? Then we can do the payload
to gain access to the target machine. The margins are the
heart of the matter. Exploit that provide most of the
functionalities include.
Like Scandal network exploit.
Module that exploit the weaknesses of the system payload
that, as I said is inject.
Uh, I thought it was the target system.
Under.
And in most.
And most file system layout and most Metasploit framework we
will find like a directory hierarchy under the Framework
directory we can find in IB Lib which stands for libraries. Here
we can find the internal library libraries that we can exploit
use.
This will be helpful if we write our own scanners exploit
payloads.
Add modules that contains a exhilarate for scanning
encoders, encoders. We can encode the specific payload, for
example 200 times in order to prevent a a Windows Defender to
detect it.
So we can work around in, in quarters, evasion, evasion.
And it's for avoiding a for avoiding the detection from the
antivirus.
Exploits, payload and post exploitation, and we have a
plugins.
Yeah, I'm sorry, the plugins, it's holds the integration code
of the third party tool. So plugins we can use a third party
tool just to to integrate and to integrate code for me to
explore. And we have a script.
We have a very subscription Metasploit database that we can
utilize during testing.
So exploitation.
It's a. As I said, we have more than more than 2000
exploitation. Maybe if you ask me which one we should use.
Actually it depends. We have to have a plan to use which
exploitation to use and we we have to know which platform that
we are attacking. Is it a Windows Machine, Linux, Unix et
cetera. And we have to know which.
Yeah.
Vulnerability which ports are open in the target machine? It
depends on the ports that open that. We can use a specific
exploits and the payload itself.
There are more 2000 exploit model the margins and the the
name convention of the Exploitation. It's we can use
exploit then the platform which is Windows, Unix, Linux service
is at FTP HTTP.
And the name of the exploit. Actually I have listed an
example here. Example is that called exploit.
Well, I'm sorry.
Yeah, here it's exploit windows.
Local token magic. So talking magic is is an exploit that can
give us a privilege escalation that give give us a higher
access to the target machine. For example, if I get an access
to the machine I do have, maybe I do have enough privilege to to
do some task. That's why I'm using this exploit. This one is
giving. It's giving me a high high access. Maybe I can give me
a God the privilege.
I like an administrator on the target machine.
OK. And the payload as I mentioned is a part of the
execution of the target system which used to inject the code
inside the target machine. This code it has a specific functions
like I can play an audio file. I can copy files, I can corrupt
file, destroy files. I we can do many things actually. And and
this payload code.
There was a payload here. The naming convention. It's called
payload platform architecture. Then the name of the payload.
This example payload Windows X64 reverse TCP reverse TCP means
that I'm getting access to the target machine. I'm I'm
expecting the target machine to get back to me in the reverse to
in order to get the shell to know not to get access to the
machine.
So once I have done the scanning exploitation payloads.
Once I've done, you can see here in the screenshot there is a
little printer, so meterpreter once I get a better operator it
means I have fully active.
To the target machine, but actually of course some commands
needs to to hire the to get a higher privilege. So Meterpreter
is a post exploitation tools included with the middle split
framework which uses access to the target machine.
To provide command line interface and the suite of
exploration meterpreter is a payload is a configured along
with the exploit module operate completely in memory. This is a
good thing that.
The the the user or the victim cannot see what I'm doing in his
machine because it's it's doing the work in memory, but some of
course.
Yeah.
Here you have some some activity activities and nobody can be
discovered by the victim, so operates completely in. Nobody
in the target system. Nothing in disk. Once we have a meterpreter
session on a target system then we can run multiple commands. We
can do something called get info to get the information about the
target. What the platform, what the version of operating system,
what the user that's running the.
The user currently logged in.
Chill, mkdir. We kind of create a folder on there. We can do cat
list cat command that can list for example a sensitive data. I
can do something called cat sensitive file. I can see all
the.
The data that within the file execute reboot and can't shut
down some commands together. System details, registry files.
Process information and users account details. I can create a
user in the target machine, examine and terminate specific
process.
Not command to not additional functioning. I can not extra
extension that is going to help my in my my my.
Attacking light attack.
There is a little bit of sploit from work that provide extension
that can help me to do some extra functionality.
And of course, a little brutal method. There are client side.
And we have a server side or client side is established
through forward or reverse connection. We have to have a
session.
So we have to have a sessions that connect to the target in
order to control of the target and have access completely to
the target server side.
Just I need.
All I need from the server side or from the victim machine is
one click.
