text:
Cenveo Announces Closing of its Exchange Offer and Related Debt Refinancing Transactions
STAMFORD, Conn. — June 13, 2016 — Cenveo Corp., a Delaware corporation (the "Company"), announced that on Friday June 10, it closed on an exchange offer (the "Exchange Offer") whereby approximately 80% of its outstanding 11.5% Senior Notes due 2017 (the "11.5% Notes") were exchanged for newly issued 6.000% senior notes due 2024 (the "New Notes") and warrants (the "Warrants") to purchase shares of common stock, par value $0.01 per share, of Cenveo Inc. ("Common Stock"), representing in the aggregate 16.6% of the outstanding Common Stock, at an exercise price of $1.50 per share, and related refinancing transactions. Cenveo Inc. (NYSE: CVO), a Colorado corporation, is a holding company and holds all of the capital stock of the Company.
Commenting on the transaction, Robert Burton Sr., chairman and CEO, stated, "We are delighted to have achieved these important milestones with our refinancing transactions. With the closing of the Exchange Offer and related transactions, and other signed transactions, Cenveo emerges a stronger company with lower debt, higher cash flow due to significantly lower interest expense, and no significant scheduled debt maturities until August 2019. We are confident that with our improved free cash flow and increased liquidity as a result of the new $50 million secured term note financing, we have sufficient cash to address the nearly $50 million of 11.5% Notes and 7.0% exchangeable senior notes that remain outstanding following this closing. These financing transactions enable the Company to continue to capitalize on its leadership position within its three business segments by significantly reducing the refinancing and disruption risk associated with the 2017 debt maturities. We are very excited about the future of our company and very appreciative of our longtime lenders who have supported us during these transactions."
On June 10, 2016 (the "Closing Date"), the Company retired approximately $150 million of its outstanding 11.5% Notes in exchange for an aggregate of approximately $105 million of New Notes and Warrants to purchase approximately 11.1 million shares of Common Stock. For each $1,000 principal amount of 11.5% Notes exchanged, the holder received $700 aggregate principal amount of New Notes and Warrants to purchase 74 shares of Common Stock. The retired 11.5% Notes represented approximately 80% of all such notes outstanding at the commencement of the Exchange Offer. Approximately $38.5 million aggregate principal amount of the 11.5% Notes remain outstanding.
Also on the Closing Date, in a related transaction, the Company amended its asset-based revolving credit facility (the "ABL Facility") to extend the term of the ABL Facility through 2021 and to reduce the commitments thereunder by $50 million to $190 million. The ABL Facility now matures in June 2021, with a springing maturity of May 2019 ahead of the Company's existing 6.000% senior priority secured notes due August 2019 (the "6.000% Notes") in the event that more than $10.0 million of the 6.000% Notes remain outstanding at such time.
Also on the Closing Date, in another related transaction, the Company and certain affiliates of or funds managed by Allianz Global Investors U.S. LLC ("Allianz" and, collectively, the "Purchasers") entered into a secured indenture and note purchase agreement (the "Secured Note Purchase Agreement") pursuant to which the Company issued new secured notes to the Purchasers in an aggregate principal amount of $50.0 million (the "New Secured Notes"), the proceeds of which have been applied to reduce the outstanding principal amount under the ABL Facility. The New Secured Notes mature in December 2021, with a springing maturity of May 2019 ahead of the Company's 6.000% Notes. The New Secured Notes bear interest at 4% per annum and are secured by the same collateral that secures the ABL Facility, the 6.000% Notes and the Company's 8.500% junior priority secured notes due 2022 (the "8.500% Notes"). With respect to the ABL Facility, the New Secured Notes rank junior with respect to all collateral up to a certain maximum principal amount of the ABL Facility. With respect to the 6.000% Notes, the New Secured Notes rank junior with respect to notes priority collateral and senior with respect to ABL Facility priority collateral. With respect to the 8.500% Notes, the New Secured Notes rank senior with respect to all collateral. Such ranking of the New Secured Notes with respect to the 6.000% Notes and the 8.500% Notes is the same ranking that the ABL Facility has with such notes.
In addition, as previously disclosed, the Company and Allianz have agreed to enter into a note purchase agreement pursuant to which the Company shall purchase all of its 7% exchangeable senior notes (the "7% Notes") owned by Allianz in the aggregate principal amount of $37,545,000 in exchange for: (a) payment in cash in an amount equal to (i) the aggregate principal amount of such 7% Notes multiplied by 0.6 plus (ii) an amount of interest on the amount payable pursuant to the immediately preceding clause (i) at an annual interest rate of 7% per annum, such interest accruing from the date of execution of such note purchase agreement until (and including) the closing of the purchase and computed based on a year of 360 days; (b) payment in cash of interest that shall have accrued in respect of such 7% Notes in accordance with the indenture relating to such 7% Notes but remains unpaid at the closing of the purchase; and (c) delivery to Allianz of Warrants to purchase 3.3% of the outstanding shares of the Common Stock as of the Closing Date. The consummation of the 7% Notes purchase may occur in one or multiple closings on or prior to January 31, 2017 and are subject to customary conditions precedent. As a result of the 7% Notes sale, only approximately $11.2 million aggregate principal amount of 7% Notes will remain outstanding.
The New Notes, the Warrants and the shares of Common Stock underlying the Warrants and the offering thereof have not been registered under the Securities Act or under any state securities laws. The New Notes, the Warrants and the shares of Common Stock underlying the Warrants may not be offered or sold within the United States, absent registration or an applicable exemption from registration requirements. On the Closing Date, the Company executed a registration rights agreement pursuant to which the Company will file a registration statement covering the resale of the Warrants and the shares of Common Stock issuable upon exercise of the Warrants.
J.P. Morgan Securities LLC was the Dealer Manager for the Exchange Offer. In the transactions, Hughes Hubbard & Reed LLP represented the Company and Cenveo Inc., Cahill Gordon & Reindel LLP represented the Dealer Manager and Willkie Farr & Gallagher LLP represented Allianz. MacKenzie Partners acted as the Information Agent for the Exchange Offer.
About Cenveo Inc.
Cenveo Inc. (NYSE: CVO), world headquartered in Stamford, Conn., is a leading global provider of print and related resources, offering world-class solutions in the areas of custom labels, envelopes, commercial print, content management and publisher solutions. The company provides a one-stop offering through services ranging from design and content management to fulfillment and distribution. With a worldwide distribution platform, it prides itself on delivering quality solutions and service every day to its customers.
Source: Cenveo.
Cenveo Inc.
Quad to Close Midland, Mich., Publication Plant
Paul Bradshaw Joins New Leaf Paper as COO
Orora Limited Names New CEO and Managing Director
Xeikon Consolidates its Operations to Belgium
Toppan Printing Announces New President


Based on a pre-defined weighted trend formula for chart analysis, ZL.Z20 scored -65 on a scale from -100 (strong downtrend) to +100 (strong uptrend).
Want to analyze SOYBEAN OIL Dec 2020 ZL.Z20 or another symbol? Try our Free Future Trend Analysis Report.


text:
Future-Proofing Mental Health
General Impact
UK academics are calling for targets for mental health research in order to meet the healthcare challenges of the next decade. Published today in Journal of Mental Health, researchers set out four overarching goals that will speed up implementation of mental health research and give a clear direction for researchers and funders to focus their efforts when it comes to better understanding the treatment of mental health.
The treatment of mental illness currently brings substantial costs to individuals, the NHS, and also to wider society. The need for innovation to promote good mental health has never been greater. In an effort to catalyse this innovation, researchers have set out four ambitious targets:
Halve the number of children and young people experiencing persistent mental health problems
Improve our understanding of the links between physical and mental health, and eliminate the mortality gap
Increase the number of new and improved treatments, interventions and supports for mental health problems
Improve the availability of choices and access to mental health care, treatment and support in hospital and community settings
The number of goals was limited to four in an effort to easily promote cross-sector partnerships, and to track their impacts.
Professor Dame Til Wykes, corresponding author from King's College London's Institute for Psychiatry, Psychology & Neuroscience, said:
'While there is a wealth of research taking place to better understand the treatment of mental illness, we must have a clear idea in our heads where we are heading. Without clear targets and goals for mental health we will be amassing information without any clear trajectory, or worse, no clear understanding of achievements or the expected timescale. The four goals that we have set out are in response to this problem, providing a roadmap forwards for all researchers, funders, and policymakers. We have undoubtedly set ourselves a high bar, but they have been designed to give us all a clear sense of purpose.'
The research comes at a particularly pertinent time. At least 1 in 6 adults in the UK is likely to experience mental health difficulties in any given week, and the British Medical Association has recently warned that the mental health consequences of COVID-19 will be "considerable".
The research has been welcomed by several sector voices, including funders, researchers, and NHS Trusts.
Professor Chris Whitty, Chief Medical Officer and co-lead of the National Institute for Health Research, said:
'Few could disagree that mental health research is crucial in driving innovation in current mental health care and in bringing hope for the future. Working with clinicians, academics, major mental health research funders, mental health research charities and representatives from service user groups, as well as representatives from Public Health England and NHS England has been key to identifying those areas of most concern and transforming them into four distinct research goals, which the mental health community can sign up to.'
Professor Cathy Creswell, co-author from the Departments of Psychiatry and Experimental Psychology, University of Oxford, said:
'The pandemic has shone a light on the need for huge strides forward in mental health research and practice. These goals provide a focus for research efforts by addressing key priorities as identified by a broad range of stakeholders, in particular the needs of children and young people, the physical health burdens associated with poor mental health, and the need for improved access and choice when it comes to promoting good mental health and preventing and treating mental health problems'
Professor Elaine Fox from the Department of Experimental Psychology, said:
National high-level goals that focus our research efforts are an important part of ensuring that good will and good intentions are translated into genuine innovations and impact.
The four goals were produced following a consultation process that was organised by the Department of Health and Social Care and convened by the Chief Medical Officer. The views of service users and service user organisations supported this activity, as well as research support from the National Institute for Health Research's Clinical Research Network.
To read the full paper, Shared goals for mental health research: what, why and when for the 2020s.
Kia Nobre steps down as Head of Department
Matthew Rushworth replaces Kia Nobre as interim Head of Department
PTSD in healthcare workers during pandemic could be exacerbated by past trauma
While some of the high rates of post-traumatic stress (PTSD) seen in healthcare workers during the pandemic are specifically COVID-19-related, a more significant number of cases were linked to trauma that occurred earlier in their lives, researchers at the University of Oxford have found.
New Policy Briefing Addresses Mental Health Effects of the Pandemic on Young People
In the Briefing, a team of researchers at King's College London and Oxford University highlight the multiple effects that the COVID-19 pandemic has had on children and young people in the UK in their education and daily life, including challenges around social isolation, academic pressures, adjusting to online learning and coping with reopening of schools.
Mitigating impacts of the COVID-19 pandemic on parents and carers during school closures: A Rapid Evidence Review
UKRI awards funding for project to research adolescent mental health and development in the digital world
Sustainable funding needed to provide nursery places

