ASLR^Cache: Practical Cache Attacks on the MMU
|
|
|
- Natalie Lloyd
- 5 years ago
- Views:
Transcription
1 Cisco CRC - 45 minutes ASLR^: Practical Attacks on the MMU Ben Gras Kaveh Razavi Erik Bosman Herbert Bos Cristiano Giuffrida Vrije Universiteit Amsterdam 1
2 Teaser Compute virtual addresses of data & code With microarchitectural MMU side channel, not software Thereby breaking ASLR On all modern CPU models - Intel, AMD, ARM Even from JavaScript 2
3 Teaser Visualization - JavaScript - and no software bug There will be videos and other refreshments 3
4 Big picture: cached page tables Set Page 4
5 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 5
6 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 6
7 ASLR Main justification Response to exploitation in the 90s Exec Non-Exec Stack 0xbfffffff 0xbffffxyz 0x SHELLCODE Application 0x
8 ASLR Let s randomize both areas: ASLR Also DEP. So exploitation requires ROP+ASLR bypass Exec Non-Exec Stack 0x???????? 0x8048abc 0x8048def SHELLCODE Application 0x???????? 8
9 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 9
10 Side Channels Get secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g. Power analysis e.g. Timing e.g. RF 10
11 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 11
12 Big picture: cached page tables Set Page 12
13 Pagetable Walks From Page tables point to the next step in a tree 13
14 Pagetable Walks From 0x644b321f CR3: Level 4 Physical Addr 14
15 Pagetable Walks From Level 4 0x644b321f CR3: Level 4 Physical Addr 15
16 Pagetable Walks From Level 4 0x644b321f CR3: Level 4 Physical Addr 16
17 Pagetable Walks From Level 4 0x644b321f CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr 17
18 Pagetable Walks From 0x644b321f Level 4 Level 3 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr 18
19 Pagetable Walks From 0x644b321f Level 4 Level 3 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr 19
20 Pagetable Walks From 0x644b321f Level 4 Level 3 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr PTE 300: Level 2 Phys Addr 20
21 Pagetable Walks From 0x644b321f Level 4 Level 3 Level 2 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr 21
22 Pagetable Walks From 0x644b321f Level 4 Level 3 Level 2 Level 1 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr PTE 500: Target Phys Addr 22
23 Pagetable Walks From 0x644b321f Level 4 Level 3 Level 2 Level 1 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr TLB PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr PTE 500: Target Phys Addr 23
24 Pagetable Walks From 0x644b321f Level 4 Level 3 Level 2 Level 1 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr TLB PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr VAddr PAddr PTE 500: Target Phys Addr 24
25 Pagetable Walks From 0x644b321f Level 4 Level 3 Level 2 Level 1 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr TLB PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr VAddr PAddr PTE 500: Target Phys Addr PT Data 25
26 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 26
27 CPU s Logical layout of a CPU core and connection to Core Execution Unit Load/Store Unit Virt Addr TLB MMU Miss Fill CR3 PT Walker Phys Addr L2 L1 Data L3 (Shared) 27
28 CPU s Memory cache lines can only go into one small cache set Set 28
29 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
30 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
31 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
32 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
33 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
34 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
35 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
36 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
37 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
38 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
39 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
40 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
41 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
42 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
43 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
44 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
45 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
46 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