To the link or when the link to the file so that file is
injected with a payload with exploitation. Actually it's
ready to be clicked.
Uh fight to connect back to us and to provide us a shell for
communication.
Attack methods in active mode. As I said, active mode, we are
interacting directly with the target, so we can do a scan the
target to check any any to scan the target for vulnerabilities
and weaknesses.
By using auxiliary this auxiliary model that help us to
scan the target machine or we can use as I mentioned in map.
And 2nd we can prepare exploit code that will exercise those
vulnerability and weaknesses.
You know the code to get access to the target.
So the fourth thing is a trick. The victim we went to compromise
the user system by directing their client to communicate with
our attack server by, as I mentioned, adverse TCP. Once the
user click it will it will communicate with us back. So we
wait until the client connection is made, then our server will
send exploit code to the vulnerable client.
If the exploit code is successfully, will we will get
better operator actually and our payload is then executed. Maybe
we can. As I mentioned we can use something called phishing
e-mail phishing e-mail just to send it to the target.
And for something that interested the target, maybe I
can do some.
I look for I make. Maybe I can do some some social engineering
that I can check what the target is like. Is he expecting any
reward in his e-mail or anything? Make it maybe I can do
fake advertising. I hacked website or anything with the
link that will entice the user to click.
So I'm going to the demo here.
So this is what I have done actually in my lab what I have
done in here.
The ones that I doubted highlighted in yellow, I have
done MSF venom so MSF venom that this command is a tool to create
a payload we are using to create our own payload. Dash P means
the creator payload.
What the payload type is a Windows Metro reporter reverse
TCP.
So reverse this app, as I mentioned, uh, we need the
client to click with the link or click with the file. Then we'll
get back to us.
In this in this situation, we can create a decision.
Between the target and the victim build host means a local
host, which is my IP address 10.0 to 0.94.
Dash F Dash if means a file type. OK, I'm the file type, it
exceed 5-O. Output it to download tested EXE.
So this command is going again will create a payload reverse
TCP payload that is going to inject it in Excel file.
And will be downloaded in my in my in my file system downloads
this with exit once I press enter, I see the payload size
here 354 byte.
The final size is 73,000 almost.
And it's saved in home. Curly downloads, tested taxi.
So the file is very big because I didn't specify the platform.
Is it windows or anything?
So next I have to start the SQL, the database service possible to
start this one is a little slower is going to use if I want
for example to serve some files or to do some work I have to
start with service particulars before I go.
To uh MSF console.
This actually is not showing here the command but I have done
MSF console then press enter then I'm in now.
Here is the victim machine. The victim machine has a tested
exhi. I I transferred the file.
And the victim has double Click to the machine once the machine
and the victim double click on it.
What then? I used the exploit the multi handler. This multi
handler exploit that can I use for maybe showing in here I can
use for multiple things X64, Windows, Linux.
Then I have a. Once I choose my exploit, I then choose my
payload which is reverse TCP. I said this is the command that
when I went to set the payload sit payload Windows Meterpreter
reverse TCP. I use this payload that the one that I have created
area.
OK. And sit in host to IP other this is my IP address, OK? This
is my attacking machine IP address. Why I'm putting my IP
address to listen to any, to to be listening on the port for,
for, for for which is.
No, the the the default Metasploit port that once the
victim clock click on it, I will he will return back to this IP
address which is my machine attacking machine.
This is, uh, actually this is exploit multi handler. Once I
show options I see the exploit is multi handler. The payload
option that the ones that I have created the end host is my IP
address showing in here in port local port that I'm listening on
Port 4444. I actually this one should be.
Uh change later about the port because the Windows Defender
knows.
What's what's the Windows Defender? See that the victim
machine going back to me on this port. It's going to know that
this port is malicious. Port should be changed later, but
they just just an explanation.
Explored. Not now. I'm everything is really here about
show options. Everything is really here. So I'm going to do
exploit once I do exploit and click double click with the
machine on the file from the victim machine I'm getting
meterpreter. Once I get to the meterpreter.
I uh, I inserted a question mark that what's the matter of Peter
can can can be done in there?
What are you click a question mark and there not showing this
whole things that have 12345 slides that show with that
operator can do.
I can't. I'm sorry. I can do multiple things like I can load
meterpreter extension.
My great.
Maybe it's.
And I can read read some data from the channel.
I can.
Got read the contents of the file of the skin that takes
screenshot. Shut down and I can make a directory.
A lot. A lot of things actually.