redpajama_set_name: RedPajamaCommonCrawl


text:
In case anyone should ask…..
Dave Andrusko
There will be one more digital edition of National Right to Life News that will be sent out the first week of November. But as I write this, there are three weeks until the United States elects its 44th President, it's important that we do enough over the next 21 days that we are able to answer the following in a way that would make us (and our children) proud.
In case anyone should ask, are you ready to vote? Do you know who the pro-life candidates are? Did you encourage your pro-life family and friends to vote for those pro-life candidates, whether for President, Senate, or House of Representatives?
In case anyone should ask, did you help National Right to Life's PAC or the NRL Victory Fund? Historically, no one has done more with less to help pro-life candidates than NRL PAC and the NRL Victory Fund.
In case anyone should ask, did you share the truth about Hillary Clinton's never-enough position on abortion? Did you lay out, chapter and verse, her long, long history of passionate abortion advocacy, a commitment to exponentially increasing the number of aborted babies overseas and to frisking your pockets for tax money to pay for slaughtering the innocents, both at home and abroad?
In case anyone should ask, did you contrast Donald Trump's position on the fate of the little ones with Hillary Clinton's? Did you make it crystal clear that while he is committed to protecting the life-saving Hyde Amendment, Clinton would eliminate a policy that has stood for 40 years? That he would nominate pro-life candidates to the Supreme Court while Clinton's litmus test is 100% support for Roe v. Wade, the 1973 Supreme Court decision whose tsunami like impact has resulted in the deaths of nearly 60 million unborn babies?
In case anyone should ask, yes, you can document how militantly pro-abortion Clinton is. In addition to the above, while a U.S. senator she opposed the ban on partial-birth abortions. For those new to the Movement or new to the issue, partial-birth abortions are usually performed in the fifth and sixth months of pregnancy and so grotesque even hard-core pro-abortionists blanch. But not Hillary Clinton.
Before the ban was enacted, signed into law by President George W. Bush, and upheld by the Supreme Court, thousands of times a year, an abortionist deliberately delivered, feet first, a premature, healthy infant until only the baby's head remains lodged just inside the mother's womb. Then he punctured the base of the baby's skull with 7-inch surgical scissors and suctions out the brain.
Hillary Clinton can live with that. Huge, highly developed babies can not.
And as if to prove her support for partial-birth abortions was no fluke, Clinton opposes the Pain-Capable Unborn Child Protection Act. The bill accomplishes what the title suggests: it protects unborn babies who are capable of experiencing excruciating pain when they are aborted beginning at 20 weeks after fertilization, which is 22 "weeks of pregnancy," or about the beginning of the sixth month, a point by which – if not earlier – there is substantial medical evidence that the unborn child can feel pain. Public opinion polls show that by lopsided margins, Americans support prohibiting abortion at least by this stage in development, with most polls showing women even more supportive than men.
But not Hillary Clinton.
In case anyone should ask, you are working as hard as you are because you know the stakes: the future for decades to come of the Supreme Court; the Hyde Amendment whom only a radical like Clinton would target for extinction; the abortion-enhancing, and rationing-inducing, ObamaCare; and the countless appointees who will make policy–for good or for evil–behind the scenes.
In case anyone should ask, having tried with everything at your disposal to help the babies and their mothers, you will quote Mother Teresa who once said, "God doesn't require us to succeed, he only requires that you try."
Editor's note. This editorial appeared on page two of the current digital edition of National Right to Life News. Please share this story–and the entire issue–using your social media contacts.
Categories icon Politics
Tags icon Hillary Clinton, NRL-PAC, vote
Woman who tried to self-abort baby at 24 weeks wants all charges dropped
Arizona Senate: Ann Kirkpatrick wants you to pay for abortions. Vote John McCain.


Old enough to have been to both Kiddie Land and Joyland, Doug Stucky was born and raised in Wichita. In Fact, he has the original Joyland swimming pool sign he purchased after the park closed along with the Midge-O-Rac ticket box.
Doug currently serves dual duty as an AIGA Wichita Board and as a AIGA Chapter Advisory Council (CAC) member consulting and advising 12 chapters within AIGA Region 6. As a Wichita board member he has served in variety of roles from programming to chapter President.
Doug owns Red Catapult, Inc. a Targeted Branding company that arms small businesses with the strategy and branding tools necessary to grow. He has over 30 years of branding and strategy experience and has owned and operated a design studio for more than 25 years.
For the past several years, Doug has also served as an adjunct instructor in the Wichita State University's Graphic Design program. Doug is a big college basketball fan, and although he graduated of Kansas University with Bachelor of Fine Arts, he supports the Shockers and Jayhawks equally (well sort of).


Choose wholegrain varieties whenever you can, or eat potatoes with their skins on for more fibre.
Is the eatwell plate for me?
The eatwell plate applies to most people – whether they're a healthy weight or overweight, whether they eat meat or are vegetarian, and no matter what their ethnic origin.
However, it doesn't apply to children under the age of two because they have different nutritional needs. Between the ages of two and five, children should gradually move to eating the same foods as the rest of the family, in the proportions shown on the eatwell plate.


At Active Orthopedics Physical Therapy in Midland, Michigan, we have an incredibly talented team of physical therapists who are skilled in using advanced methods to relieve your pain and improve your functional ability.
In order to offer the most effective care to our patients, we encourage our physical therapists to pursue additional training and certifications. At Midland, our therapists have certifications in orthopedic manual physical therapy, strength and conditioning, Graston® Technique, and USA triathlon coaching.
To schedule an appointment for physical therapy or one of our special programs at Midland, call (989) 832-9300 today.
Craig earned a master's degree in physical therapy from Central Michigan University in 1999 and completed a 2-year post-graduate residency program in orthopedic manual physical therapy (OMPT) at Oakland University. He is also nationally recognized as a certified strength and conditioning specialist (CSCS) and is pursuing board certification as a sports clinical specialist (SCS).
An avid triathlete and cyclist, Craig founded the MidMichigan Multisport Racing Club and the Sanford and Sun Triathlon and Duathlon.
Laura earned her doctorate degree in physical therapy from Central Michigan University in 2011, and she is nationally recognized as a certified strength and conditioning specialist (CSCS).
Further supplementing her degree, Laura has taken numerous courses in the areas of manual therapy, orthopedics, and sports medicine, with an emphasis on overhead throwing and swimming.
Laura is also a certified USA Triathlon coach and a 3-time USA Triathlon sprint distance national champion.
Lori earned her doctorate degree in physical therapy from Central Michigan University in 2005 and has extensive experience in orthopedics, post-operative rehabilitation, and sports rehabilitation. She has also taken several courses in manual therapy focusing on lumbar and sacral dysfunction.
Lori is also certified in the Graston® Technique utilizing instrument-assisted soft tissue mobilization (IASTM). She enjoys spending her free time with her family, and she is an avid runner.
Shane earned his doctorate degree in physical therapy from Central Michigan University in 2016, and he is nationally recognized as a certified strength and conditioning specialist (CSCS).
Shane is also a competitive golfer and a level 1 certified golf coach with the Titleist Performance Institute. In his spare time Shane enjoys golf, resistance training, and hunting.
Merrick earned his doctorate degree in physical therapy from Central Michigan University in 2016 and is pursuing advanced training and certification as a strength and conditioning specialist (CSCS). He serves as adjunct faculty at Saginaw Valley State University where he teaches functional biomechanics.
A triathlete and ultra-marathon runner, Merrick is involved in various outdoor recreational activities.


