Hello, everyone.
I am the host for this talk.
I am Berman.
Today's talk is very interesting.
AD's security has always been the key to security defense.
It is also the area where the Red and Blue teams must fight.
In recent years, AD's security has also been discussed very popularly.
So you can see from Black Hat, Defcon, and Hikon.
In fact, a lot of AD talks are getting more and more.
Today's speaker is a researcher at the OECD.
This is John Sboik.
Today they will talk about interesting problems and interesting phenomena in AD.
Then we can share the face of security and discuss with you.
Next, I will give the time to the two of you.
Hello?
Test it.
Have you heard anything?
OK.
Let me start today's speech.
Hello everyone, I am Sboik.
Today's topic is Active Directory Safety.
Sometimes reality is more absurd than fiction.
Let me give you a little self-introduction.
I am the one on the right, Sboik.
On my left is John.
We are all researchers at OECD.
We are basically focused on AD security.
Today we are here for two years.
We did some tests with some customers.
Then do the collection, do the analysis, and get some feedback.
That's what I'm going to share with you today.
Let's talk about why there is this talk.
Basically, everyone knows that AD is really a loving and hateful service.
Basically, as long as you have a certain scale of a field.
Basically, in order to quickly and conveniently deploy some of yours.
Whether it's your script.
You have to manage your...
Every computer in this field, every user.
Then you will use AD, this domain service.
But AD, in the past year or two, especially in the past year or two.
A lot of security loopholes keep popping up.
For example, like our first body button.
Or the same account name spoofing at the back.
Or the CV number at the back of this Certify.
These CVs have been around for the past year or two.
Basically, you can do something like this.
Get such a full line of domain admin.
Or it can be said that you can do some relay attacks, etc.
That can make it very convenient for you.
From a nameless little account.
It becomes a voice.
It becomes an identity of a domain admin.
What about the last one?
It's a...
A lot of people are using it right now.
One of this local authorization.
You can say it's a loophole.
You can also say it's a feature.
Because Microsoft is not yet planning to do a repair.
So basically, you're using KB right now.
It's very convenient for you to do a local authorization.
It's a full-fledged function of local admin.
And then there's the AD security of the company itself.
In fact, at present.
There's really not a very good one.
A formalized way of checking.
To assess whether your own corporate field is safe enough.
So it's hard for you to know.
Your own AD health condition.
You don't have to say that AD administrator.
Do you know how your own health is?
Maybe it's all a big question mark.
So today we're going to go through our past two years.
To do a data collection.
Do a statistical analysis.
From small companies to large companies.
What are the general questions on management?
This question.
Then we often hear the company ask us.
That is to say.
Hey, I want to ask.
In the end, our corporate field and our AD situation.
How is it?
It's hard for us to say if we're doing well.
Can you tell us?
In fact, we will find that we ourselves.
It's hard to answer.
From this question.
It's hard for us to give a good answer.
From this data.
We can actually roughly infer.
That is to say, in small companies.
Because their environment is relatively simple.
So?
They rarely encounter some special AD.
Or a method of horizontal movement.
They don't have a problem with the division of power lines.
It's easier to find this.
High power line account.
It's easy to be a merge.
That is, they will have a lot of high power line accounts.
It may be placed under the same group.
That group.
As long as there is one person.
That he is giving special power lines.
Because there is no special service.
There is no very complex architecture.
So his situation is relatively.
Relatively speaking, it is relatively rare.
What about the replacement?
It's him who gives one or two accounts directly.
The power line is stretched to the highest power line.
And then it's convenient for him to do things.
What about his security settings?
Most of them are relatively untouched.
A stage that has been revised and modified.
That he has not been adjusted.
Maybe some default security settings.
It's enough to be in this small company.
That we hear more often.
Whether it's APD attack.
Or some.
Some new loopholes issued at major meetings.
This kind of connected use.
In fact, more of this is happening.
In this kind of large corporate AD.
That's because his security requirements are higher.
What about his entire management rights?
It needs to be more detailed.
That may be in the process of his cut.
There may be errors.
The other is that his service is very heavy.
The structure is huge.
So he might have some weird software.
Because these companies may be.
Old companies over 10 or 20 years old.
So he may have his AD.
The body itself is not very good.
So what about us?
Through the problems we just encountered.
These cases, these data.
We roughly divided it into five categories.
Such a common management problem classification.
Then we also gave him some.
This is different.
Different levels of classification.
That's basically not in the management.
At a good stage.
We don't need to talk about this.
And his sense is very good.