Dear download, I can download specific files.
I can escalate the privilege.
OK, execute some commands.
Shut down. Still talking. We are a lot of things. I can't even
start a a wave dot wave.
The audio file from the victim machine.
I can't insert idle time. I I idle time that returns the
number of the 2nd that removed user has been idle for how long
they've been the user is adding. Maybe I can work in the system
while he's not on the keyboard. I can send some key events mouse
screenshots. I can take screenshot a lot of things
actually.
Uh, really bit commands here. I can't do some. I can't do hash
dumb to crack at the password.
At time to stop, I can't eat it. The file date.
Uh, I get system get system. This is a very important command
that I can attempt to elevate a privilege from the local system
and a lot of things actually. But I just give a basic things
what the meterpreter and whatever method split can do.
So I think I've done it from my side. Thank you very much.
Thanks, Tariq.
Thank you.
I do have a couple questions, but I I I'm saving them for the
end.
OK. Yeah, sure, sure. I'm ready. Anytime.
If you stop sharing, OK.
Luciani have a question.
OK, alright and.
See Lucas, Are you ready?
Yeah. Readies I'll ever be.
Alright, take it away.
Heading share your screen. There you go.
Alright, so I should I struggled for a couple weeks trying to
figure out what to do and last week there was a question that
kind of got me thinking and the question was what? What's the
reality of AI soldiers fighting wars?
Umm and I don't. I don't know how. How real that seems, but
the reality of is that I think the future of war is a cyber
war.
Umm.
If not, we're already headed down that path already, so my
presentation is on the reality of a of a cyber war or cyber
warfare going forward.
Umm. So essentially, cyber warfare is the use of computer
technology to disrupt the activities of a state or
organization.
Uh, especially in a deliberate attacking of information systems
for strategic or military purposes.
Umm, so all branches of the military have a growing cyber
warfare field. The Navy Air Force Army. I'm actually in the
army. I don't do cyber warfare right now. I'm a firefighter.
But my plan is to.
Uh, reclass two cyber warfare upon my completion with my
degree and getting some certifications. So I plan on
doing that in the next year.
Umm.
As I mentioned, Army offers AA one Officer focus, which is like
a subject matter expert in the cyber warfare field.
And then just the army alone plans to double the personnel
from 3000 to 6000 for the cybersecurity field and in the
next fiscal year, with a requested budget under just
under 17 billion for the funding of a for the cyber program. If
we had that on the civilian side, I think we could get a lot
of stuff done a little more efficiently if we if we could
have a budget like that at any place that we work at.
Umm so like some some incidents that occurred with cyber in this
in the cyber the the first reported incident was just stuck
Stuxnet for those that aren't familiar with Stuxnet, it was
actually.
Uh.
Believed to be developed by the US.
Umm. And it targeted the Iran.
Nuclear program and started shutting down.
UM's nuclear facilities over there, it would target their
computer systems, and they would.
Hit the hit the computer systems and it wouldn't throw any alarms
or anything, so everybody thought it was fine, but it
would start spinning the center future so fast that it would
automatically.
Uh start to throw everything off, and then it grew into
multiple industries, pipelines, uh, electrical planes.
Everything else.
Umm. And then other other various attacks have happened
throughout the course of the last 10-11 years, with the most
recent one of with just August 1st, where Russian hacker.
A group attacking it targeted Lockheed Martin.
For the.
The high margin missiles and throwing off the GPS systems.
That Lockheed Martin has been supplying to Ukraine to uh.
To disrupt everything.
Umm.
So as you can see with this one, the attacks on on just the US
government from for over the course of 12 years, it peaked in
2015 with just over 77,000 attacks on the government alone.
2018 was just a little over 33,000. I couldn't really find
any numbers over the last few years but.
Uh, you know, I'm. I'm sure that those numbers have stayed pretty
consistent. Uh, you know, you know 33,000 tax.
You know, that's roughly 100 taxes a day, which is pretty,
pretty substantial.
Umm.
And then just just some random facts about the about the type
of warfare, uh, the cyber, cyber war. So 26 a little over 26% of
all attacks are directed towards the US.
Umm with 20% of global organizations believe cyber
espionage is the number one threat, so there's definitely a
demand for cybersecurity out there and keeping everything
secure.
35% are all politically motivated cyber attacks of are
coming from China or Russia.
Umm, I think we've known for a while that those are probably
our biggest enemies that are after us the most.
And then 11% of all cyber attacks are SP manage related.