I don't know my Student ID.
Your Student ID is listed on the billing statement you received at the business office when you registered. It is the 9-digit number underneath the date. It looks something like this: 1230-04321. If you do not have your billing statement or other paperwork that has your Student ID on it, by Statehouse Halland ask at Student Services. You will need your ANC Student ID card or government issued photo ID.
If you do not live near enough to stop by Statehouse Hall, email the Helpdesk using your ANC school email account or the personal email account you listed with us. This can begin the process of verifying your identity. You will need to answer several questions and we will send your ID number ONLY when we are confident we are sending it to the correct person.
I know my Student ID and my password, but I still can't log in to myANC.
Be sure you are typing your Student ID without any hyphens. Just type the 9 digits straight through. Contact the Helpdesk at ANCHelp@smail.anc.edu if you have never logged in and it isn't working for you OR if you have logged in previously, reset your password and can't remember it. We can't look your password up but we can reset it back to the last four digits of your SSN.


text:
US9218467B2 - Intra stack frame randomization for protecting applications against code injection attack - Google Patents
Intra stack frame randomization for protecting applications against code injection attack Download PDF
stack locations
David Matthews
Robert Martz
Forcepoint LLC
Forcepoint Federal LLC
2013-05-29 Application filed by Forcepoint Federal LLC filed Critical Forcepoint Federal LLC
2013-05-31 Assigned to Raytheon BBN Technologies, Corp. reassignment Raytheon BBN Technologies, Corp. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: MARTZ, ROBERT, MATTHEWS, DAVID
2013-06-12 Assigned to AFRL/RIJ reassignment AFRL/RIJ CONFIRMATORY LICENSE (SEE DOCUMENT FOR DETAILS). Assignors: RAYTHEON BBN TECHNOLOGIES CORPORATION
2015-05-28 Assigned to RAYTHEON CYBER PRODUCTS, INC. reassignment RAYTHEON CYBER PRODUCTS, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: RAYTHEON BBN TECHNOLOGIES CORP.
2015-06-02 Assigned to RAYTHEON CYBER PRODUCTS, LLC reassignment RAYTHEON CYBER PRODUCTS, LLC CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: RAYTHEON CYBER PRODUCTS, INC.
2015-06-09 Assigned to RAYTHEON COMPANY reassignment RAYTHEON COMPANY PATENT SECURITY AGREEMENT Assignors: PORT AUTHORITY TECHNOLOGIES, INC., RAYTHEON CYBER PRODUCTS, LLC (FORMERLY KNOWN AS RAYTHEON CYBER PRODUCTS, INC.), RAYTHEON OAKLEY SYSTEMS, LLC, WEBSENSE, INC.
2016-02-16 Assigned to FORCEPOINT FEDERAL LLC reassignment FORCEPOINT FEDERAL LLC CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: RAYTHEON CYBER PRODUCTS, LLC
2017-08-01 Assigned to FORCEPOINT LLC reassignment FORCEPOINT LLC ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: FORCEPOINT FEDERAL LLC
G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material
G06F21/12—Protecting executable software
G06F21/121—Restricting unauthorised execution of programs
G06F21/125—Restricting unauthorised execution of programs by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
G06F12/14—Protection against unauthorised use of memory or access to memory
G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
G06F12/1425—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block
G06F12/1441—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block for a range
G06F12/16—Protection against loss of memory contents
G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
A method of randomizing locations of variables in a stack includes: identifying a plurality of stack locations corresponding to a plurality of variables; shuffling the stack locations of the variables to produce shuffled stack locations; and updating the stack locations of the variables with the shuffled stack locations.
STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT
This invention disclosure is related to Government Contract No. FA8750-12-C-0098. The Government has certain rights in this invention.
Aspects of embodiments of the present invention relate to the field of computer security, and, more specifically, protection against code injection attacks.
Stack-based code injection attacks using buffer overflows are a common security risk in computer systems. In a buffer overflow attack, input data supplied by an attacker to a function (subroutine, method, procedure, or other callable unit) exceeds the size of the space allocated for that input (the "buffer"). If the computer system fails to check the size of the input data before writing the input data into the buffer, then the buffer "overflows" and data stored in portions of memory outside of the buffer can be corrupted.
FIG. 1 is a schematic diagram of a typical computer system. In a standard computer system, a central processing unit (CPU) 10 includes a program counter (PC) 12, a plurality of registers 14, an arithmetic/logic unit (ALU) 16, and a bus interface 18. The program counter 12 provides the address of the next instruction to be executed, the registers 14 store data and values currently being computed, and the ALU 16 performs computations on the data stored in the registers 14. Data is transferred into and out of the CPU 10 via the bus interface 18, which interfaces with an I/O bridge 20 to communicate with main memory 30 and other peripheral devices 40. While FIG. 1 illustrates a typical computer system, various other computer systems may be organized in different ways (for example, the I/O bridge 20 may be integrated into the CPU 10, or the CPU may include memory caches).
FIG. 2 is a schematic diagram illustrating a stack smashing buffer overflow attack. C. Cowan, et al., StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks 7 PROC. OF USENIX SEC. SYMP. (1998). As seen in FIG. 2, the stack 100 is stored in main memory 30 and grows in a downward direction (e.g., away from 0xFFFF and toward 0x0000). When a function call is made, a "Return Address" is pushed onto the stack and space is allocated for local variables, including a potentially attackable buffer at lower addresses. When input data is stored the buffer, the data (e.g., a text string from user input) grows in an upward direction (with increasing addresses). If the size of the input data exceeds the allocated size of the buffer, data located at higher addresses than the buffer can be overwritten with the supplied data. In FIG. 2, for example, the data overflowing the buffer could overwrite the Local Variables, the return address, and portions of the stack above the return address (which is generally the portion of the stack allocated to the calling function).
As seen in FIG. 2, the overflowing buffer can be used to insert executable attack code into the stack and to overwrite the return address with a pointer to the attack code. As such, when the attacked function exits, the processor jumps to and executes the attack code instead of the function that it was called from. The attack code can be used to gain root (or administrator) access to the machine by, for example, executing the command 'exec("sh")' to produce a root shell.
Generally, stack-based code injection attacks require: knowledge of the instruction set of the underlying architecture; knowledge of the location of one or more buffers on the stack; ability to inject code/data; and ability to redirect the control flow. An attacker can use the stack to return to the injected or other arbitrary code.
For an attacker to successfully craft a payload for a stack-based code injection attack, they need to be aware of the stack layout of the function they are attacking. This is because they need to change a return address in a very specific place on the stack to successfully gain control of the system.
Historically the layout of layout of these local variables (including any buffers) is controlled by the compiler, and each compiler handles them differently. However, it is generally not difficult for an attacker to determine (or guess) which compiler was used. The layout of these local variables has no influence on the execution of the function, because they are typically referenced in the machine code as an immediate offset from the stack pointer.
Most modern operating systems use some form of address space layout randomization (ASLR), which will randomize the location of the entire stack. See, e.g., O. Whitehouse, An Analysis of Address Space Layout Randomization on Windows Vista™, Symantec Advanced Threat Research. While this can provide some benefit, this concept requires support in the underlying operating system, and it can be turned off via operating system settings, thereby rendering system vulnerable when deactivated by an attacker or deactivated by a system administrator (due, for example, to compatibility problems between "legacy" software and ASLR).
According to one embodiment of the present invention, a method of randomizing locations of variables in a stack includes: identifying a plurality of stack locations corresponding to a plurality of variables; shuffling the stack locations of the variables to produce shuffled stack locations; and updating the stack locations of the variables with the shuffled stack locations.
The identifying the stack locations may include identifying variables in object code, and the updating the stack locations of the variables may include updating the object code with the shuffled stack locations.
The identifying the stack locations may include identifying variables in binary code, and the updating the stack locations of the variables may include updating the binary code with the shuffled stack locations.
The identifying the stack locations may include identifying variables in executable code loaded into memory, and the updating the stack locations of the variables may include updating the executable code loaded into memory with the shuffled stack locations.
The shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations may occur prior to execution of the executable code.
The shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations may occur during execution of the executable code.
According to one embodiment of the present invention, a non-transitory computer readable medium embodies program instructions for execution by a data processing apparatus, the program instructions adapting the data processing apparatus for: identifying a plurality of stack locations corresponding to a plurality of variables; shuffling the stack locations of the variables to produce shuffled stack locations; and updating the stack locations of the variables with the shuffled stack locations.
According to one embodiment of the present invention, a computer system includes a processor; and memory storing program instructions, the program instructions being configured to control the computer system to: identify a plurality of stack locations corresponding to a plurality of variables; shuffle the stack locations of the variables to produce shuffled stack locations; and update the stack locations of the variables with the shuffled stack locations.
The accompanying drawings, together with the specification, illustrate exemplary embodiments of the present invention, and, together with the description, serve to explain the principles of the present invention.
FIG. 1 is a schematic diagram of a typical computer system.
FIG. 2 is a schematic diagram illustrating a stack smashing buffer overflow attack.
FIG. 3 is a schematic diagram of an exemplary stack before and after being shuffled in accordance with an embodiment of the present invention.
FIG. 4 is a process flow diagram illustrating a method of randomizing the locations of variables on the stack during a standard build process in accordance with one embodiment of the present invention.
FIG. 5 is a process flow diagram illustrating a method of randomizing the locations of variables on the stack in a compiled and linked executable binary file (or binary) in accordance with one embodiment of the present invention.
FIG. 6 is a process flow diagram illustrating a method of randomizing the locations of variables on the stack after a compiled and linked executable binary file (or binary) is loaded into memory for execution in accordance with one embodiment of the present invention.
FIG. 7 is a process flow diagram illustrating a method of randomizing the locations of variables on the stack during execution in accordance with one embodiment of the present invention.
In the following detailed description, only certain exemplary embodiments of the present invention are shown and described, by way of illustration. As those skilled in the art would recognize, the invention may be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Like reference numerals designate like elements throughout the specification.
Embodiments of the present invention are directed to methods, systems, and programs for improving the security of a computer system against code injection attacks by shuffling (or randomizing) the order of local function variables on the stack. Embodiments of the present invention may be implemented as a computer programmed in any of a number of programming languages such as x86 assembly, C, Python, and Java. Embodiments of the present invention may also be implemented as a computer program stored on a non-transitory computer readable medium embodying program instructions. Some embodiments of the present invention are directed to the method of performing the processes described below.
FIG. 3 is a schematic diagram of an exemplary stack before and after being shuffled in accordance with an embodiment of the present invention. Referring to FIG. 3, prior to stack randomization, the stack 102 includes (in order from the bottom of the stack toward the top of the stack 112): a return address, local variable 3, an attackable buffer, local variable 2, and local variable 1. In exemplary stack 102, there is a critical distance (Cdbefore) between the return address and the address of the attackable buffer, where critical distance is the sum of the size of the local variable 3 and the size of the attackable buffer.
Stack 104 in FIG. 3 shows the stack after stack randomization. In stack 104, local variable 1 and local variable 2 are now located between the attackable buffer and the return address. As such, the critical distance (Cdafter) after shuffling is the sum of the size of local variables 1 and 2 and the attackable buffer. As such, the critical distance Cd between the attackable buffer and the return address is changed by the randomization process.