And he has done some training.
He knows how to make adjustments.
But in the trial management and management.
Of course, there are some errors.
We can see the obvious difference.
That is to say.
His account division.
In the trial management stage.
You know you want to change.
Such a division.
Such a full control.
But you don't have much historical experience.
So you may not be able to divide well.
There will still be some errors.
In the trial management and management.
At this stage of some experience.
You may still be because.
Different problems come out of different bags.
What about the full line of the board account?
It's in your trial management stage.
You won't go to the thing you care about.
It's because you're in your account.
The division has not been done yet.
You tell Huang Lun to do this.
The action of the full line of the board account.
But when you already have a little bit of management.
When this account division experience.
You will start to notice.
Is the distribution of the full line of the account suitable?
The full line of these settings.
Is it enough?
Let him do enough things.
Instead of doing the full moon action.
Then we started.
We will provide us.
Some case studies over the past two years.
Then we will start from these five management issues.
To introduce one by one.
The first one is the issue of group management.
We encounter a group management.
One of the most common problems is that.
He may not have a group management at all.
Such a concept.
In some companies' industries.
Is to put all the IT department's employee accounts directly.
Consistently put into some high power lines.
In this kind of group.
So we have seen some cases before.
The IT department's employee accounts.
He is all.
You just need to take down an IT department employee.
You use a fish attack or so on.
Get an IT department employee.
You become a domain name.
The other situation is that Microsoft has told you before.
You can use a cooperator.
You can use print operators.
But if you pay attention to him.
In the last few years of this documentation.
You will find out what he told you.
He told you.
Don't add any employees.
Don't add any accounts into the account operator.
You have to be careful to add the members of the print operator.
This is what everyone should pay attention to.
The AD manager should pay special attention to.
Do you understand these groups?
What is his history?
What is his best practice now?
So some people may put this account.
Put it in the account operator.
But he doesn't know the members of the account operator.
His authority is actually very big.
This kind of person may not need it at all.
Such an authority.
That one person failed.
All fall into place.
So we would suggest that the authority is divided.
The personnel and the account operator must be separated.
And then let your daily and your account operator.
There is such a separation.
So this is one of the cases we just mentioned.
We have two domains under a certain field.
These two domains have the same problem.
That is to say, some of his members.
Whether it's a computer or he's a user.
He will be a member of a domain name.
Then we can take a closer look at it.
It is composed of these members.
We usually think that the members of the management group.
It should be strongly connected.
He either is the same.
A naming rule of a high-power account.
Or it is said that he is in a different field.
But it's the only one in that department.
A more advanced supervisor.
But we see in this case.
The members in the case are composed.
Most of them come from different departments.
He even said that he mixed this user.
With a computer account to become a member.
Then we are not just looking at the domain name.
We are also looking at the same problem in the domain name.
This actually means that.
This is not a temporary violation.
But they were in this design.
Their mindset is already.
There is a conceptual error.
Then let's take a look again.
If you know you have to do this today.
But you can't do it again.
Then we will encounter a set of management groups.
This kind of.
Some of his little problems.
For example, he opened an additional management group.
A part of the request.
But his member composition is not clear.
He doesn't know.
Why is there an A member in here today?
That A member.
He shouldn't be in this group.
Who added him in?
In addition, there is a kind of.
He opened a lot of additional management groups.
He thinks he has to cut it very clearly.
But he is in all kinds of sets.
The whole line is blurred.
He can't know.
Is my group clean or not?
That's another management group.
The dispersion of the whole line.
But in fact, he doesn't know.
There is another group that is higher.
You can manipulate the member composition in this group.
So our suggestion.
The action is that you want to build a set.
A set of mechanisms to review.
Your member composition every time.
What about you?
Don't be too fragile when you cut the group.
But to do a real review and review.
That account and group.
The whole line should be executed regularly.
Regularly review.
Share with you.
We found that in a certain field.
There is a group called.
Password management.
But this password group.
But to a middle group.
That is, we put it.
To identify.
But he is actually a group.
And then this group.
He also has this right for users container.
So.
We may think that this.
The situation is more special.
Then we will ask the manager of this field.
Is there a group?
Then maybe we have heard a few cases.
Including like he might be in.
When the whole line is set.
It may be that the external manufacturer has not set it for us.
Or is it that they themselves have some business purposes.
And need to do something for users container.
A high-level operation.
That kind of operation.
He didn't understand that.
It turns out that password management can go.
Move to this any group.
Then he can indirectly from.
Members of password management.