So they're they're after some kind of.
Secret.
Information that that we have known what our next move is,
where we're going, uh, in very stuff like that.
Uh short, sweet to the point that that's that's. That's all I
have.
All right, thanks. I was just writing down my questions for
you.
Umm. Let's see. Let's get this moving. And Christopher, Are you
ready?
I'm ready. Yep. Yep, absolutely.
Alright.
Take her away. And thanks, Lucas. That was awesome. I liked
Alright.
Yes, good job Lucas.
it.
The thank you.
Ohh come on.
I got a grant Chrome access to my browser. Sorry bear with me
here.
Ohh.
I thought I had this enabled. I've used team several times
before, but apparently.
Give me one second here.
No problem, it happens.
Just on a a separate note, I I just love hearing how everyone
here just about everyone is connected to the military in
some way. That's just awesome.
He GI Purdue global.
Really pushes.
Marine.
And their families, I I got to a.
Take part in the benefits of being the wife of a marine, so
that that was awesome when I was going to school.
My husband's Navy and he got his degree at Puerto Rico, an
associate and then bachelor. And then I obviously got to.
To get some of the that benefit as well.
Right, right. And you know, usually as the wife or a spouse
of a military person, you know, get their benefits. So that was
awesome. When I learned that Purdue does offer that.
Bristol.
Where did you want Josiah to do his presentation? While you're
trying to?
Get your computer to work.
They've stepped away.
Josiah, do you? Did you wanna do your presentation?
Yeah, I can have customers.
OK.
OK, for a second, alright, one second here.
All right.
Ohh boy am I embarrassed. Sorry guys.
If somebody else is presenting, that's fine. I I'm so sorry. I'm
back.
Go for it. You're good.
OK, alright, sorry about that. Yeah, I had to access let Chrome
have access to my desktop and then it just.
It just kicked me off, so I apologize sincerely.
So.
OK. OK. Can you guys see my my?
Yep.
This screen.
Awesome. In the beginning in this internship I didn't have
much experience with the command line, so you know, obviously our
suite of hacking tools, you know, we would use the command
line for IMAP, Metasploit, running those services like
that. So using a Mac, I would just use the attack box on try
hack me, which is really what kind of is.
They created, you know, trying to find, you know, something
that would work on my computer, the terminal for Mac. I wasn't
getting having any success running those programs, so I did
some research and there is a package installer called Home
Brew that I have installed on my my Mac currently. And what home
room home Brew does is it allows you to.
You can go and search for the services that you need to
install on your on your computer, which if it'll switch
here. So for example the what really started the use for
wanting to use something outside of the attack box that is.
Whenever I would try to use the hash ID to determine what type
of hash it was, for whatever reason in the in the attack box,
I couldn't get it to label if it was SHA 256 or you know whatever
hash it was. So what I would do is I would come to home brew and
then I don't think it had a hash ID. I think I had it, but let's
see what did I need. Well, for example, if you needed to.
Install in map it would.
If you basically what you would need to type in to get installed
in map on your terminal. So what I used at mainly for would be
for to. Let's see.
For example.
If I needed to determine the hash type of.
Doing this is a hash that I have stored on here somewhere. Let's
see.
OK.
So then it would return, you know, so it's SHA one. OK. So
then in try hack me you would have to.
Umm. Then crack that hash.
So there we go, OK.
So bear with me here while I use the red terminal here.
That's.
OK. And then I'm going to use John the Ripper to crack this
hash here.
Ohh boy, terrible demo. I think I've already cracked it so it
should have it stored somewhere in here.
OK, the terrible demo, but yeah, yeah, I would use home brew for
example if I wanted to download.
Uh Metasploit, for example. It would be brew install
Metasploit.
And then from there it would fetch that that resource and
then install it onto my MacBook, which then would allow me to use
outside of the attack machine, which you know is great and all,
but I wanted to have that more in-depth use of of the command
line in the terminal.
Umm, but yeah, mines pretty short and sweet too. So yeah,
I've gotten more versed with the command line before I started
the internship to where I am now, so that's really that's the
length of my presentation there. Thank you.
Thanks, Christopher. Yeah, I've used home brew in the past and
as a Windows user it didn't work so well. That was a big
confused.
What?
Looks like we got a question.
Yeah, it's. Yeah, it's been. Yeah, it's been very
resourceful. I I love it.
Yeah, I I wish they had something like that for Windows.
Fleece it. Felicia, did you have a question?
At no.