47 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
48 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
49 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
50 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
51 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
52 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
53 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
54 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
55 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
56 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
57 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
58 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
59 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
60 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Set
61 Tiny Example 2-way cache, 5 sets per page, showing 2 colors Eviction sets follow page offsets Set
62 Big picture: cached page tables Set Page 62
63 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 63
64 EVICT+TIME Flush TLB, forcing pagetable walk Evict first cacheline Measure lookup time Find cacheline dependencies 64
65 EVICT+TIME in 0x644b321f Level 4 Level 3 Level 2 Level 1 CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr TLB PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr VAddr PAddr PTE 500: Target Phys Addr
66 EVICT+TIME in PTE 200: Level 3 Phys Addr Level 4 Pagetable in 66
67 EVICT+TIME in PTE 200: Level 3 Phys Addr Level 4 Pagetable in 67
68 EVICT+TIME in Do address lookup PTE 200: Level 3 Phys Addr Level 4 Pagetable in 68
69 EVICT+TIME in Do address lookup PTE 200: Level 3 Phys Addr Level 4 Pagetable in 69
70 EVICT+TIME in It was uncached - slow PTE 200: Level 3 Phys Addr Level 4 Pagetable in 70
71 EVICT+TIME in Let s do it again PTE 200: Level 3 Phys Addr Level 4 Pagetable in 71
72 EVICT+TIME in It was cached - fast PTE 200: Level 3 Phys Addr Level 4 Pagetable in 72
73 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 73
74 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 74
75 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 75
76 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 76
77 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 77
78 EVICT+TIME in Eviction done - let s do lookup PTE 200: Level 3 Phys Addr Level 4 Pagetable in 78
79 EVICT+TIME in Eviction done - let s do lookup PTE 200: Level 3 Phys Addr Level 4 Pagetable in 79
80 EVICT+TIME in Still cached PTE 200: Level 3 Phys Addr Level 4 Pagetable in 80
81 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 81
82 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 82
83 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 83
84 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 84
85 EVICT+TIME in Let s evict PTE 200: Level 3 Phys Addr Level 4 Pagetable in 85
86 EVICT+TIME in Eviction done - let s do lookup PTE 200: Level 3 Phys Addr Level 4 Pagetable in 86
87 EVICT+TIME in Eviction done - let s do lookup PTE 200: Level 3 Phys Addr Level 4 Pagetable in 87
88 EVICT+TIME in Uncached now PTE 200: Level 3 Phys Addr Level 4 Pagetable in 88
89 Ambiguity 2 sources of ambiguity remaining Which are the 4 levels 0x644b321f Level 4 Level 3 Level 2 Level 1 8 slots per cacheline CR3: Level 4 Physical Addr PTE 200: Level 3 Phys Addr We have to vary the target PTE 300: Level 2 Phys Addr PTE 400: Level 1 Phys Addr This varies the slots PTE 500: Target Phys Addr 89
90 Big picture: cached page tables Set Page 90
91 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 91
92 JavaScript Complications A security boundary: sandbox There are some complications For code: a large block of JIT Instruction re-ordering Return right away Low resolution timer Don t forget to flush the itlb Contiguous virtual address space Prototypes in Firefox and Chrome 92
93 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 93
94 Results: speed Remaining virtual address entropy (bits) Chrome heap (PTL3 cacheline crossing) Firefox heap (PTL3 cacheline crossing) Firefox heap (PTL4 cacheline crossing) Firefox JIT (PTL2 cacheline crossing) Elapsed time (s) 94