Then go directly.
To the user account of this group.
So this is a very typical.
A case of problems caused by layers.
Okay, let's go to John.
This is the last three categories.
The rest of the categories.
Thank you.
Then I will share.
The following cases.
Then what we are going to talk about next is.
The classification of micro-channel and daily account.
In fact, we have been talking about this for a long time.
Then we still have to mention it here.
Then.
In many cases, we all know that.
We have heard thousands of times.
Your account is not mixed.
It is easy to cause credential blocking.
This matter.
Then maybe everyone knows.
But we are actually in many industries.
We will find other problems.
Is in addition to your manager.
Out of violation.
There will be other problems.
For example, software login.
We have met some customers.
He has a backup account.
This account will log into other people's computers.
What does he do with other people's computers?
Help backup information.
This matter is actually very common.
Then there are some events in the array.
Or some deployment software accounts.
It can all be logged into these computers.
So there are often some.
You do not expect the login event to happen.
And we are not just talking about credential blocking.
In fact, in addition to credential blocking.
There are other attacks.
Related to this login violation.
As long as we have logged in, we will leave the host.
Then the hacker can attack.
Then we are not talking about credential dumping now.
Catch credential this thing.
Catch credential, we often hear you say.
Have you ever heard of a hacker using a secret card?
This kind of thing.
Even hackers can use a secret card.
Use RubyS.
Or you have a local login.
MSCache this kind of thing.
There is a way to do dumping.
This thing is familiar to everyone.
And everyone has some practice.
Use Remote Credential Guard.
This kind of thing can prevent Catch Credential.
OK.
But it's not just Catch Credential.
There is also Relay Auth.
In fact, there are some attacks in the past two years.
That is to say, as long as you have logged in here.
I can force your account.
To verify other people.
This thing.
In most AD environments.
Everyone did not do well.
Prevent Relay Auth this thing.
So like we just mentioned.
KRB Relay Up.
Remote Potato.
And some earlier.
There was LSA RelayX two or three years ago.
This kind of attack.
These are all Relay Auth attacks.
Let's take a look later.
Actual cases.
Let's talk about it now.
We have seen in the client industry.
Jumpbox case.
What is the most exaggerated thing we have seen?
Within seven days.
There are 279 users.
RDP to the same computer.
You will find it ridiculous.
This is in many large series.
Wolfram Home stage.
Everyone RDP to this side first.
Then go to RDP to your own.
Management host.
This is a common operation.
So we often see some units.
Set up server.
Let the power supply host.
Then, for example, some are more lazy.
Some better ones will say.
One by one.
Some are lazier.
I put all the domain users in.
RDP group.
Then you will find out.
Why is this computer?
Everyone can light.
This is also what we often do for customers.
Find out when checking.
In this case.
Jumpbox 279 users.
Logged into the same computer.
We can do cross-session attack.
We will have a demo video later.
Let's talk about this.
In cross-session attack.
I can relay OS to these things.
For example, relay to ADCS host.
Because I talked about it in detail.
What are these two attack techniques?
But to be honest.
When you put this into the key search.
You will see.
How did he attack?
OK.
Then we will play a video next.
Then let's check it out now.
Our own identity rights.
We are an ordinary user.
Called Bob.
So we are now a.
RDP comes in.
But no one with any special rights.
Then we slowly connect to a host.
Called Creeper.
Then we see the error message now.
Access denied.
So it means.
We have no rights.
Then we will check.
Other people who are also logged into this host.
Then we will make it easy for everyone to understand.
We use Administrator.
Now Administrator is in.
17, 13, 14.
So there are other people with me.
Logging into the same host.
What about this time?
I forced.
For example.
14, 15, 17.
Administrator account.
Go to another one.
Computer verification.
At this time, I can do RelayAuthAttack.
Then we are here for 17.
This session went to a KRB Relay attack.
Then this attack.
You can check it out.
Then we got it here.
RelayAuthAttack.
Then we can help him kill a ShadowCredential.
In the Administrator account.
Then next.
We can use ShadowCredential.
The certificate that came out of the request.
To do the next attack.
Then we will copy it.
The certificate given by the attack.
Then paste it.
Now it is a ready-made tool.
After we do this thing.
The first point is.
Just such an attack.
He can get the user's NTLM hash.
And you can see that our FD1E starts.
Is the Administrator NTLM hash.
Then at the same time.
We passed the Tiki attack.
You can also do it.
Then we can succeed now.
Come in successfully.
Creep this account.
And.
His HostName.