I don't think so, but it's great for the home brew.
I just saw your hand come up. Alright, Josiah.
OK. And am I the last one to go tonight?
Take her away.
Yes you are.
OK.
Again, OK. Can everyone see my screen?
Yep.
OK.
So tonight I will be discussing data oriented design. We will be
talking about what it is, when to use it and why it is
beneficial.
My goal is to provide information on a topic that I
discovered recently and I have found to be interesting.
Umm.
So to understand data oriented design, we need to 1st
understand what that means. Data oriented design is structured
around.
Data oriented programming.
That oriented programming is one of many programming paradigms I
programming paradigm is a style or method of programming.
So for example, functional programming, procedural
programming, object oriented and data oriented are a few of the
different programming paradigms. Functional is programming with
functions that avoid any global state. Procedural is imperative
programming with procedure calls.
Object orienting oriented is programming by defining objects
that send messages to each other and that oriented is programming
focused on decreasing the complexity of data by using
generic immutable data structures.
So programming paradigms are not meant to be mutually exclusive.
Normally multiple are used together.
There are many more paradigms than these four, but the two
that we are gonna focus on are object oriented and data
oriented.
So let's take a closer look at object oriented programming and
that oriented programming.
Object oriented programming, as its name states, is focused on
objects and classes.
Objects are defined with specific functions and
attributes.
The objects are defined as classes and are able to be
reused throughout the program. This makes it easy to reuse
written code.
However, data within one object is restricted to that object and
must be inherited to be used in a different one.
This paradigm mirrors real world objects, which makes it easier
to understand how attributes and functions should be created.
Data oriented programming varies due to the fact that it focuses
on separating data from behavioral code. It uses
immutable generic data structures. This means that
instead of being objects, everything is represented as
data that can be acted upon.
This eliminates the need for inheritance.
In that oriented programming functions are general purpose
and can be applied to large chunks of data and the main
reason for the change is how the data is used and how it's stored
in memory.
Now we have a better understanding of the two
paradigms. Let's start to look at how they influence design.
Object Oriented design is focused on the creation of the
classes and the objects as it's used in programming. How can
each object utilized attributes and the functions in relation
with other objects to complete the program?
And the diagram shown on the right, the cat class has methods
and variables exclusive to its object.
Cat could take inheritance from a bigger class called Animal and
what could have other child classes such as dog or turtle,
while those other objects may share inherited attributes from
animal, they cannot directly access cats, private attributes
or methods.
Umm, so object oriented design examines how those interactions
between objects occur.
That were into design focuses on the data rather than on the
relationships between the objects. This approach focuses
design around large sets of data and the functions that are used
to transform that data.
The data structures are set up generically so they can be
reused. The main purpose of this design strategy is to eliminate
unnecessary memory usage.
To improve optimization, it does this by optimizing the data
transformation as the most important piece in designing the
program.
We can see that the function feed is separated from each
individual data, dog, cat and turtle, but it can act upon them
separately.
So let's look at a comparison between these two paradigms. As
we have talked about, data oriented is focused around data,
whereas object oriented is focused around individual
objects.
Since the data is separated from the functions, data oriented
programming is able to scale very easily. Having generic data
structures that can be function upon makes adding and
transforming that data much easier.
Object Oriented programming is scalable but does require more
work to create the relationships around those new objects.
The main goal of focusing on data first is to receive better
performance and optimization.
Object oriented programming can be optimized also, but it can be
more challenging due to the focus on the relations between
the objects rather than the specific data within those
objects.
This diagram shows the difference in relationships in
object oriented and data oriented design structures.
Functions must be passed from object to object to interact
with each other's data and object oriented programming.
Whereas in design data oriented design.
Functions have a direct relationship with the data.
So what's what's the benefits of using data oriented design?
Umm, we look at some performance benefits here. I know this chart
isn't super clear.
Umm, but that's unfortunately the the picture I could find,
but I did some research and found an experiment that was
performed specifically to test the functionality of data
oriented design and object oriented design. The experiment
was simulating a specific number of cars being processed by data
oriented design and object oriented design coded programs.
The left of the chart shows the time that it took to process
those simulations.
And the bottom shows the number of cars that were simulated.
So there are four different methods that were used to get.
And the results? They were pretty technical and I wasn't
able to fully understand what was occurring in the process.
The person that performed the test had a blog post about his
entire process and his conclusions, and I have included
a link at the end of my presentation if anyone wants to
take a closer look at that.
