start	end	text
14120	17000	Hey, thanks again for joining us here in the AppSec Village.
17000	21220	Good morning, good evening, good afternoon, or good night, depending on where you're at in the world.
21220	25180	Kind of a little hard to tell right now since we're not all in one big room together.
25180	28220	But, I've got another exciting talk for you.
28380	33020	The next talk in our agenda is going to be API and Security Top 10.
33080	35600	A guided tour to the wild, wild world.
35600	39860	We've got two speakers this time. We've got David Sopas and Paulo Silva.
39860	45560	David leads a team of security researchers at Checkmarks and is a co-founder of Char49.
45660	49520	With more than 15 years of experience in pin testing and vulnerability research,
49520	54700	he has been acknowledged by companies like Google, Yahoo, eBay, and Microsoft.
54860	57940	After retiring from his bug bounty hunting career,
58400	63480	David now focuses on the Internet of Things security and tries to learn new things each and every day.
64100	68580	Paulo, since his first OWASP local event back in 2010,
68580	72760	has been active in the community, contributing to several OWASP projects.
72760	76060	With over 15 years of professional experience as a software developer,
76060	79620	he is now focused on ethical hacking and security research
79620	84540	with regular collaborations with companies like Char49 and Checkmarks.
84540	90930	He's interested in programming languages, DevSecOps, and web mobile secure coding practices.
91180	94620	Please welcome David and Paulo.
96060	100460	Hello everyone and welcome to the API and Security Top 10,
100460	103480	the guided tour to the wild wild world.
103580	110360	Before we start, I would like to thank and appreciate the opportunity to be at DEF CON,
110360	112920	even if it's in safe mode,
112920	118320	and AppSecVillage for approving our research.
118320	119860	So, thank you.
120160	122000	Let's start.
122000	125700	Well, I will start by presenting who we are,
125700	131960	with a brief description of what APIs are,
131960	135320	the importance in today's software,
135320	138620	the differences from traditional apps.
138620	143340	Then we went through the OWASP API Security Top 10,
143340	147960	talked a little bit about the project and our contribution to that project,
147960	152220	and then guns blazing on the API's wild wild world,
152220	156940	where we show real vulnerabilities on modern web applications
156940	160160	and describe a little bit about our findings.
161740	163300	Who we are.
163300	165280	Well, my name is David Sopas.
165280	169360	I work for Checkmarks since February 16.
169780	176820	I'm currently the security team leader of a very talented group of researchers.
176820	183000	I'm chief operating officer and co-founder of Shard49.
183000	188240	I was a bug bounty hunter a few times ago.
188860	197040	I have around 15 years in penetration testing and security research.
197600	202220	Nowadays, I'm playing more with breaking IoT devices,
202220	206280	specifically using BLE technology,
206280	211740	and focusing on modern web applications, of course, and API.
212540	216460	Some of my work you can already see on TechCrunch,
216460	219880	The Register, Security Week, and ThreatPost.
220100	224300	Sorry about the photo, but I used the pandemic filter.
224840	231200	It was during the quarantine in Portugal, so that's it.
231200	233700	I think it was very appropriate to this event.
233700	234920	Moving on to Paulo.
235620	237440	Hello, and thanks for watching.
237440	241380	My name is Paulo Silva, and it's a great pleasure to be presenting at DEF CON,
241380	243520	especially together with my friend David.
243820	246580	I used to define myself as a freedom enthusiast,
246580	250220	since I love everything related to free and open-source software,
250220	254700	World Wide Web, or cross-countering and bikepacking.
254860	257900	I have more than 15 years as a software developer,
257900	261740	so I know what is plenty of time to have done all sorts of mistakes.
262100	265320	Right now, I do ethical hacking and security research,
265320	268860	and since 2010, I'm a regular OWASP volunteer.
270520	275320	Currently, I'm the OWASP Go Secure Coding Practices project co-leader,
275320	279820	and main collaborator on OWASP API security project.
280000	285040	Meanwhile, I'm used to fill the gap and deliver security awareness sessions in academia.
286800	291040	Before continuing, the mandatory disclaimer.
291040	293940	Hacking systems without permission is crime,
293940	299320	and we are not responsible for misuse of any information we are about to disclose.
300220	303340	Let's talk a bit about APIs.
303700	309420	I like to look for definitions in the dictionary, because words matter.