By randomizing this order within individual stack frames of a program, an attacker would not be able to know where an "attackable" buffer would be placed on the stack (the critical distance Cd), thereby providing additional security against stack-based exploits by frustrating or preventing an attacker's ability to craft an appropriate attack payload due to the uncertainty in the distance between the start of the buffer and the location of the return address on the stack. While code injection would not necessarily be prevented by such an arrangement, attempts to gain control of the system using such an attack would be limited.
Generally, an implementation of an embodiment of this invention would first identify the placement (or definition) of the local function variables on the stack within all the functions of a given program. This placement of variables has a fairly standard signature, and is usually located at the start of the machine code for a particular function. For example, according to one embodiment, instructions in a given function involving variables can be identified by their references to memory locations having addresses at fixed offsets from the frame pointer (fp) (e.g., load or store instructions using an immediate address or fixed offset from the fp), in accordance with the way in which these memory locations are identified in the architecture of the computer processor being used (e.g., ARM, x86, PowerPC, etc.).
References to those variables within each function are then identified. These variables are generally referenced using a fixed offset from the frame pointer. Once both the locations of the variables on the stack and all the references to the variables are known, their order (and locations) can be randomized.
For example, if a function makes use of local variables a and c which are located on the stack at fp−4 and fp−8 and buffer b is located at fp−72, then references to those three locations (fp−4, fp−8, and fp−72) would be searched for within the function body. The allocations of space and the references to those locations can then be shuffled (e.g., moving buffer b to fp−64 and local variables a and c to fp−68 and fp−72) by replacing each old reference to a location on the stack with the new, shuffled location on the stack.
Because only the order of the variables on the stack is changed, the size of the program and the amount of space used on the stack are not changed, and other address offsets do not need to be updated.
The extent of the randomization is dependent on the number of variables in a given function (more variables means more opportunities for reordering). Nevertheless, even a handful of local variables can result in an effective randomization. In addition, local variable randomization can run on the bare metal of the machine and can be built into the binary of the program, thereby making it more difficult to deactivate the variable randomization feature (in contrast to operating system-based ASLR protection).
Several embodiments of the present invention are described below. In one embodiment, this process is included in the build (or compilation) process, so that a new randomization is created at every compilation. In another embodiment, this process is run on a compiled binary application, so that the variable order will be different the next time an application is run. In a third embodiment, this process is incorporated into how the application is launched, so that the variable order is re-randomized every time an application is run. In a fourth embodiment, the randomization functionality is incorporated into an application itself, allowing it to re-randomize itself at intervals during execution. However, embodiments of the present invention are not limited thereto and may be implemented in a variety of other ways without departing from the scope of the invention.
FIG. 4 is a process flow diagram illustrating a method of randomizing the locations of variables on the stack during a standard build process in accordance with one embodiment of the present invention. In the method 400 shown in FIG. 4, after the compiler has produced object code in operation 402, the locations of the variables on the stack are identified in operation 404, the variable locations are randomized in operation 406, and the compiled object code is updated with new variable locations in operation 408. The updated compiled object code in then supplied to the linker to produce a binary from the updated object code in operation 410.
The compiler and the linker may be any standard compiler and linker such as GNU C Compiler (GCC C) and the GNU linker (GNU 1d) or the LLVM Clang and LLVM 11d. In other embodiments of the present invention, the method of shuffling the locations of variables in compiled object code before linking may be used with other compilers and linkers, in conjunction with the C programming language or any other appropriate programming language (e.g., languages susceptible to buffer over flow attacks).
According to one embodiment, variable locations on the stack can be identified in operation 404 as follows:
Generally, local variables are placed on the stack and referenced by a fixed offset from the frame pointer. For example:
str r3, [fp, #−8]
This instruction stores the value in register r3 into a local variable on the stack which, in this case, is 8 bytes from the frame pointer fp (fp−8). Throughout the function, this offset from the frame pointer will always refer to this variable, so it is easy to find these locations by looking for all locations that have this given offset (here, −8). Therefore, when the value stored in that local variable is used later in the function, the following instruction loads the value at the position of the local variable (fp−8) in the stack:
ldr r2, [fp, #−8]
This instruction places the value of that variable (the data stored at location fp−8 in the stack) into register r2.
In one embodiment, randomization of the variable locations in operation 406 is completed by changing the fixed offsets of all locations of the local variables in the function. For example, continuing with the above example, −8 could be replaced with another valid stack location (such as −12) such that the above instructions would become:
str r3, [fp, #−12]
ldr r2, [fp, #−12]
Because the offsets for the local variables only have meaning within the function being randomized, the problem is well bounded (the randomization operation only needs to be concerned with the function currently being randomized).
The object code is then updated with the new variable locations in operation 408 by replacing instructions in the object code as described above. This operation can be done in object code because the offsets are relative to the frame pointer and no fixed addresses are used (fixed addresses are typically added during linking in operation 410). In other words, only the offsets relative to the frame pointer are modified during the update.
The above operations of identifying locations in the stack, randomizing the locations, and updating the binary can be repeated for every function in the compiled object code and, according to one embodiment, the above operations are performed by a computer program that takes the compiled object code as input and that outputs modified object code.
In another embodiment of the present invention, the locations of variables on the stack can be shuffled in a linked binary application. FIG. 5 is a process flow diagram illustrating a method 500 of randomizing the locations of variables on the stack in a compiled and linked executable binary file (or binary) in accordance with one embodiment of the present invention. For example, in a Unix or Unix-like systems context, this binary may be in the executable and linkable format (ELF) and in a Microsoft® Windows® context, this binary may be in a portable executable (PE) format. In this embodiment, the shuffling operations occur after the linking operation 510, rather than before the linking operation 410 in the above-described embodiment directed toward randomizing the locations of variables during the build process.
Identification of variable locations on the stack after the build process in operation 504 is substantially similar to the technique used during the build process (in operation 404) because the same instructions are present in both the object code and the binary. In addition, the variable location randomization operation 506 is substantially similar to the corresponding technique used during the build process (in operation 406).
In this embodiment, in operation 508, the binary (rather than the object code) is updated with the new variable locations. The instructions are the same in both cases, and the contents will be written are the same. This is because the binary (or any section inside the binary) will not change in size because only the offset values (the offsets relative to the frame pointer) are being replaced and no data is added. According to this embodiment, a new (or a replacement) binary is generated in which the locations of the variables are shuffled from their locations in the original binary. According to one embodiment, this process is implemented by a computer program that takes a binary as input and that outputs a modified binary in which the locations of the variables in one or more of the functions are shuffled.
According to another embodiment of the present invention, the locations of variables on the stack are randomized on application load (when the application is loaded to be run). FIG. 6 is a process flow diagram illustrating a method 600 of randomizing the locations of variables on the stack after a compiled and linked executable binary file (or binary) is loaded into memory for execution in accordance with one embodiment of the present invention.
Identification of variable locations on the stack after the build process in operation 604 is substantially similar to the technique used during the build process (in operation 404) and the technique used after the build process (in operation 504) because the same instructions are present in both the object code and the binary loaded into memory. In addition, the variable location randomization operation 606 is substantially similar to the corresponding technique used during the build process (in operation 406) and after the build process (in operation 506).
In this embodiment, after the locations of the variables are identified in operation 604 and the locations of the variables are randomized in operation 606, the code in memory is updated in operation 608 (in contrast to the code in the binary on disk being updated in operation 508 of the embodiment in method 500). Apart from this difference, this embodiment is substantially similar to the embodiment in which the binary file is modified.
In this embodiment, because the variable locations are randomized each time the application is loaded into memory, each separate run of the application results in a different shuffling (or randomization) of the locations of the variables on the stack, thereby further increasing the diversity of the system. According to one embodiment, this process is implemented by an executable loader (e.g., ELF loader such as 'execve' in Linux) that is configured to modify the binary code while the application is being loaded into memory or after the application is loaded into memory. Some embodiments of the present invention implement this with a modified loader at the operating system level.
According to another embodiment of the present invention, a running application randomizes the locations of variables on the stack during execution. FIG. 7 is a process flow diagram illustrating a method 700 of randomizing the locations of variables on the stack during execution in accordance with one embodiment of the present invention.
In this embodiment, the binary application itself includes code to perform the randomization of the variables throughout its own code in memory. This randomization code can be called during execution at "randomization points," which can be triggered based on a timer or when execution reaches a particular state. This embodiment is substantially similar to the randomization process that takes place during application load, but differs in that the randomization code is built into the application rather than a component of the loader process.
In one embodiment, the randomization code can be automatically inserted into the application by using a modified compiler. In some embodiments, the modified compiler may be created by patching an existing compiler. In another embodiment, the randomization code can be incorporated into an application by incorporating a library for randomizing the stack locations into the program. In still another embodiment the randomization code can be incorporated into an application by running a macro on or including a macro in the source code of the application.
In some embodiments of the present invention, the randomization code is provided in a modified application virtual machine (e.g., Java® Virtual Machine, Low Level Virtual Machine, Python, Ruby, Common Language Infrastructure Virtual Execution System, or Mono™ Code Execution Engine). According to one such embodiment, the randomization process is performed on compiled bytecode loaded into memory by the application virtual machine.
Embodiments of the present invention may impose some upfront performance cost at load time due to the shuffling process, but would cause no performance impact during operation. In addition, embodiments of the present invention can work in concert with other stack security schemes such as stack canaries (see, e.g., Cowan et al., above) without requiring additional space on the stack. In addition, embodiments of the present invention do not require or depend on any OS-specific features such as address space layout randomization (ASLR), and can run on "bare-metal." Furthermore, embodiments of the present invention provide finer-grained approach than ASLR, thereby increasing the likelihood that the technique will be compatible with older ("legacy") software,
While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims, and equivalents thereof.
1. A computer implemented method of randomizing locations of variables in a stack associated with a software application, prior to said randomizing locations, the stack including, in order from a bottom of the stack to a top of the stack, a return address for a function call, a local variable and an attackable buffer, the method comprising:
identifying, by one or more processors, a local function in the software application;
identifying, by the one or more processors, a plurality of stack locations of a plurality of variables in the identified local function;
identifying, by the one or more processors, references to each of the plurality of variables in the identified local function;
shuffling, by an executable loader that loads the software application, the stack locations of the variables to produce shuffled stack locations of the variables, each time that the software application is loaded into a memory, wherein each execution of the software program results in a different shuffling, wherein said shuffled stack locations of the variables changes a critical stack distance between the return address for the local function and the attackable buffer, and wherein the critical stack distance is a sum of a size of the local variable and a size of the attackable buffer; and
updating the stack locations of the variables with the shuffled stack locations.
2. The method of claim 1, wherein the identifying the stack locations comprises identifying variables in object code, and
wherein the updating the stack locations of the variables comprises updating the object code with the shuffled stack locations.
3. The method of claim 1, wherein the identifying the stack locations comprises identifying variables in binary code, and
wherein the updating the stack locations of the variables comprises updating the binary code with the shuffled stack locations.
4. The method of claim 1, wherein the identifying the stack locations comprises identifying variables in executable code loaded into memory, and
wherein the updating the stack locations of the variables comprises updating the executable code loaded into memory with the shuffled stack locations.
5. The method of claim 4, wherein the shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations occur prior to execution of the executable code.
6. The method of claim 4, wherein the shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations occur during execution of the executable code.
7. A non-transitory computer readable medium embodying program instructions for execution by a data processing apparatus for randomizing locations of variables in a stack associated with a software application, prior to said randomizing locations, the stack including, in order from a bottom of the stack to a top of the stack, a return address for a function call, a local variable and an attackable buffer, the program instructions adapting the data processing apparatus for:
shuffling, by an executable loader that loads the software application, the stack locations of the variables to produce shuffled stack locations of the variables, each time that the software application is loaded into a memory, wherein each execution of the software program results in a different shuffling, aid wherein said shuffled stack locations of the variables changes a critical stack distance between the return address for the local function and the attackable buffer, and wherein the critical stack distance is a sum of a size of the local variable and a size of the attackable buffer; and
8. The non-transitory computer readable medium of claim 7, wherein the identifying the stack locations comprises identifying variables in object code, and
9. The non-transitory computer readable medium of claim 7, wherein the identifying the stack locations comprises identifying variables in binary code, and
10. The non-transitory computer readable medium of claim 7, wherein the identifying the stack locations comprises identifying variables in executable code loaded into memory, and
11. The non-transitory computer readable medium of claim 10, wherein the shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations occur prior to execution of the executable code.
12. The non-transitory computer readable medium of claim 10, wherein the shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations occur during execution of the executable code.
13. A computer system for randomizing locations of variables in a stack associated with a software application, prior to said randomizing locations, the stack including, in order from a bottom of the stack to a top of the stack, a return address for a function call, a local variable and an attackable buffer, comprising:
memory storing program instructions, the program instructions being configured to control the computer system to:
identify, by the processor, a local function in the software application;
identify, by the processor, a plurality of stack locations of a plurality of variables in the identified local function;
identify, by the processor, references to each of the plurality of variables in the identified local function;
shuffle, by an executable loader that loads the software application, the stack locations of the variables to produce shuffled stack locations of the variables, each time that the software application is loaded into the memory, wherein each execution of the software program results in a different shuffling, wherein said shuffled stack locations of the variables changes a critical stack distance between the return address for the local function and the attackable buffer, and wherein the critical stack distance is a sum of a size of the local variable and a size of the attackable buffer; and
update the stack locations of the variables with the shuffled stack locations.
14. The computer system of claim 13, wherein the identifying the stack locations comprises identifying variables in object code, and
15. The computer system of claim 13, wherein the identifying the stack locations comprises identifying variables in binary code, and
16. The computer system of claim 13, wherein the identifying the stack locations comprises identifying variables in executable code loaded into memory, and
17. The computer system of claim 16, wherein the shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations occur prior to execution of the executable code.
18. The computer system of claim 16, wherein the shuffling the stack locations of the variables to produce shuffled stack locations and the updating the stack locations of the variables with the shuffled stack locations occur during execution of the executable code.
US13/905,122 2013-05-29 2013-05-29 Intra stack frame randomization for protecting applications against code injection attack Active 2033-08-28 US9218467B2 (en)
US13/905,122 US9218467B2 (en) 2013-05-29 2013-05-29 Intra stack frame randomization for protecting applications against code injection attack
PCT/US2014/031687 WO2014193523A1 (en) 2013-05-29 2014-03-25 Intra stack frame randomization for protecting applications against code injection attack
US13/905,122 Active 2033-08-28 US9218467B2 (en) 2013-05-29 2013-05-29 Intra stack frame randomization for protecting applications against code injection attack
US10303861B2 (en) * 2017-01-26 2019-05-28 Immunant, Inc. Software diversification in external contexts
CN103338159B (en) * 2013-06-19 2016-08-10 华为技术有限公司 Round robin scheduling to achieve a method and apparatus
US9390264B2 (en) * 2014-04-18 2016-07-12 Qualcomm Incorporated Hardware-based stack control information protection
US10268601B2 (en) 2016-06-17 2019-04-23 Massachusetts Institute Of Technology Timely randomized memory protection
US10310991B2 (en) * 2016-08-11 2019-06-04 Massachusetts Institute Of Technology Timely address space randomization
WO2000039956A1 (en) 1998-12-30 2000-07-06 Rainbow Technologies, Inc. A method of software protection using a random code generator
US20020016918A1 (en) * 2000-05-12 2002-02-07 David Tucker Information security method and system
US6578094B1 (en) * 2000-03-02 2003-06-10 International Business Machines Corporation Method for preventing buffer overflow attacks
US20050183072A1 (en) * 1999-07-29 2005-08-18 Intertrust Technologies Corporation Software self-defense systems and methods
US20070039048A1 (en) * 2005-08-12 2007-02-15 Microsoft Corporation Obfuscating computer code to prevent an attack
US20080016314A1 (en) * 2006-07-12 2008-01-17 Lixin Li Diversity-based security system and method
US20100082945A1 (en) 2008-09-30 2010-04-01 Nec Electronics Corporation Multi-thread processor and its hardware thread scheduling method
US7945953B1 (en) * 2005-07-06 2011-05-17 Symantec Corporation Method to identify buffer overflows and RLIBC attacks
US20120173497A1 (en) 2011-01-02 2012-07-05 Cisco Technology, Inc. Defense-in-depth security for bytecode executables
US20120204039A1 (en) * 2011-02-09 2012-08-09 Apple Inc. Counteracting memory tracing on computing systems by code obfuscation
US20120260106A1 (en) 2011-04-07 2012-10-11 Apple Inc. System and method for binary layout randomization
Barrantes, Elena Gabriela, et al. "Randomized instruction set emulation." ACM Transactions on Information and System Security (TISSEC) 8.1 (2005): 3-40.
Chew, Monica, and Song, Dawn. "Mitigating buffer overflows by operating system randomization." Technical Report CMU-CS-02-197, Carnegie Mellon University, Dec. 2002, 11 pages.
Crispin Cowan, et al. "StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks." Proceedings of the 7th USENIX Security Symposium (Jan. 26-29, 1998). 15 pages.
Forrest, "Building Diverse Computer Systems", Operating Systerns, 1997, The Sixth Workshop On Hot Topics in Cape Cod, MS, USA, May 5-6 1997, Los Alamitos, CA, USA, IEEE Comput. Soc. US, May 5, 1997 (p. 67-72).
Haugh, Eric and Bishop, Matt. "Testing C Programs for Buffer Overflow Vulnerabilities." In Proceedings of the Network and Distributed System Security Symposium, 2003, 8 pages.
International Search Report for International Application No. PCT/US2014/031687, filed Mar. 25, 2014, International Search Report dated Jul. 1, 2014 and mailed Jul. 10, 2014 (4 pgs.).
James C. Foster; Buffer Overflow Attacks: Detect, Exploit, Prevent; Feb. 2005, Syngress, Chapter 5-Stack Overflows, Summary, pp. 202-203; downloaded from http://techbus.safaribooksonline.com/book/web-development/1932266674 on Sep. 15, 2015. *
Kc, Gaurav S., et al. "Countering code-injection attacks with instruction-set randomization." Proceedings of the 10th ACM conference on Computer and communications security. ACM, 2003, pp. 272-280.
Shacham, Hovav, et al. "On the effectiveness of address-space randomization." Proceedings of the 11th ACM conference on Computer and communications security. ACM, 2004, 10 pages.
Whitehouse, Ollie. "An analysis of address space layout randomization on Windows Vista." Symantec advanced threat research (2007): 1-14.
Written Opinion of the International Searching Authority for international Application No. PCT/US2014/031687, filed Mar. 25, 2014, Written Opinion of the International Searching Authority mailed Jul. 10, 2014 (6 pgs.).
Yang-Seo Choi, Dong-il Seo and Sung-Won Sohn; A New Stack Buffer Overflow Hacking Defense Technique with Memory Address Confirmation; 2002, Springer-Verlag Berlin Heidelberg 2002, pp. 1-14, downloaded from http://link.springer.com/chapter/10.1007%2F3-540-45861-1-12 on Sep. 15, 2015. *
Xu et al. 2015 Controlled-channel attacks: Deterministic side channels for untrusted operating systems
US7093239B1 (en) 2006-08-15 Computer immune system and method for detecting unwanted code in a computer system
EP2281234B1 (en) 2018-08-01 Method for validating an untrusted native code module
Arnold et al. 2009 Ksplice: Automatic rebootless kernel updates
Carlini et al. 2015 Control-flow bending: On the effectiveness of control-flow integrity
Tice et al. 2014 Enforcing Forward-Edge Control-Flow Integrity in {GCC} & {LLVM}
EP2281258B1 (en) 2015-08-12 Method for safely executing an untrusted native code module on a computing device
US5721927A (en) 1998-02-24 Method for verifying contiquity of a binary translated block of instructions by attaching a compare and/or branch instruction to predecessor block of instructions
US20120216281A1 (en) 2012-08-23 Systems and Methods for Providing a Computing Device Having a Secure Operating System Kernel
Pappas et al. 2012 Smashing the gadgets: Hindering return-oriented programming using in-place code randomization
US6996677B2 (en) 2006-02-07 Method and apparatus for protecting memory stacks
US8136091B2 (en) 2012-03-13 Architectural support for software-based protection
US7603704B2 (en) 2009-10-13 Secure execution of a computer program using a code cache
US7886148B2 (en) 2011-02-08 Secure execution of a computer program
Li et al. 2010 Defeating return-oriented rootkits with return-less kernels
Checkoway et al. 2010 Return-oriented programming without returns
US20080250216A1 (en) 2008-10-09 Protected function calling
Castro et al. 2006 Securing software by enforcing data-flow integrity
US8739160B1 (en) 2014-05-27 Methods and systems for safe execution of guest code in virtual machine context
US8479174B2 (en) 2013-07-02 Method, computer program and computer for analyzing an executable computer file
Pappas et al. 2013 Transparent {ROP} Exploit Mitigation Using Indirect Branch Tracing
EP1870829B1 (en) 2014-12-03 Securing software by enforcing data flow integrity
Lee et al. 2004 Enlisting hardware architecture to thwart malicious code injection
US5887159A (en) 1999-03-23 Dynamically determining instruction hint fields
Kornau 2010 Return oriented programming for the ARM architecture
Owner name: RAYTHEON BBN TECHNOLOGIES, CORP., MASSACHUSETTS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MATTHEWS, DAVID;MARTZ, ROBERT;REEL/FRAME:030519/0559
Owner name: AFRL/RIJ, NEW YORK
Free format text: CONFIRMATORY LICENSE;ASSIGNOR:RAYTHEON BBN TECHNOLOGIES CORPORATION;REEL/FRAME:030601/0462
Owner name: RAYTHEON CYBER PRODUCTS, INC., VIRGINIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RAYTHEON BBN TECHNOLOGIES CORP.;REEL/FRAME:035794/0226
Owner name: RAYTHEON CYBER PRODUCTS, LLC, VIRGINIA
Free format text: CHANGE OF NAME;ASSIGNOR:RAYTHEON CYBER PRODUCTS, INC.;REEL/FRAME:035806/0367
Owner name: RAYTHEON COMPANY, MASSACHUSETTS
Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:WEBSENSE, INC.;RAYTHEON OAKLEY SYSTEMS, LLC;RAYTHEON CYBER PRODUCTS, LLC (FORMERLY KNOWN AS RAYTHEON CYBER PRODUCTS, INC.);AND OTHERS;REEL/FRAME:035859/0282
Owner name: FORCEPOINT FEDERAL LLC, VIRGINIA
Free format text: CHANGE OF NAME;ASSIGNOR:RAYTHEON CYBER PRODUCTS, LLC;REEL/FRAME:037821/0818
Owner name: FORCEPOINT LLC, TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:FORCEPOINT FEDERAL LLC;REEL/FRAME:043397/0460