I just wanted to show how the performance differs between each
method.
The green is the.
Data oriented design method and the other three are a variety of
ways using object oriented design. Each time we can see
that the data oriented design method processed significantly
faster than the others.
The main point of showing this is to show how data oriented
design optimizes performance, especially as the quantities of
data being worked with are increased.
So you can see that, uh, on the left, 256 cars were simulated
and the data oriented design almost cut the time in half of
all the object oriented design.
Uh programs and it just kind of continues that trend all the way
up until 2004, 2048, cars were simulated.
So let's talk about data oriented design and video games.
Well sparked my interest in researching data oriented design
was its use in video games.
Video games originally got me into programming and are still
something I am passionate about working on.
That data oriented method is something that has been used in
AAA game industry titles for a while is because early game
console hardware was very limited in its processing power
and memory.
The the processing power and memory of those early consoles
would have been fine for performing most most
applications, but because games require a lot of computer
resources to be played.
It just wasn't enough, and a 3D game. Every element is rendered
out in individual polygons.
That can contain thousands of vertices.
The thousands of individual points per object add up very
quickly, as we saw in the previous slide. Data oriented
designs performance has a large advantage over the standard
object oriented design method.
Uh, think of what data we're into. Design could do for an
application that is processing data from a data warehouse.
Where millions of calculations and operations need to be
performed per second, optimizing performance for hardware is
really one of the main goals of data oriented design.
One thing that really made it stand out for me was when a
friend of mine showed me an example where he rendered out
1,000,000 squares.
Which you can see on the right there.
He was using the Unity game engine and it was still able to
run at 13 frames per second.
Uh, which is pretty slow, uh, and would be almost unplayable
for a game, but is far better than a standard object oriented
design method would do.
So he was using unity and Unity has been developing a data
oriented design focused tech stack is known as dots.
Umm, so we're going to take a closer look at dots and.
Kind of see how.
It works.
And how it can be implemented so there are four main elements of
the data oriented text stack?
They are the entity component system that burst compiler. The
C# job system and native containers.
They call the the three main pillars of dots. They are the
the ECS and the burst compiler, and the job system. Together
they combined to form the foundation of.
Unities way of delivering performance data oriented
solutions.
So the main pillar is the entity component system. This is a
framework that provides data oriented coding in unity. It
shifts the way that game objects are thought about from being the
object oriented containing functions and variables to using
using the data oriented method where it separates the functions
and behaviors away from the data itself.
You can see here that the entities point to the components
which hold the data.
There and then the systems which are the functions and the
behaviors are used then to transform the data and perform
actions on them.
ECS also allows for data to be arranged to reduce cache misses
by the CPU at cache miss is a failed attempt to read or write
a piece of data to the cache. This leads to increase in memory
access time and slowing down performance.
Using the ECS, developers can also define how data is
organized in memory.
Allowing for quicker access to adjacent data.
The other two pillars, which are the C# job system and the burst
compiler, are packages developed by Unity to make it easier to
increase performance along with using the ECS, the job system
adds a simple way to generate multithreaded code, while the
burst compiler is able to generate fast and optimized
native code for the engine. Both are really easy to set up and
use, and then the native containers are just an easy way
to control the memory.
That is used in the ECS data structures.
Every part of Unity's data oriented technology stack is
designed to optimize performance through the use of a data
oriented approach. This shifts from the previous ways of
developing games that were poorly optimized to focusing on
having a good performance by default, and it provides a
bright future for the state of games.
Especially for indie game developers that use free engines
like unity and don't have the resources or manpower that
larger game development companies might have.
So what does this mean for the future of software? I think that
more programs are gonna start being developed with a data
oriented approach.
I also think that better integration between object
oriented and data oriented program will occur.
Uh, I think that the two could work together well.
I also think that there will be an increase in optimization
across all software and programs. This is because
hardware optimization and the increase in performance is
starting to slow down. So I think that.
The main boost in performance is gonna come from the way that
things are coded.
And lastly, I think that there is going to be some new coding
languages that might start popping up in the near future
that have a heavier focus on data oriented design over object
oriented programming languages like C or Java.
Lastly, I do have some resources that I researched and found for
this presentation. If you are interested, you can send me a
message and I can send you the links to those.
Umm my references.
It's not going to click on that.
Uh references for things and then does anyone have any
questions?
I did. I wrote down a question.
I have.
Umm, so it reminds me a lot of databases.
Is that what it is? It's it's databases.
Umm it?