309420	316040	Nevertheless, I'm not expecting to find a definition for API in the dictionary.
316600	323680	But something interesting about interface, defined as a common boundary of two bodies.
323680	326360	In fact, you can think about APIs this way,
326620	331260	a common language that connected things talk in order to get work done.
333060	336480	APIs have a central role in today's software.
336480	341200	They are the common ground among several types of devices and applications.
341200	347840	A generic language that all them know how to talk, to exchange data and execute functions.
348280	352600	This is different from traditional web applications in many ways.
352600	358400	Before, we had web servers playing this central role, doing the heavy work.
358400	364280	Answering client requests, gathering data from databases and other web services,
364280	370640	gluing everything together, computing the final HTML and returning it back to the client to be rendered.
372040	376080	Nowadays, there are several types of clients behind web browsers.
376080	382240	We have smart bulbs, wearables, cars, surveillance cameras, etc, etc, etc.
382400	392100	All these clients use APIs to make their capabilities available to other clients and to communicate with each other.
392100	395480	Clients are now more powerful than they were before.
395480	401100	In modern web applications, there is a clear separation between front-end and back-end.
401100	408100	The front-end nowadays is a bunch of JavaScript and CSS providing rich user interfaces to collect data,
408640	417080	send the data to several APIs, making it generally available to all clients regardless their type.
417080	427900	I think this is pretty much about APIs and we should move on to the OWASP API top 10 with David.
427900	431420	So, OWASP API security top 10.
432360	443280	You may have already heard about OWASP. In its own words, it is a non-profit foundation that works to improve the security of software.
443280	448960	OWASP top 10 is one of the flagship projects and most of you should already know it already.
448960	458040	It has played an enormous role to bring security awareness into organizations, both to management and dev teams.
458040	463260	But we have seen very specific API related issues popping up.
463260	475080	We should learn from past mistakes and R. Zialon and Inon Skedi decided to start the OWASP API security project to address API specific issues.
475080	484400	The document follows the same approach and popular OWASP top 10 for readability purposes, but it's 100% API oriented.
485980	487840	Our contribute.
488120	498520	Vendors have been doing business as usual and there is no API specific data for a public call for data like other OWASP projects.
498520	500320	So we had to research.
500320	514040	There are several bug bounty programs that released full disclosure write-ups and we went there and even on some public information that we got hands-on,
514040	519060	but we had to review it and pick only the API related issues.
519060	526740	So while reviewing the reports and the write-ups, we start standardizing the categorization and grouping things together.
526740	532680	After a few months, we were able to compute a statistical top 10.
532680	540620	Security risk, of course, was using the OWASP risk rating methodology.
540660	551560	We drafted the first OWASP API security top 10 and asked several entities, organizations and individuals with relevant AppSec experience in the API field,
551560	554020	at least to get us some feedback.
554020	565280	The draft was published on GitHub and during the several months we worked with AppSec community to get some feedback and change a little things.
565280	572960	By the end of 2019, the final version was published and we were very happy with it.
572960	580480	Then we went wild to validate how accurate the OWASP API security top 10 2019 was.
580480	586620	I hope you can have the opportunity to download it and see it.
587880	590560	APIs in the wild, wild world.
591220	592360	Our research.
593960	603440	Our focus was only on high-profile web applications and, of course, focusing on the API.
603440	612680	We want to map all the vulnerabilities that we found on the OWASP top 10 2019.
613260	622540	So, you may ask what was our biggest problem, if I can say that.
623220	633380	And, yeah, it was the responsible disclosure because many companies didn't reply or just didn't care about security.
633380	639680	That was the most challenging issue that we encountered.
640340	644900	On our research, we tested 8 APIs.
644900	654980	We discovered 28 API issues that we categorized as you can see on the right table.
654980	661880	We got a minimum CVSS 2.7 and a 7.7 max.
662880	667380	We found 7 broken user authentication.
667520	680220	With 5 issues, we have broken object level authorization or BOLA and also with 5 excessive data exposure.
680480	683660	Security misconfiguration was 4.
683660	686780	Broken function level authorization, 3.
686780	691240	And also with 3, lack of resources and rate limiting, 3.
691240	696380	Finishing with 1 result on injection, not so common anymore.
698180	701440	Findings. Moving on to Paolo.