text:
Venezuelans Hold Rival Marches for Workers' Day
By Lucas Koerner and Ricardo Vaz
Source: Venezuelanalysis.com
Posted in: Coups, Politics/Gov., US, Venezuela | No comments
Hundreds of thousands of Venezuelans took to the streets Wednesday in nationwide pro- and anti-government marches in commemoration of International Workers' Day.
On the opposition side, Juan Guaido had promised the day's mobilization would be the "largest march in history," marking the "final phase" of his effort to oust President Nicolas Maduro, known as "Operation Freedom."
While considerable in size, the march did not, appear to exceed that of previous anti-government demonstrations which Guaido has been holding since he declared himself "interim president" on January 23.
Speaking at the rally, which concluded in the upscale eastern Caracas neighbourhood of El Marques, Guaido assured supporters that the "definitive" overthrow of Maduro was at hand.
The opposition leader also unveiled the next stage of "Operation Freedom," which he said will include "escalating strikes" by public employees leading to a "general strike." It is not clear at the time of writing whether any trade unions have endorsed the call.
The opposition march came on the heels of Tuesday's failed military putsch led by Guaido and fellow hard-right Popular WIll party leader Leopoldo Lopez, who escaped his house arrest with the help of rogue national intelligence agents.
From the early hours of Tuesday morning, military units alongside opposition militants occupied the Altamira overpass in eastern Caracas and tried to take the nearby La Carlota airbase. The insurrection was thwarted when the majority of armed service members withdrew, claiming that they had been deployed under false pretenses of an official military drill. Guaido later attempted to lead a march into western Caracas but was stopped in Chacaito by the National Guard, with Leopoldo Lopez subsequently fleeing to the Spanish embassy.
Tuesday's violent clashes between opposition supporters and authorities continued during Wednesday's march, with security forces deploying tear gas in Caracas and other cities, notably in the eastern Caracas district of Altamira and the surroundings of La Carlota airbase.
For his part, President Maduro also led a massive pro-government march through the streets of Caracas in repudiation of the previous day's escalating coup efforts and threats from Washington.
The march, considered among the larger Chavista mobilizations in recent years, began at multiple points before concluding at Miraflores Presidential Palace where Maduro addressed the crowd.
"Here the people of Venezuela stand victorious again," he told supporters, referring to Tuesday's events.
Maduro also pledged that Saturday and Sunday will see the Bolivarian Congress of the Peoples, which groups parties and social movements, hold meetings to debate and receive proposals in view of improving government policies.
Likewise speaking on Wednesday, US Secretary of State Mike Pompeo warned that the US might resort to military action to topple Maduro "if that's what's required."
"The president has been crystal clear and incredibly consistent. Military action is possible. If that's what's required, that's what the United States will do," Pompeo said on Fox Business Network.
US officials, such as National Security Advisor John Bolton and Special Envoy for Venezuela Elliott Abrams, have repeatedly stated that all options, including a military intervention, are "on the table."
Bolton reacted to the failed military putsch on Tuesday by urging Supreme Court President Maikel Moreno, Defense Minister Vladimir Padrino and Presidential Guard Commander Ivan Hernandez to "do what is right for Venezuela." He has claimed that Moreno, Padrino and Hernandez held talks with Guaido to negotiate the departure of President Maduro, but offered no evidence to substantiate the allegations.
Koerner's:
Far More Diversity in Venezuela's 'Muzzled' Media Than in US Corporate Press
Coup in Progress in Venezuela?
The Meaning of Maduro's Mandate
Will the Venezuelan Masses Still Stand with Maduro?
Caracas Mayor's Race
10 Dead, 200 Voting Centers Attacked
Authoritarianism in Venezuela?
Massive Protests in Venezuela
Opposition Activists Confess to Being Paid
Chavistas and Opposition Forces March