95 Results: tested microarchitectures CPU Model Microarchitecture Year Intel Xeon E v5 Skylake 2015 Intel Core i7-6700k Skylake 2015 Intel Celeron N2840 Silvermont 2014 Intel Xeon E v2 Ivy Bridge EP 2013 Intel Atom C2750 Silvermont 2013 Intel Core i7-4500u Haswell 2013 Intel Core i7-3632qm Ivy Bridge 2012 Intel Core i7-2620qm Sandy Bridge 2011 Intel Core i5 M480 Westmere 2010 Intel Core i7 920 Nehalem 2008 AMD FX Core Piledriver 2012 AMD FX Core Piledriver 2012 AMD FX Core Bulldozer 2011 AMD Athlon II 640 X4 K AMD E-350 Bobcat 2010 AMD Phenom Core K Allwinner A64 ARM Cortex A Samsung Exynos 5800 ARM Cortex A Samsung Exynos 5800 ARM Cortex A Nvidia Tegra K1 CD580M-A1 ARM Cortex A Nvidia Tegra K1 CD570M-A1 ARM Cortex A15; LPAE
96 Outline Justification: ASLR Side Channels Pagetable walks CPU s EVICT+TIME JavaScript Results Demo 96
97 Reception Intel, AMD, ARM: CVE , , Chrome, Firefox, Safari, Edge: CVE Apple mitigation in ios, Safari and tvos updates Thank you NCSC-NL 97
98 Conclusion There is an micro-architectural MMU cache side channel Exploitable from JavaScript It breaks ASLR in sandboxed environments Project page: Native code: 98
99 Results: reliability False positive False negative Success rate Chrome 3 Levels Firefox 3 Levels Firefox 4 Levels 99
100 Results: noise Repeat measurements vs confidence margin 100
101 Who are we VUSec systems security academic research group Defensive & offensive security projects using systems techniques Aim to publish at S&P, CCS, NDSS, Usenix Security, SOSP, OSDI VU University in Amsterdam I am an intern with Cisco ASRG now 101
GLOBALMEET RELEASE 4.0
GLOBALMEET RELEASE 4.0 This release includes a major enhancement to webcam sharing, usability improvements, and fixes to issues reported by our customers. SUMMARY OF CHANGES NEW FEATURES AND ENHANCEMENTS
High Performance Computing for Engineers
High Performance Computing for Engineers David Thomas dt10@ic.ac.uk Room 903 HPCE / dt10 / 2012 / 0.1 High Performance Computing for Engineers Research Testing communication protocols Evaluating signal-processing
How do I get an Allocation?
How do I get an Allocation? How do I get time on an HPC system and what is available? You must submit a proposal for a project in order to gain access to an HPC system. We have two resources available
CAYUSE TRAINING INTRODUCING CAYUSE 424 & CAYUSE SP. ORA Project Team: Ralph Brown Johanna Eagan Katy Ginger Lisa Martinez-Conover
CAYUSE TRAINING INTRODUCING CAYUSE 424 & CAYUSE SP ORA Project Team: Ralph Brown Johanna Eagan Katy Ginger Lisa Martinez-Conover CAYUSE AGENDA What is Cayuse? Why now? What are some of the workflow changes?
TABLE OF CONTENTS. Updated 1/20/2014 Updated ref phy doc Page 2 of 10
TABLE OF CONTENTS Referring Physician Portal Log In................................................... Pg 3 WEB PORTAL Usage of PatientKeeper...........................................................
Success Story Enabling Global Growth with NVIDIA GRID
Success Story Enabling Global Growth with NVIDIA GRID #GTC17EU Enabling global growth with NVIDIA GRID Rody Kossen & Jits Langedijk AWL - Introduction Keeps you ahead in automated welding www.awl.nl 4
REQUEST FOR PROPOSALS Noise Monitoring and Flight Tracking System and Noise Monitor Service and Maintenance
REQUEST FOR PROPOSALS Noise Monitoring and Flight Tracking System and Noise Monitor Service and Maintenance In accordance with provisions of the Boca Raton Airport Authority Procurement Code (the "Procurement
High Performance Computing for Engineers
High Performance Computing for Engineers David Thomas dt10@ic.ac.uk Room 903 HPCE / dt10/ 2013 / 0.1 High Performance Computing for Engineers Research Testing communication protocols Evaluating signal-processing
CWE TM COMPATIBILITY ENFORCEMENT
CWE TM COMPATIBILITY ENFORCEMENT AUTOMATED SOURCE CODE ANALYSIS TO ENFORCE CWE COMPATIBILITY STREAMLINE CWE COMPATIBILITY ENFORCEMENT The Common Weakness Enumeration (CWE) compatibility enforcement module
Deployment Guide. GlobalMeet 5 June 27, 2018
1. Deployment Guide GlobalMeet 5 June 27, 2018 Table of Contents Introduction 3 Contents of this guide 3 Intended audience 3 Version information 3 What s new in this guide 4 About GlobalMeet 5 Meeting
CAYUSE RESEARCH INTRODUCING CAYUSE 424 & CAYUSE SP. ORA Project Team: Ralph Brown Johanna Eagan Katy Ginger Lisa Martinez-Conover
CAYUSE RESEARCH INTRODUCING CAYUSE 424 & CAYUSE SP ORA Project Team: Ralph Brown Johanna Eagan Katy Ginger Lisa Martinez-Conover CAYUSE AGENDA What is Cayuse? Why now? What are some of the workflow changes?