705440	709620	Okay, let's start with the broken object level authorization.
709620	714360	You may know this by IDOR or Insecure Direct Object Reference.
714360	721880	But while writing OWASP API security top 10, we decided to rename it since IDOR is not a very accurate name.
722640	729940	In this case, we found 2 exposed APIs, a GraphQL and a REST one.
729940	733780	Both vulnerable to broken object level authorization.
734660	742080	As you may know, GraphQL is not like REST and you should ask for what you need and you will get exactly that.
742080	744180	Nothing more, nothing less.
744280	750160	This is valid for resources like profile but also to their fields.
750160	754560	Of course, we can try to guess everything or use word lists.
754560	764480	But it becomes even more interesting if you find another vulnerability like a security misconfiguration allowing you to query that information.
764560	772200	More details about the security misconfiguration specific to GraphQL and its specific section.
772200	776840	You just have to wait a few more issues and we will get there.
777500	781400	By now, let's focus on the requests on the left side.
781400	786120	We are looking for a specific profile based on its slug.
786120	792110	The slug is public information since it's part of the user's public URL.
792380	795920	On the right side, we have the API response.
795920	807200	We can see user's public URL, the slug and also something that points the profile to be private.
807200	810420	But nowadays, we never know what private means.
810520	820000	We have several other properties but there's another one, the ID, which we will use with the REST API.
821000	833400	We took the ID property we got from the GraphQL API and we used it to request a user on the REST API.
833400	842040	We got additional information including billing information with full address and tax ID number.
842640	849020	At least this time, API doesn't say that the user resource is private.
849020	855640	But note that both requests were anonymous. There was no authentication nor authorization.
856040	861460	I think this was a good warm-up. We can continue with David.
863740	868520	Broken user authentication. In this case, SoundCloud.
868520	873920	Our final objective was to get account takeover and we did it.
873920	883600	On SoundCloud, which is already disclosed this issue, I can give you a brief description of what we did.
883600	892760	On user account lockout, based on failed login attempt, is something that we don't see often.
892760	900540	In this case, the API was rate-limited.
900540	905040	So, nevertheless, it was possible to bypass and we will show you how.
905540	911120	So, chaining the rate-limited bypass with the user enumeration issue that we found,
911120	915860	we were able to accomplish the account takeover via credential stuffing attack.
917700	925200	This is a typical user enumeration scenario where we abuse the recover password mechanism.
925200	934100	We have a binary feedback depending either the provided email belongs to a user account or not, as you can see on the perp screenshot.
936100	941940	Rate-limiting bypass was something fun, because at least it was the first time we saw it.
941940	947760	It was based on the user agent, the device ID and the signature.
947760	952220	So, both device ID and signature was computed client-side.
952520	962240	Instead of reversing the JavaScript logic, we gathered three different combinations to be randomly picked by our brute-force script.
962240	971540	After a first fixed attempt, we will also use different EIPs by using Tor, forcing different as-it-nodes.
972000	978780	Rate-limiting is very important, of course, and it should be very restrictive for authentication endpoints,
978780	984020	but it can also not be enough to prevent what the user account lockout does,
984020	988480	which should be implemented both authentication and rate-limited.
989420	996620	So, this is the example that we did with a single-threaded POC running in an ordinary laptop.
996620	1005180	For sure, if we use concurrency or parallelism and cloud-based approach, we have done it much faster, for sure.
1006980	1016600	So, in the end, this is the access token we can have and the account takeover is completed to follow.
1023290	1026750	Let's talk about excessive data exposure.
1026770	1030670	This is probably one of my favorite findings.
1031570	1035930	We started with the user enumeration issue on the recovery password mechanism
1035930	1042190	and later a security misconfiguration allowing us to leverage the attack.
1042590	1047490	The recovery password required the user to provide its email address on the front-end,
1047490	1057130	which then issues an API request to retrieve a list of available delivery channels, either email or phone.
1057130	1065850	The user can pick one on the front-end and then a one-time password is delivered so that it can recover his password.
1065850	1075270	In this workflow, we noticed that a URL, including a JSON web token, were provided for each delivery method.
1075270	1080410	So, we took the phone URL and decoded the JSON web token.
1080830	1090450	Then we found that the actual user phone number is included in the JSON web token payload section,
1090450	1094470	meaning that we can exchange user emails by phone numbers.