You can see that we are.
We verified success.
We can log in normally.
So we successfully obtained.
The full line of the Administrator account.
And get one of his.
Help him kill a ShadowCredential behind the door.
We can continue to use this in the future.
ShadowCredential to log in.
OK.
So this is a common.
Some.
We are talking about.
When everyone logs into the same computer.
This kind of potential threat.
It's not just your ShadowCredential problem.
The situation just now.
You have a good setting.
Your security.
Mimika can't dump.
But you can be attacked.
To abuse.
Next is the setting check part.
We.
This thing is common.
Whether you are a large or small enterprise.
There will be this problem.
Then we come.
Quickly cover it up.
What kind of.
In some pre-set things.
Like Group Policy.
This is very common.
We have seen a lot of cases.
And just before.
The last speaker mentioned.
This kind of problem.
Then there are some Network Share.
Some things.
Network Share.
Everyone can save.
Some people can.
Attackers can.
Replace this Network Share file.
And from.
To cause some attacks.
Then we will have other cases later.
Then there are some.
Verification related things.
The full line and version of ADCS.
Set errors.
We will mention it later.
There is also A9-ADConnect.
Many companies.
Let's talk about a data.
Fortune.
The world's top 500 companies.
98% of companies.
Have used.
A9-ADConnect.
Why?
Because they all use.
Exchange Online.
This data.
Everyone can.
If you are interested.
You can check it online.
Then come again.
There are some 2FA services.
There is a link here.
CSA.
An alert report.
During the attack.
Using AD and 2FA.
Service.
Intermediate setting errors.
Then let him.
Can successfully enter the internet.
Then let's share the case.
That is.
This is our evidence.
That.
This thing.
In fact, it is.
Common in ADCS.
Environment.
That.
What we can see is.
The first part of the frame.
The first frame above.
That is.
This word is a bit small.
He is Authenticated User.
This thing.
Represent.
All users and computers.
Come again.
He is down there.
There will be a read.
Write.
Enroll.
here.
In fact.
Normally you only give enrol.
But we found that most.
Uh.
The past lessons may not be good.
Or if there is no course.
Everybody.
Either on full restrictions.
Or it's for the.
By the way.
That.
Enroll and write.
The preference.
So that he can wash the road.
When you give these things.
Users.
These users.
Can modify the content.
And then.
domain admin and basically you can't see this As mentioned earlier, last year's SAFETOPS mentioned 8 attacks in total.
If you are interested, ADCS has many error settings.
Let's talk about this process.
First, you are all users.
All users are domain user members.
All users can write a template.
Therefore, domain users modify the template to make it a complete template.
Next, any user can register this template.
Because it says on the template that any user can write and register.
Then we request a template.
And this template says I can represent anyone.
Then the user writes I can represent administrator.
I can represent other domain admins' accounts.
Next, after he gets the template, he can represent domain admin and make Kerberos TK request.
It's like in the video we used Rubius.
We used ASK TGT in Rubius.
It means after we get the template, we can make Kerberos TGT request.
This is one of the error settings.
Another error setting is AAD connect service.
If you understand AAD connect service, we can know that AAD connect service means you have to a domain admin account to install this service.
Why?
Because it has to use domain admin permissions to create a new account, which is MSOL initial account.
This account has a high domain permission.
Especially when you use password hash sync, it will give DC sync permission.
A long time ago, someone said if you can compromise an MSOL account, then you can do this attack.
It means I only have account operators.
In the previous version, account operators can modify the MSOL account password.
But it's not normal.
It's an account, but it's not normal because we have interviewed many clients and their teams are separated.
They don't think this can be done.
And this is fixed on Microsoft .
But if your MSOL has been installed for a long time, sorry , you have to modify this .
Microsoft provides script, but it won't modify it after you update it.
You have to fix this.
If you have been installing it for time , then
you have This kind of thing, we will talk about it later.
This small companies rarely encounter .
But medium -sized and large companies always encounter this problem.
Let's talk about the pain of this .
For certain assets , they don't about giving privileges .
Like we talked about before.
And in Microsoft when setting ACL, we have a property set.
You have 10 or 20 privileges it .
This is convenient.
But when you select this privilege, you don't know what is behind it.
This is so it is to understand this.
Let's share an example.
Exchange AD privileges creation.
We have this account.
It has a right DACL privilege .
In 2016, 2013 you may use RBAC or share permission model.
You may set these groups.
Organization management or Windows trust subsystem groups.
These groups in 2010 have right DACL privileges.