text:
Bafana Mlangeni (1967 – 11 July 2015) was a South African actor most famous for acting as Sibeko, a drunkard and security spy in the sitcom ''Emzini Wezinsizwa.

Acting career
Mlangeni acted as Sibeko, a spy for security guards in a hostel compound and reported about events around the place mostly Room 8 where Roland Mqwebu (James Mkhize), Jerry Phele (Thabang Mofokeng), Jabulani Nkosi (Benson Chirwali), Vusi Thanda (Moses Tshawe) and Shadrack Ngema (inyanga uMagubane) lived. He also did the sitcom's soundtrack. He later acted on e.tv's eKasi: Our Stories and Mzansi Bioskop movies until his death.

Personal life
Mlangeni was married to Maki Mlangeni for 12 years and had five children with her. She described him as "a loving husband who cracked jokes even when they were quarreling".

Death
Mlangeni got ill and was admitted to hospital in mid-June while  he was shooting a film in Durban. He was discharged on 29 June 2015 and was admitted again on 11 July and Mlangeni died that same evening, 11 July 2015, at Bheki Mlangeni Hospital in Soweto. He was suffering from diabetes.

References

1967 births
2015 deaths
South African male actors
People from Soweto
Deaths from diabetes

redpajama_set_name: RedPajamaWikipedia


text:
Q: Count number of distinct values based on another set of distinct values I am trying to count a set of values based on another distinct value set:
-----------------------------------------------------
|CusID  |Agent1  |Agent2 |Agent 3 |Agent 4 |Agent 5 |
-----------------------------------------------------
|1      |Pat     |Pat    |Jane    |Simon   |Jane    |
|2      |Pater   |Pat    |Simon   |Simon   |Pat     |
|1      |Jane    |Jane   |Simon   |Pat     |Pat     |
|3      |Simon   |Simon  |Jane    |Pat     |Peter   |
|3      |Jane    |Simon  |Pat     |Pater   |Pat     |
-----------------------------------------------------

I want to get:
----------------------------------------------------------------------------
|CusIDUnq  |AgentName|Count|AgentName|Count|AgentName|Count|AgentName|Count|
----------------------------------------------------------------------------
|1         |Pat      |4    |Jane     |4    |Simon    |2    |Peter    |0    |
|2         |Pat      |2    |Jane     |0    |Simon    |2    |Pater    |1    |
|3         |Pat      |3    |Jane     |2    |Simon    |3    |Peter    |2    |
----------------------------------------------------------------------------

How can I do this using SQL?
Thanks in advance!
edit:
I need to tell that the number of customers and agents could change over time. So, I think a solution like below is also fine with me. The point is, I can't code the agent names or customer IDs into the query.
-----------------------
|CusID|AgentName|Count|
-----------------------
|1    |Pat      |4    |
|1    |Jane     |4    |
|1    |Simon    |2    |
|2    |Pat      |2    |
|2    |Simon    |2    |
|2    |Peter    |1    |

etc.
Here, I need to omit 0 results where an agent is not listed for a specific customer.
Again, many thanks!

A: If I understand correctly, you can do:
select id,
       sum(case when 'Pat' in (Agent1, Agent2, Agent3, Agent4, Agent5)
                then 1 else 0 end
           end) as num_pat,
       sum(case when 'Jane' in (Agent1, Agent2, Agent3, Agent4, Agent5)
                then 1 else 0 end
           end) as num_jane,
       sum(case when 'Simon' in (Agent1, Agent2, Agent3, Agent4, Agent5)
                then 1 else 0 end
           end) as num_simon,
       sum(case when 'Peter' in (Agent1, Agent2, Agent3, Agent4, Agent5)
                then 1 else 0 end
           end) as num_peter
from t
group by id;

This puts the counts in column names with the agent name, but that seems to be what you want.

A: After messing the logic I have got some result as below query
     SELECT CUST_ID, 'Pat'
     Case when 'Pat' IN (Agent1,Agent2,
       Agent3,Agent4,Agent5)
      then
      count(Agent1)+count(Agent2)+
         count(Agent3)+count(Agent4)+
          count(Agent5)
           else 0;
        End As 'Count_Pat',
      'Jane',

       Case when 'Jane' IN
       (Agent1,Agent2,
       Agent3,Agent4,Agent5)
      then
      count(Agent1)+count(Agent2)+
         count(Agent3)+count(Agent4)+
          count(Agent5)
           else 0;
        End as 'Count_Jane',
    'Simon',
     Case when 'Simon' IN
       (Agent1,Agent2,
       Agent3,Agent4,Agent5)
      then
      count(Agent1)+count(Agent2)+
         count(Agent3)+count(Agent4)+
          count(Agent5)
           else 0;
        End As 'Count_Simon',
         'Peter',
     Case when 'Peter' IN
       (Agent1,Agent2,
       Agent3,Agent4,Agent5)
      then
      count(Agent1)+count(Agent2)+
         count(Agent3)+count(Agent4)+
          count(Agent5)
           else 0;
        End as 'Count_Peter',

       From Table

       group by cust_id;

A: In your data model a cus record has exactly five agents and there is a priority (or timeline or the like) of agents, with one agent being Agent1, one agent being Agent2, and so on.
In your query, however, you don't want to treat the agents differently, you don't even care whether they stem from the same cus row. In order to treat them all alike, we'll convert your table to a mere cus-agent table where each row has a pair of cus and agent. Then we can simply aggregate and count.
select cusid, agent, count(*)
from
(
  select cusid, agent1 as agent from mytable
  union all
  select cusid, agent2 as agent from mytable
  union all
  select cusid, agent3 as agent from mytable
  union all
  select cusid, agent4 as agent from mytable
  union all
  select cusid, agent5 as agent from mytable
) cus_agent
group by cusid, agent
order by cusid, agent;

If you want separate columns rather than rows for the agents, then use above query and care about the layout in your GUI layer (i.e. use a loop in your app or Website).

redpajama_set_name: RedPajamaStackExchange


text:
Ермінескін 138 () — індіанська резервація в Канаді, у провінції Альберта, у межах муніципального району Ветасківін № 10.

Населення
За даними перепису 2016 року, індіанська резервація нараховувала 2457 осіб, показавши зростання на 31,1%, порівняно з 2011-м роком. Середня густина населення становила 23,5 осіб/км².

З офіційних мов обидвома одночасно володіли 5 жителів, тільки англійською — 2 390, а 5 — жодною з них. Усього 440 осіб вважали рідною мовою не одну з офіційних, з них 430 — одну з корінних мов.

Працездатне населення становило 49,6% усього населення, рівень безробіття — 28,8%.

Середній дохід на особу становив $20 242 (медіана $16 536), при цьому для чоловіків — $16 721, а для жінок $23 745 (медіани — $11 936 та $19 386 відповідно).

16,4% мешканців мали закінчену шкільну освіту, не мали закінченої шкільної освіти — 55,7%, 28,2% мали післяшкільну освіту, з яких 13,9% мали диплом бакалавра, або вищий.

Клімат
Середня річна температура становить 2,9°C, середня максимальна – 20,8°C, а середня мінімальна – -19,1°C. Середня річна кількість опадів – 496 мм.

Примітки

Населені пункти Альберти


text:
Identifinders Solves 1987 Roxanne Wood Homicide Based on Record Low Amount of DNA
Identifinders International in conjunction with the Michigan State Police, Niles Post, is pleased to announce the identification of 67-year-old Patrick Wayne Gilham for the 1987 murder of 30-year-old Roxanne Leigh Wood. Gilham has pleaded No Contest to Second Degree Murder and agreed to a minimum sentence of 23 years in prison. The case represents a landmark in the use of forensic genetic genealogy (FGG) as the decades-old DNA sample used to identify Roxanne's assailant was very low level and highly degraded, representing the contents of only a few cells of his body.
An undated photo of Roxanne Wood courtesy family.
Mrs. Wood, was found murdered in the kitchen of her home in Niles Township, Berrien County, MI, by her husband Terry Wood, on February 20, 1987. She had been stabbed numerous times and raped. The murder weapon was never located. Numerous leads were followed but no CODIS hit was achieved, and the case went cold.
The Wood homicide was considered high risk for FGG considering that the only DNA sample available consisted of two tubes of dried blood. The original amount of DNA was unknown, and the condition of the sample was shown to be highly degraded, leading to major processing complications that took months to resolve.
"This case was the toughest technical challenges we have faced, but it shows that we should never give up hope," said Colleen Fitzpatrick, President of Identifinders. "We are grateful to the Michigan State Police for having faith in us for the careful decision making it took to process the DNA and solve the case".
"Thank you so much for your hard work and dedication. This case would have gone unsolved forever. There's no way we could have done this without you.", Detective Sergeant John Moore said of Identifinders.
Identifinders would like to thank former independent contractor Gabriella Vargas for her hard work on this case.
About Identifinders International:
Identifinders International is an award-winning pioneer in the application of forensic genetic genealogy Y-DNA and autosomal SNP analysis to cold case homicides, sexual assaults, and Unidentified Doe cases.
Lori Jonasson2022-04-03T13:00:30-07:00