1094810	1101810	Note that these API requests are anonymous, since they are aimed to recover passwords.
1101810	1111110	We decided to go further and do this for an arbitrary list of email addresses that we gathered from pastebin.com.
1111110	1119970	It had 169 email addresses and we got 7 user accounts with email and phone number.
1120690	1124570	Meanwhile, we found a security misconfiguration.
1124570	1131130	In fact, we found an exposed error log file, including some sensitive information,
1131130	1137550	but the most interesting one was the location of some internal files.
1137750	1144230	Luckily, these files were also exposed and publicly accessible.
1144230	1147330	And this is how some of them look like.
1147330	1158190	They were mailing reports with valid user account emails and also the mailing subject.
1158190	1165790	So, just by themselves, they were good enough to be used for a phishing campaign.
1165790	1174410	But we could even enrich it with phone numbers, complete the info and drive some phishing or smishing attack.
1178280	1182360	APIs tend to handle huge amounts of data.
1182360	1186000	And some of them also leak part of that data.
1186000	1188480	You may know Meetup.
1188480	1197500	Meetup offers pro accounts, which give you access to unlimited groups and targeted communications to members.
1197500	1203940	You get several other features, all of them for $30 per month per group.
1204440	1208280	And, in fact, you also get access to free email addresses.
1209040	1217500	Regardless of what privacy settings you choose and what Meetup says, that they won't give your email address to anyone,
1217500	1227260	what we saw is that as long as you can issue an API request, you will be able to retrieve email addresses from the API.
1227860	1238960	And we did this for 38,504 user profiles just on the WordPress network.
1239380	1242760	I think it's quite huge.
1242760	1247560	Let's continue with David with lack of resources and rate limiting.
1248740	1256700	Well, with lack of resources and rate limiting, the final objective was user enumeration.
1256700	1261820	So, what we have is improper rate limiting.
1262300	1267520	And, in the end, we got the user enumeration.
1267520	1270540	In this screenshot you can see it.
1270540	1278440	Because, to be fair, the Meetup, which is the target, had the rate limiting defined on...
1278440	1280700	It followed the best practice.
1280700	1286460	You can see the X rate limit custom response header.
1286460	1293660	But, when we tried to enumerate members, we noticed that something was strange.
1294440	1301620	We noticed that after a few rate-limited requests, it just got stuck.
1301620	1308300	So, I don't know if it was a bug on the server side or something like that.
1308300	1316780	Because it allowed us to continue and did not lock our attempt to enumerate.
1317060	1320840	Just a small preview, nothing fancy.
1320840	1335980	But, you can see that, in the end, after a few requests, we did find a lot of user names that we could use.
1339860	1347240	Ok, so, just simple enumeration, including the username, user location, the profile photo...
1347860	1353140	And, by the way, you can see on the bio that it's the co-founder and former CTO.
1354560	1358860	Of Meetup and PM on Facebook.
1358860	1361400	So, it was... well, it was the number 2.
1361400	1370680	So, I'm supposing the idea was very close to be the founder or something very important on the Meetup.
1370680	1374140	But, just to show you that a simple...
1374920	1381140	If you don't control and test the rate-limited protection...
1383140	1386640	You need to make serious. You better test it.
1386640	1392220	It's not just put a header and didn't test it and forget it.
1392220	1394660	You need to control it, ok?
1394660	1396180	So, to follow.
1404480	1410320	Let's talk about the second authorization issue in the OWASP API security top 10.
1410380	1412660	Broken function level authorization.
1412840	1415600	We began with broken object level authorization.
1415600	1418000	And you should expect something similar.
1418000	1425100	But instead of requesting objects by their unique identifier, we're gonna ask APIs to execute functions.
1425100	1428240	Either regular user or admin ones.
1428720	1435480	We're glad you stick with us until here because we didn't have the chance to talk about COVID-19 pandemic yet.
1435520	1442100	This pandemic, among other severe consequences, also created a new battleground.
1442100	1444860	Conferencing tools and services.
1444860	1451640	By the way, this finding was yet another great job by our friends João Moraes and Guilhom Lopes.
1451980	1458180	João Moraes is also presenting at DEF CON this year together with Pedro Umblino, another friend of us.
1458180	1462220	And you should not lose the chance to watch their talk.