Microsoft modified the Exchange version.
Many people may have been since 2010 or 2020.
This is the same A9 AD Connect.
This privilege will not remove you.
You must remove it .
So why many Exchange in AD has a big .
But it is an attack path.
So when your Exchange is up 2010 , you may not know it exists .
You must do it.
Another privilege is that many companies have this privilege.
We know that many of you are from cyber or security people.
But some companies computer accounts.
Why?
You may have an answer.
Because you can add 10.
So to get around this mechanism, we will do a practice that allows join domain people to build a computer account .
Any group users OU can do some changes.
This is also a problem .
When you have this privilege , you will build a computer account .
For join domain people, the owner can set DSL for RBCD or shadow credential.
They may not need practice, but they may set machine account quota 0.
This makes it difficult for to create fake machine accounts.
This makes it difficult for to create them freely .
This is also done some units.
The main problem is that people build computer accounts have to these own computer objects.
The first thing is that the join domain people can't manage these computers.
The reason is that join domain is a small thing in a big company .
These things are not for busy IT people.
These are for external help desks.
If he is a manager , you don't need to fix anything .
But if not , this thing must be retrieved We know that it must be retrieved manually or retrieved manually .
Yes.
The last part is the core asset.
Let's talk about core assets.
Let's review the point of picture .
The core assets are in tier 0.
Tier 0 can affect the network domain.
The core assets are For example, AAD, ADCS, can control the region.
ADFS can control the cloud.
There are some LAPS servers, and so on.
There are some Python servers.
Python will send it to domain control or other important host.
It can send it to important host.
It is ignored.
And some features, password management platforms, and so on, can affect the network domain.
These are the core assets.
For example, let's say there is a compromised account.
It can successfully attack the password manager server .
But this client can't the password manager server .
It can't directly connect to the T20 server.
But the password manager server can get the local admin password.
The client doesn't know that the T20 server will pull data every day and execute it.
So the
client can every day and every day
and execute So
the client can't pull data it.
So the client can't pull data every day and execute it.
the server
can't data every day and So the can't
So the client can't data
So the client can't pull data day and it.
client can't pull data day and it.
So the client can't pull data every day and execute day and it.
client can't say don't It's relatively simple.
It doesn't have a complex setting.
It doesn't have a complex management structure.
So its biggest problem is in its management.
And its problem-solving part.
The bigger it gets, the bigger it gets.
When it's in such a field.
It's because of its whole business.
It's getting busier and busier.
It will begin to discover that it has some core assets.
For it, it's vague.
It doesn't know.
Then it has some problems with the whole line of accounts.
It can't be solved.
Then we finally analyzed the hot map.
Indeed, it also meets our initial assumption.
Then we can see that.
When you are in different field sizes.
The frequency of such a problem.
As shown in the picture.
So we can give you a suggestion.
That is to say.
You can first correspond to your own field.
How many units are there?
Then according to this unit.
You can follow a different role.
To see that.
Some of the problems you should deal with first.
With the problems you need to spend time and effort to deal with.
For example, if I am a big field today.
If I have more than 10,000 units.
Then what should I do?
In theory, you should divide the management group.
Daily account division.
Profit check.
This kind of basic work.
You can see that everyone is in the same field as you.
Other companies of this size.
They did a good job.
In theory.
You should do this part well.
That's the most common thing.
The whole line of accounts and core assets.
It's not clear.
Such a range.
Such a situation.
You should spend more effort.
To overcome such a problem.
And when you overcome it.
You're in the same one.
Uh, that's to say.
At the same level.
At this level.
You did better than anyone else.
So this is what we bring to you.
One of them is.
We are based on our.
This customer's field analysis.
A part of a hot map.
Then everyone should know.
Just set up a check.
You can see that.
In these three areas.
Its size.
Whether it's small or large.
There may be errors.
That means.
You should.
You can do some more.
Deployment software.
GPO.
Or some of your.
Some of the software introduced.
Some of its configuration.
You should all go through.
To understand.
And to set errors.
According to your.
This difference in demand.
You should go.
Set different values.
To make a best match.
So now.
Start now.
How do we do it?
We just mentioned.
Refer to today's briefing.
Research related questions.
According to your different.
Area size.
Find these competitors.
With you.
High mastery.
It's the green.
Network monthly rate.
Part of this sort of issue.
You should solve it first.
Solve first.
Encounter difficult questions.
You should go ask.
Some professional.
Advisor or consultant.
That better to do.
Ask the problem of the red.
This question area's type.