It's a focus on data itself, so the data could be coming from a
OK.
database or it could be.
Any kind of data stored within the program itself, but I could
see a pretty large use from databases like I said from large
OK.
amounts of information.
I'm being transferred into the programs.
So is object oriented data versus.
Umm, the other one kind of like sequel versus no sequel or.
So.
They're kind of the same the way that the the data is, it's just
that the data oriented design is.
Umm.
Prioritizing.
Umm, the data over the functions and the data together. I guess
if that makes sense.
So it's really trying to find a way to optimize how the program
works with the data.
Uh, rather than creating the objects themselves with the
functions and attributes and variables combined?
Alright.
From my understanding, I haven't done a whole lot of research.
This is a.
Pretty new to me still so trying to figure it out.
Right. And and I got and I got a project for you in mind with
with databases so.
We'll get it. We'll get together about that later.
Umm.
Do you know any language that is data oriented? Lucian asks.
I do not. No, I do know that I'm so even though languages like C#
or Java or C++ aren't necessarily data oriented, that
there are still ways to use them like that.
I know C++ is a big one.
That has been kind of growing that data oriented focus.
Hi this is a great presentation. This is doctor Chicone Josiah.
I think I I think.
I.
To help with answering the last question, this is about design
so.
If you just take kind of, you can take a function oriented
type programming language, but you're going to focus on the
data when you're designing your software. Keeping in mind that
performance is important, so I don't know that. I mean, there
may be some languages that'll come out to make things kind of
easier like unity, because unity kind of thinks that way.
Data oriented, but I I I have a feeling it's it's going to be
more.
Where you can use some of the existing languages.
And it it's more about.
Changing your thinking to be data focused.
If that makes sense, I mean, that's what I think. I haven't
Yeah.
done any research either, but yeah.
No, I.
I agree. Yeah, I think. Uh, I think you're exactly right. I
think that's the main focus. I don't know if I just said maybe
in the future there will be some that make it a little bit easier
to do that. But I think it is more of a.
Right.
Thought process on how you do things.
Right.
Yeah. And I mean, you could take a language like C, which is a
function oriented programming language and you can design it
with a, you know, a data focused mindset.
Even with, you know, even with the object oriented programming
language, you know the idea with object oriented programming.
When it came about was to keep.
Umm, you know your data and the functions and all of that
together, you know, and look at it as one object now with with
this kind of design. Now you're taking it apart again.
Umm, back to more of a function oriented. I mean you can a data
oriented design by using a functional programming language
if that makes sense, but it's it's very very interesting.
Yeah, I agree.
Looks like Frank had a question comment.
1st I'll I thought that was a great presentation. My question
is, is data oriented programming more of a linear approach versus
you know object oriented program can be like sometimes all over
the place.
Umm.
I don't know specifically I think.
I haven't done any data oriented programming, so I don't know for
sure. I think it.
Could be similar. I know that. Umm.
The focus is on setting up the the data structures to be used
previously, so I know like.
Umm, I don't know if this is exactly what you're saying, but
if I'm coding in an object oriented programming language or
doing object oriented design, I kind of just start creating
objects.
Like 1 here one there whereas I think in data oriented design
you kind of wanna have an idea of all the data that you're
gonna be using.
Beforehand I don't know if that kind of answers your question.
So that might be something to look into if it's linear or not.
Frank define what you mean by linear.
Uh, cause one of the slides that he posted up was with the car
simulation was that when it was a data oriented programming it
said that it was focusing more so on arrays.
So.
I was just wondering, like is it more of a linear approach versus
you know object oriented programming where you know you
have your classes at different functionalities of each object.
Right.
That's why I was like is it more of a linear approach versus?
Ohh P and then.
Think about it. Yeah. Think about it like this.
So that's what.
Umm.
You know when you're designing software, typically you're
manipulating data.
Right. And and and so you have to think about the best data
Mm-hmm.
structures to use, whether that's a list, a queue, a stack,
a set.
Umm, you know it it it doesn't matter. You'll choose your data
structures for maximum performance when it comes to
space and time. Like the whole big O notation it it it it's
just more of a focus on data rather you know you you're not
going to encapsulate it together with its functionality, but
you're going to think about the data 1st and optimize that then.
Implement the functionality. Obviously that you're gonna use,
you know.
That uses that data.
So it's all about, I think data structures and the way you know
when you does think about like if you design A database and you
normalize it to the best of your ability, it's almost like the
same way since the same thing.