1463660	1470300	In addition to the audio and video features, this conferencing tool also offers a user chat.
1470300	1477920	I think they know that users need a way to ask others whether they can hear them.
1478180	1483160	I'm not sure whether this is foolproof, but let's see what we found.
1485020	1489940	While joining the meeting, we noticed an API request like the one on the left.
1489940	1493520	The response on the right returns a list of participants.
1494380	1503840	We don't know what the ticket code is, but when we see a numeric identifier like the viewer code ID, we surely test it.
1504380	1519440	So, simply iterating over viewer code ID, we got exactly 1496 email addresses from other meeting participants.
1519440	1526720	And we also got 673 phone numbers from the same participants.
1528320	1531660	Let's discuss security misconfigurations with David.
1534530	1536570	Security misconfiguration...
1538210	1546730	Well, with security misconfiguration we did found a couple of things, but please don't expect too much from here.
1546730	1559990	It's really a bunch of nothing. We did found stack traces and one of them, not related to the stack trace, one of the security misconfiguration was a GraphQL introspection.
1560370	1570950	It was a little bit... I think it was one of the first time that I saw it in production, but let's see it in detail.
1570950	1581200	Okay, so stack trace on an handled Java exception. So, this type of vulnerability is like boring, moving along.
1581590	1587220	Another stack trace, but this time with more style. It's Node.js, an handled exception.
1587870	1591710	Well, at least it's clean up your own mess, right?
1593330	1596950	Okay, finally, something more clean.
1596950	1601990	You know that development tools should not be deployed in production, right?
1603790	1609270	And yes, this is the GraphQL introspection attack.
1610170	1617190	And please, GraphQL introspection should be disabled in production, like I said before.
1617190	1625910	This will give the attacker the opportunity to get the structure of your database and many more information.
1625910	1630090	So, devs, keep that in mind.
1630150	1636950	Also, unique ID is Base64 obfuscated.
1636950	1642530	This is what we underlined on the Burp screenshot.
1642530	1647170	By the way, Base64 is encoding and not obfuscated.
1647190	1651230	But anyway, thanks for the detailed explanation.
1652050	1658290	Injection, one of my favorite sections of this presentation.
1658610	1660070	And guess what?
1660950	1667610	We changed the vulnerabilities with cross-site scripting and cross-site request forgery.
1667610	1677070	And in the end, well, we have the cool scenarios to present.
1677470	1679710	Guess what? Meetup.
1679790	1682070	All your meetup belong to us.
1682730	1685050	What was the real objective?
1685050	1687670	Well, I used meetup.
1687670	1696570	And when I see a discussion part where you could post some comments and messages to the group itself,
1696570	1701710	it immediately wanted me to pop up some alert box.
1701710	1708490	And coming from a guy that loves and keeps studying cross-site scripting attacks,
1708490	1712050	it was something that I would like to do.
1713370	1719750	The frontend immediately won't allow it and sanitized most of the content that I posted.
1719750	1724950	So, after a while and checking the burp proxy logs,
1724950	1729810	I noticed that some requests were being made to the API.
1729810	1732010	So, API did the job.
1732930	1738790	I did found a payload that immediately triggered what I wanted.
1738790	1741670	In this case, the alert one.
1744470	1747710	The payload was not mine, of course.
1747710	1757230	I want to thank Gareth Hayes, which compiled a magnificent list on PortSweeger.
1757230	1758950	So, check it out.
1758950	1763170	We don't have the original name for the guy that created this payload,
1763170	1769070	but it was the starting point to our attack.
1769550	1771290	So, what we wanted to do?
1771290	1774750	Okay, let's be the organizer of the meetup.
1774750	1777790	Let's steal a meetup group.
1777790	1785310	We noticed that even using the API, we have some shards were removed, sanitized or whatever,
1785310	1791350	but also they were very easy to bypass.
1791350	1796250	We just used eval and encoded in Base64.
1797050	1809850	We wanted to create a payload that will trigger a vulnerable cross-site request forgery endpoint that we found previous.
1809850	1819250	So, we pointed to the hidden iframe that submitted an auto-submit form
1819850	1829670	that allowed the authenticated organizer to approve another user to co-organizer.
1829670	1833730	We have a video showing that.
1833730	1840210	So, we have dropped the payload meetup that is owned by FunkyCat.