You should try.
More effort.
To cultivate.
Ah, this related training.
.
To train related.
These managers.
Ah.
And then let them.
To understand.
This problem more clearly.
How should it be.
It was revised.
How to do it?
A.
Uh, good this.
Cognition.
If it's the hungarian bullet.
OK, so that's it for today.
Let's see if you have any questions.
Thank you.
Let's give the speaker a round of applause.
Now, let's see...
We still have some time, so I'd like to leave the questions to the audience.
Is there anyone who would like to ask a question?
Please raise your hand.
Is there anyone who has a question?
OK.
While you are thinking about the question, you can think about the time.
There are a few questions on the line.
The first one is...
We just did a risk map.
A member of the audience would like to know how many customers have been collected and what is the industry distribution like?
Before doing this, I already thought that someone would ask this question.
I'm sorry.
I can't tell you the number of customers.
But what I can tell you is that in the past two years, we have done...
I can't tell you the exact number.
But in the past two years, we have done a lot of customers.
What are the cross-industry industries?
There are government, technology, and semiconductor.
The reason why I say technology and semiconductor are different is because some are factories, but they are not semiconductor industries.
Then, military, police, etc.
We have actually confirmed the distribution.
As for large and small industries, because we have less data on small industries.
But to be honest, we have seen a lot of small educational institutions.
Most of the questions are the same.
I hope I have answered the question about data.
Okay, thank you.
Although I can't give a clear answer on data, but I can share the size of the industries and companies.
I hope I have answered the question.
Now, let's go back to the scene.
Is there anyone who wants to discuss some issues with the speaker?
Okay, still no.
Then, I will give you some time to think.
Then, I will find another question online.
There is a person on the line who wants to submit an article.
If Blahunt can only find the shortest path to domain admin, how to find all potential paths?
Is there any tool?
Okay, we can't do it with Blahunt.
Actually, what Blahunt wants to show is the shortest path.
Is there any way to show it?
Blahunt is based on Neo4j.
Your algorithm actually has a way.
You can create a query by yourself.
You can create it like this.
But the problem is your source and destination.
How do you do this?
At present, there is no way to use tools to judge you.
You have to use Blahunt.
You must have a basic sense.
What is important?
Some people who have used Blahunt may know that Blahunt has high value.
But in fact, its high value definition is not complete.
So you have to find a way to calculate all the source and destination.
Then list all its possibilities with Neo4j.
Of course, it will take a long time to list.
This is its possibility.
You can do this.
Then you will list a little longer.
You can use Neo4j.
OK.
In fact, there is another question related to tools.
Is there any other tool like Blahunt?
Or how do you do it here?
Then calculate these risks and find these natural problems.
How do we do it?
This is not suitable to talk about here.
How do we do this?
Actually, our ML master is not here.
Otherwise, we can ask him to talk to you again.
Because we are actually doing AD expert.
Of course, we are not in control of those calculations.
OK.
It looks like some business secrets.
Let's ask if anyone wants to ask questions on the spot.
There are still a lot of questions online.
Then I will pick one here now.
There is a question from the audience.
Is there an environment suitable for practicing corporate AD detection and testing?
If you want to use it, I will recommend two things.
One is called Bayblot.
It is very suitable.
Its data is generated by a random.
You can use it to practice detection and testing.
Then...
OK.
A question from an old friend.
Have you ever seen a situation where you were injected with TierModel and was still injected?
Are there many such situations?
Are there many situations?
Few, but there are.
TierModel is what you think is cut, but it's actually not cut well.
Yes, it still happened.
I see a lot of questions on the spot.
But they all use Slido to ask questions.
I don't quite understand this question.
What he wants to ask is...
Where can we find AD professionals?
Then help us detect or ask some questions about full-line settings.
Sorry, I don't quite understand this question.
Let me ask like this first.
If you have any questions, you can help me supplement.
Where can we find AD professionals to provide full-line settings?
This question is very embarrassing.
I don't want to do business.
I'm very upright.
I don't want to do business.
Many manufacturers have this kind of consulting service.
I can't tell you.
After all, this is Hikam.
We are technical talk.
Okay, very good.
The person who just asked this question is also here.
Do you want to help me supplement?
Everyone is too shy.
We still have time for one more question.
Is there anyone at the scene who has some questions to discuss with the speaker?
It seems that most of the questions have been answered.
Welcome everyone to continue to discuss with the speaker after the meeting.
This is the end of our agenda.
Let's give two more speakers a round of applause.
Then we will end this agenda.