UNCLASSIFIED R-1 ITEM NOMENCLATURE
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Air Force DATE: February 2012 COST ($ in Millions) FY 2011 FY 2012 Base OCO Total FY 2014 FY 2015 FY 2016 FY 2017 Cost To Complete Total Cost Total
Matching System for Creative Projects and Freelance Workers: PaylancerHK
Department of Computer Science The University of Hong Kong Final Year Project (2015/16) Matching System for Creative Projects and Freelance Workers: PaylancerHK Interim Report 24 th January, 2016 Group
UNCLASSIFIED. UNCLASSIFIED Army Page 1 of 7 R-1 Line #9
Exhibit R-2, RDT&E Budget Item Justification: PB 2015 Army Date: March 2014 2040:, Development, Test & Evaluation, Army / BA 2: Applied COST ($ in Millions) Prior Years FY 2013 FY 2014 FY 2015 Base FY
Diving Into Telemedicine: Adventist Health s Virtual Care Network. Tuesday, July 25, 2017
Diving Into Telemedicine: Adventist Health s Virtual Care Network Tuesday, July 25, 2017 Diving Into Telemedicine with Adventist Health Featured Presenters Dan McCafferty V.P. of Global Sales & Corporate
Personal cloud computer available for everyone
Personal cloud computer available for everyone Boosteroid.com V.1.1 Personal cloud computer available for everyone Pre-ICO 22-29 September 2017 Token price: $0,1-0,47 ICO October 23 - November 6, 2017
EPCC A UK HPC CENTRE. Adrian Jackson. Research Architect
EPCC A UK HPC CENTRE http://www.epcc.ed.ac.uk Adrian Jackson adrianj@epcc.ed.ac.uk Research Architect International Aspect EPCC Edinburgh Parallel Computing Centre founded in 1990 at the University of
Oracle Talent Acquisition Cloud
Oracle Talent Acquisition Cloud Release 15B Release Content Document August 2016 Revised: August 2017 TABLE OF CONTENTS REVISION HISTORY... 3 OVERVIEW... 5 ORACLE TALENT ACQUISITION CLOUD... 6 ORACLE TALEO
Online Grant Application Instructions
Online Grant Application Instructions Before You Begin 1. Visit www.mainecf.org/grantapp.aspx. Review the instructions and gather the information you will need. Getting Started After you have gathered
GLOBALMEET USER GUIDE
GLOBALMEET USER GUIDE Release 4.0 October 2017 (REV2) Includes: GlobalMeet web meetings GlobalMeet desktop tools (Mac and Windows) GlobalMeet for Outlook (Mac and Windows) TABLE OF CONTENTS GlobalMeet
Siebel Installation Guide for Microsoft Windows. Siebel Innovation Pack 2017 July 2017
Siebel Installation Guide for Microsoft Windows Siebel Innovation Pack 2017 July 2017 Copyright 2005, 2017 Oracle and/or its affiliates. All rights reserved. This software and related documentation are
Next Steps to Revolutionary Change of Spectrum Usage
DoD CIO Next Steps to Revolutionary Change of Spectrum Usage Maj Gen Robert E. Wheeler (Ret) Slide 1 POWER TO THE EDGE Thesis Spectrum is an essential engine for economic strength, driving U.S. leadership
Active Shooter Preparedness
Active Shooter Preparedness Research Report Everbridge Critical Event Management Solutions Between 2014 and 2015, according to the FBI, the United States experienced nearly six times as many active shooter
UNCLASSIFIED/ AFCEA Alamo Chapter. MG Garrett S. Yee. Acting Cybersecurity Director Army Chief Information Officer/G-6. June 2017 UNCLASSIFIED
AFCEA Alamo Chapter MG Garrett S. Yee Acting Cybersecurity Director Army Chief Information Officer/G-6 June 2017 1 We ve come a LONG way.. In 157 years. Tomorrow, July 21 st is a very important date for
Penetration Testing Is Dead! (Long Live Penetration Testing!)