text:
After Roe v. Wade Leak, LGBTQ+ People Are in Big Trouble
TinyMart is sharing this content, the original was posted on advocate.com by John Casey May 03 2022 11:00 AM EDT So please click here to go there
If we are to believe that the leaked U.S. Supreme Court decision to overturn Roe v. Wade is true and that the majority opinion, written by Justice Samuel Alito, makes the point that abortion isn't mentioned in the Constitution, then we are truly and frighteningly headed for the dark ages.
The fact that women's rights will be almost negligible is only the beginning of what's to come. Brace yourselves for an onslaught of decisions that will also trample LGBTQ+ rights.
The words gay, lesbian, bisexual, transgender, and queer, to name a few, are not mentioned in the Constitution. Does that make our existence illegal?
Think about what else isn't listed in the Constitution. Voting rights, civil rights, desegregation, trains, cars, planes, telephones, cell phones, computers, the abacus, toys, games, passports, bars, restaurants, watches, jewelry, donkeys, horses, and dogs. Are these all illegal?
So what are these sanctimonious, narrow-minded, merciless firebrand, Bible-thumping, so-called justices preparing themselves to do next? They are gleefully ready to put Roe v. Wade in the trash bin of history. And because this decision is enormously consequential, my guess is that one of the justices (I guess Clarence Thomas) leaked the opinion in order to give states time to create their own anti-abortion laws before the SCOTUS decision is officially released, probably sometime late next month.
Thomas is just that sadistic. He would do something like this because he and his wife have zero respect for the court and for the LGBTQ+ community.
The leak was also a sign that if you are gay; if you are in a same-sex marriage; if you have sex; if you are transgender; if you're leaving an inheritance to your partner, husband, or wife; and on and on, you will be the next "no mentions" in the Constitution, and because of this, your rights will be stripped away.
The overturning of Roe v. Wade should come as no surprise. Amy Coney Barrett, Brett Kavanaugh, and Neil Gorsuch all gave various forms of vague responses to the case being precedent. The mealy-mouthed Sen. Susan Collins said that one of the reasons she was voting to confirm Kavanaugh to the court was that he told her he wouldn't overturn Roe v. Wade. How naive and utterly stupid was she to believe this liar.
They all basically hem-hawed around discussion of Roe v. Wade but settled on all saying the same thing about precedent. That's exactly what they did when asked about same-sex marriage too. They danced around the issue, feigned ignorance, and ridiculously said they wouldn't comment on "hypotheticals." However, in their subversive minds, Roe and same-sex marriage were never hypotheticals. They were on their target lists. Religious zealots who were chosen for the court to do "God's work."
Overturning Roe v. Wade is only a start. It lays down a marker for how far out these justices are willing to go. They are impervious to second-guessing, to appeals, to impeachment it seems. Six, and especially five, justices are out to demolish any rights that aren't "listed in the Constitution" but are listed in the Bible. They're using our precious document of freedom as a stabbing dagger and God's word as a sinister scalpel.
We got cocky. We've had so many rulings in our favor over the last two decades. Obliviously, we celebrated Pride, toasted our nuptials, and enlisted in the military. We were on our way to one day passing an equality law, not only in Congress but in statehouses around the country. We were striving hard not to be a marginalized community.
Alito, Kavanaugh, Coney Barrett, Gorsuch, and Thomas will do their utmost best to strip our marriage licenses, return us to dark alley bars, and make it a war crime for us to be in the military. These hideous and atrocious people sit in their high-backed chairs, with their highfalutin attitudes, and their subservient obedience to their higher power. Five cloistered individuals have the power to diminish, disparage, and deprecate our sexuality and identities and shred to pieces our carefully cultivated rainbow flag.
Roe v. Wade is just a start, and if they have the insolence and impertinence — the absolute gall — to take away abortion rights, God help us for what comes next. I fear the worst.
We can fight back at the ballot box. And while that is true, to so many it feels like it's not enough — but the power of a vote is important here. If every single one of us went to the polls, we'd make a difference; however, until we have that opportunity to cast our vote, we are going to be ripped to shreds by the pious right
The ultra-right-wingers have been calling us pedophiles and groomers and buttoning our mouths and taking away our books in libraries. Now that they have won the abortion battle, they are going to take all that they have done to us so far this year and use it as ammunition to call us out as immoral and call on the court to strike us down — in every capacity.
The disgusting moral uppishness of these so-called Christians is sin. Full stop. My grandmother always said that those who do you evil here on Earth will have a price to pay when they go to hell. I told them all that they will burn in hell a couple weeks ago. I still think that's true, and that my grandmother was right, but today after the alarm of Roe v. Wade, I don't think that living in hell is punishment enough.
We thought our fight was finally coming to an end. The overturning of Roe v. Wade proves our fight is just beginning, and it's not going to be easy, pretty, or victimless.


Lions, and tigers, and… SMILE! Sure, it's easy to get caught up in the wild escapades that await at Disney's Animal Kingdom theme park, but don't forget to take a moment and smile for the camera. Taking lots of photos simply means you'll have a chance to look back and remember the adventurous moments of your day in the jungle. Whether you are planning on taking your own pictures, having PhotoPass Cast Members take them, or doing both – here are our top 6 tips and tricks for making the most out of your Animal Kingdom photos.
At Animal Kingdom you'll find some unique characters that aren't available at any other parks. For example, Tarzan is available for a meet and greet at different times of the day (typically in the morning). You might see Tarzan in his squatting gorilla pose or even pounding his chest. When it's your turn to take a photo with him, don't be afraid to go a little wild yourself! Do the gorilla squatting pose with him and you'll have a character photo unlike any other. Same goes for being silly with Baloo and King Louie, or even Russell and Dug. Have fun with it while snapping great pictures of the experience!
Yes, you'll most definitely want to take a photo in front of the iconic Tree of Life that exudes all things Animal Kingdom. Take that one steps further and really explore the Tree and all it has to offer. This is fun to do as you walk trails around the tree and get up close and personal with the animals carved on the side of it, but we also recommend you look around for the Tree of Life throughout your day at the park. Different angles of the Tree make for fantastic photos. You can even take pictures of the inside of the Tree while enjoying the que for "It's Tough to Be a Bug". Plus, don't forget – now that the Tree of Life is being projected on at night with the "Tree of Life Awakenings", this is also a great time to catch photos of the Tree as it glimmers with vibrant colors.
Animal Kingdom is beautifully laid out with 5 incredible areas including the Oasis, Discovery Island, Africa, Asia, and DinoLand USA. Make it a goal to stop and take a picture by the sign in each one of these areas. This is also fun to do for a scrap book or photo album because you can use this photo as a header for the photos that took place in each section.
We've heard folks say that if you see Mickey, Minnie, Goofy, Donald, and Pluto once then you don't have to see them at the other parks. We disagree! If you are looking for great variety in your photos, you'll want to visit these "regulars" again at Animal Kingdom. They are dressed in their wilderness explorer gear which typically includes a safari hat and unique clothing. Their costumes at Animal Kingdom are some of the best we've seen them in! Want to see most of them but don't want to deal with the lines? Snag a reservation at the Tusker House for a character dining experience with this wild crew of favorites!
Some of our favorite photos are from Animal Kingdom's attractions. While conquering the Yeti at Expedition Everest or while racing out of the prehistoric period in your time rover on DINOSAUR, you'll want to be aware of where these attractions take a photo. Expedition Everest catches those brave enough to ride as they are being dumped out of the mountain down the large hill that is visible to the spectators below. On Dinosaur, look for the massive T-Rex on the right… let's just say you won't miss him. Have your family prepare a silly pose or just keep it memorable and let your natural fear shine through! When riding Kilimanjaro Safaris, try to take photos of those in your party looking at the animals that are also in the photo. When someone is in the picture the photos just tend to be more memorable when reminiscing in the future.
Maybe you're prepared to take photos in the usual important areas, but we highly suggest that whenever possible, think outside the box of "normal". Look for remote areas, snap pictures at different times of the day, say cheese with a Cast Member, take a selfie with a native, catch a shot of the family dancing during a street festival, or try a type of food you've never had before and share a photo of it on social media. It's these "outside the box" photos that will become the keepers!
What tips and tricks for taking photos at Animal Kingdom would you recommend? We'd love to hear from you!
Be sure to check out our Top 7 Photo Spots in Animal Kingdom!


MBS What does MBS stand for?
Also found in: Dictionary , Thesaurus , Medical , Financial , Encyclopedia , Wikipedia .
The MBS team representing Consolidated Water will be co-led by Lynn Morgen, partner and co-founder of MBS, and industrials and sustainability industry expert, Eric Prouty, senior consultant.
For the MBS fiscal year ended 31 August 2016, MBS generated revenue of approximately USD 499.
DJ Dal Pizzol is part of the institutional MBS sales group and brings 20 years experience in the inter-dealer MBS markets and dealer sales at regional MBS broker-dealers.
With Gemba, MBS has created a new blended learning model with 70 per cent face to face contact time to create a more personalised and intense learning and development experience alongside the rigorous academic programme.
There are hockey fans among MBS commissioners and employees who enjoy attending Spirit games.
We congratulate our new graduates who will now benefit from their world class business skills, as well as the global MBS alumni network.
MBS is distributing its products outside North America with the support of Alexander Herzog (HERZOG Services GmbH &Co.
Each of the responses to the 48 items of MBS was entered in 48 separate columns.
Sony's first-generation SAIT product (500 GB, 30 MBS native) was launched in 2003 and piqued user interest as the highest capacity tape solution available.
However, Fannie and Freddie do have large portfolios of MBS, which they have acquired by repurchasing the guaranteed MBS they or others have already sold to investors.
The Fannie/ Freddie time bomb: what happens to these giants when interest rates rise? Paul Sarbanes: call your office!
In this paper, the fracture and impact resistance of PVC/MBS blends in Izod impact tests, carried out with different MBS levels and particle size are explained by classifying them into three types.
Of the sulfenamide accelerators, MBS and DIBS are suspected of forming carcinogenic N-nitrosamines.


text:
Whoopie Goldberg
Whoopie Goldberg and Stephanie after Stephanie's performance at an award show honoring Whoopie.
Aretha Franklin, Stephanie and daughter Yolanda after a recording session for the pop hit "Jump to it", produced by Luther Vandross.
Stephanie and Tony Bennett at Ceasers Palace on New Year's Day,1999.
Little Richard and Stephanie backstage having fun and talking over old times during one of Stephanie's many Las Vegas engagements
Elvis Presely and Stephanie in a rare photo opportunity, back stage at Ceasers Palace after one of her many successful performances with Tom Jones.
Julio Iglesias and Stephanie in one of many photo opportunities during their five year singing relationship, where Stephanie sang duets and background with Julio on stage, his CD's, and on many of his world tours.
Stephanie and Magic Johnson at an award show honoring Dr. Martin Luther King's birthday
Stephanie in Palm Springs after one of her crowd pleasing performances getting up close and personal with Frank Sinatra.
Stephanie getting a huge hug from Antonio Banderas after her performance for the premier of Antonio's block buster "Mask of Zorro".
Tina Turner and Stephanie's mother, Olivia and brother, "Bunky"
Stephanie getting a huge from Michael Jackson after their recording session, where Stephanie directed the choir and sang for the reunion of the Jackson 5's "Triumph" album.
Celine Dion, Whitney Houston and Andrea Bocelli
Stephanie with Celine Dion, Whitney Houston and Andrea Bocelli after Stephanie's performance with Mariah Carey & Whitney Houston at the 71st Academy Awards.