1840210	1842710	As you can see, we have the discussion part.
1842710	1845550	Pretty easy, it's default on most groups.
1845690	1855770	So, in members, we have FunkyCat as a leader, organizer, and DavidSopas as a regular member.
1856330	1858310	This DavidSopas is crazy.
1858310	1860830	I don't know if it's malicious or not.
1860830	1866030	So, we triggered our POC, which is the payload.
1866890	1875190	And after the FunkyCat reloads the page, you will see a new comment.
1875210	1879870	In this case, it will be an empty comment.
1879870	1881210	It doesn't say anything.
1881210	1885610	So, FunkyCat will be like, oh, okay, this guy didn't post anything.
1885610	1886590	That's weird.
1886590	1892810	But when you check members, you can see that now DavidSopas is the co-organizer.
1892970	1894330	How funny is that?
1894330	1897070	And he can do anything with it.
1897070	1901830	He has almost the same options than the FunkyCat.
1902010	1903770	So, cool, right?
1903770	1906870	But we wanted more, of course.
1906930	1909830	We are security researchers.
1909830	1911050	We always want more.
1911050	1913010	So, give me some money, please.
1913010	1914510	I love this man, by the way.
1914510	1916150	Show me the money.
1917010	1920050	So, we created a new POC.
1921450	1929570	On the PayPal account, or payments received, the FunkyCat can collect dues to meetup members
1929570	1933210	or charge members for any meetup and anything.
1933210	1940110	So, you have also a box where FunkyCat can put his PayPal account.
1941110	1945810	But on your right side, you can see a messy call request.
1945810	1953530	Just copy-paste from Burp, where we use the API and trigger our payload the same way,
1953530	1957150	inserting it in the discussion part.
1957310	1965510	And when it triggers, it will post the payload on the discussion part.
1965510	1974470	And when the FunkyCat goes to his page and refreshes the meetup group,
1974470	1977590	you will get a new message also.
1977590	1981730	But, again, empty, no problem at all.
1982750	1985590	But when the random fun meetup...
1985590	1987950	Yeah, that's random names, okay?
1987950	1992790	So, it goes to settings, payments received, and guess what?
1993450	1998910	PayPal account is now sending all your cash to Evil Hacker.
1999310	2001470	That's cool, right?
2001550	2006370	Moving to Paulo, because this one is a huge thing.
2009080	2013980	I'm not sure whether this is gonna be huge, but regarding logging and monitoring,
2013980	2018860	this is what I believe happens most with APIs.
2018860	2025160	Either they're not producing enough logging, logs have not enough details,
2025160	2028640	or simply API admins are doing nothing with them.
2028640	2036160	During our account takeover attempts, we never received an email saying that our testing account was under attack.
2036160	2041260	On the other hand, our security advisories are always received with great surprise.
2041260	2045080	So we tend to assume that our activities were unnoticed.
2045080	2048180	And this is not how it is supposed to be.
2048180	2055580	Logging and monitoring should help organizations to mitigate the risk and act on a timely fashion.
2057680	2060660	It's time to wrap up this talk.
2060660	2063740	We're gonna share our final thoughts.
2063740	2068280	We definitely think that APIs are juicy.
2068280	2076540	They tend to handle huge amounts of data, and they also leak some of that data.
2076540	2080180	We still see lots of user authentication issues.
2080180	2085860	They were common on traditional web applications, and they are still common on APIs.
2085860	2090460	The same way, we see a lot of authorization issues.
2090460	2098580	The API scope tends to be big and complex, and authorization is not an easy task.
2098800	2102560	We have been watching the rising of GraphQL.
2102560	2108660	We still see REST APIs, as well as XML or JSON-RPC APIs.
2108660	2113520	But the number of GraphQL is increasing rapidly.
2113520	2120700	And GraphQL is a very recent technology, and it brings specific security concerns.
2120840	2131920	Finally, from our experience, organizations are still taking too long to answer and fix vulnerabilities.
2131920	2141060	And this is something that we will keep working to improve with our research and responsible disclosure.
2142700	2155020	We don't want to finish before leaving a special thanks to both CheckMarkz and Char49 for the great opportunity to presenting our research in DEF CON.
2155020	2158700	We are available to answer your questions.
2158700	2162320	Feel free to reach us on Twitter, and keep safe and strong.