Umm, but you're not thinking database, you're just thinking
of the data and and how that data should be organized. How
that data should be manipulated.
I don't know if that helped any, but.
No, I I I got it, but thank you.
And and that's scenario with that graph.
The the person who ran the the test.
He set them all up differently, so specifically for that data
oriented design approach, he decided to use an array, I don't
know.
What his thoughts behind doing that over the other methods for
the object oriented approach, but I don't think that that was
exclusive to just being data oriented.
You know, but also a great presentation.
Yep, Yep, you know.
Thank you.
Good job.
Good job. Does anybody else have questions or comments? I I I do,
I agree. Good job.
but I'll. I'll wait.
Do them after.
Right, Tariq?
You mentioned that end map is better. Can you tell me how it's
better?
What? What it does better than the Metasploit?
I think he actually slipped out already at 10:05.
Oh man.
I had some good questions for him. OK. So Lucas?
Yes, ma'am.
So I've heard that old tech is hard to hack.
So with that in mind, how hard would it be?
To target North Korea.
Do you think do you think North Korea still is on old tech?
I would think so. I mean they're pretty isolated, although they
do have like Russia's.
I think they're very high. They're. I think they're very
Allies.
high tech.
Oh really?
Yeah.
I I think no. I I see North Korea is being a country that
kind of stays under the radar cause.
No.
China and Russia, you know, are the forefront and and and North
Korea just kind of sitting in the back. I mean, look, look,
look at the issues we had with with their nuclear weapons and
stuff. So they're they're obviously has some kind of
technology and advancements going. We just may not know
about them.
Right.
Ohh, I see. Yep, that makes sense.
An armies armies of North Korean. I mean getting trained
on offensive, you know, cybersecurity type things. I
have a question for Lucas too. Do you mind, Angela?
No, not at all.
So do you think?
Uh, we created.
That not.
So it's it's it's interesting because the class I had just
Yeah, yeah.
before this was a cybersecurity policy class and they just
Umm.
happened to show a clip about the set necks. And in that clip,
it said that nobody's.
Claimed it or nobody's come forward about who really created
it, but in another class.
They talked about how the US and like.
Other Middle Eastern countries collaborated to target Iran
originally.
Yeah, I I don't think.
We're ever going to know for sure.
I don't. I don't. I don't think we will. I mean, there's
probably a lot of stuff we will never know for sure, right? But
I think there's a strong suspicion and I don't think it
it be surprised if if we did it.
Right.
I agree. I mean, I I personally think we did. And I I think like
you do, perhaps other countries were involved with the United
States.
Creating.
Stuff like that.
I'm sure there's many more out there too.
Oh yeah.
Hmm.
That's interesting. It's scary, though. I would. I would have
thought that more than 20% of global governments would
consider.
Umm, cyber espionage, their number one threat that was kind
of shocking to me that only 20%.
Yeah.
I don't know 20%, I mean that's that's a lot of companies though
too out there, right of of global.
Umm.
You know.
I guess how many? How many companies out there really have
that big a secrets that people want?
Umm.
Other than like the the the government side of stuff.
I guess I guess the biggest stuff people would be active be
like the technology firms, right, because that's that's one
of the biggest industries out there right now. Apple, Google,
you know, Samsung, all all that stuff.
Uh, for for the espionage. And you know what's the what's the
next big product or what's the big next technology coming out?
Right. And banking would probably be big too.
Very true.
Alright. Does anybody else have questions for Lucas?
I was going to ask Christopher.
So with homebrew, is it kind of like node JS cause no JS?
I can't remember what.
And I was going to say but but is it like no JS where it it
kind of has a?
Library of things to pull from.
Happy my assumption.
Ohh, it's Christopher going too.
Well, OK then.
If nobody has any questions for desire or Lucas, I can close the
meeting out.
No. Alright. Well thanks everyone for coming and thanks
to Tariq.
Lucas, Christopher, and Josiah. For their presentations, you
guys did a very good job.
And next week we have Brett, Shane, Steven and Nick coming up
and I did wanna make a note that if.
You are graduating with the graduating class of October 11th
and you need to get in on the October 6th or September 29th
classes to get your master class done.
Go ahead and shoot, Marjorie. A message. I think you can sign
up, but in case you can't, in case it says that all the slots
are full.
Cute Marjorie and message and she can get to put on the
calendar.
Those. Thank you everyone for coming and have a good night and
great job again everybody. I I really enjoyed the
presentations.
You have a good night.