Penetration Testing Is Dead! (Long Live Penetration Testing!) Katie Moussouris Chief Policy Officer HackerOne http://hackerone.com http://twitter.com/k8em0
Allworx Reach and Reach Link
Allworx Reach and Reach Link A Complete Business Communication System That Fits in Your Pocket Always stay connected with Allworx Reach. The Reach mobile app extends the rich functionality of your Allworx
Castles in the Clouds: Do we have the right battlement? (Cyber Situational Awareness)
Castles in the Clouds: Do we have the right battlement? (Cyber Situational Awareness) The Nation's Army in Cyberspace OVERALL CLASSIFICATION: US Army Cyber Command and Second Army 1 COL Mark Schonberg,
UNCLASSIFIED. R-1 ITEM NOMENCLATURE PE F: Multi-Service Systems Engineering FY 2012 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2012 Air Force DATE: February 2011 COST ($ in Millions) Total FY 2013 FY 2014 FY 2015 FY 2016 Cost To Complete Total Cost Total Program Element - 18.901
Delivering Medication Therapy Management Services in the Community hosted by St. John s University College of Pharmacy and Health Sciences
American Pharmacists Association s Delivering Medication Therapy Management Services in the Community hosted by St. John s University College of Pharmacy and Health Sciences Delivering Medication Therapy
XA1600E Development Board Reference Manual
XA1600E Development Board Reference Manual Contents 3 Introduction Block Diagram of the XA1600E Package contents Getting started 6 Overview XA1600E User interface XA1600E LED s, buttons, & jumpers 11 Pin
Blackjacking 0wning the Enterprise via Blackberry. Jesse x30n D Aguanno
Blackjacking 0wning the Enterprise via Blackberry Jesse x30n D Aguanno x30n@digrev.org jesse@praetoriang.net Defcon 14 - Las Vegas, NV USA 2006 Blackjacking 0wning the Enterprise via Blackberry Hello,
MASTERING THE LOGISTICS OF A LARGE SCALE HAZUS PROJECT
August 25, 2010 MASTERING THE LOGISTICS OF A LARGE SCALE HAZUS PROJECT Shanna Michael, CFM, AECOM Stefan Zink, CFM, Michael Baker Jr., Inc. Agenda Part 1: Project Overview Averaged Annualized Loss Estimation
Inteligentní pracovní prostředí
Inteligentní pracovní prostředí Zbyszek Lugsch Dimension Data Czech Republic a.s. accelerate your ambition What do workspaces look like today? Behaviour Environment Meetings Collaboration Important to
US Army/AMRDEC S&T Overview
Presented to: NDIA 61 st Annual Fuze Conference US Army/AMRDEC S&T Overview Distribution Statement A - Approved for Public Release - Distribution Unlimited. Review completed by AMRDEC Public Affairs Office
UNCLASSIFIED R-1 ITEM NOMENCLATURE
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Office of Secretary Of Defense DATE: February 2012 COST ($ in Millions) FY 2011 FY 2012 Base OCO Total FY 2014 FY 2015 FY 2016 FY 2017 Cost To Complete
Oracle. Project Portfolio Management Cloud Using Grants Management. Release 13 (update 17D) This guide also applies to on-premises implementations
Oracle Project Portfolio Management Cloud Release 13 (update 17D) This guide also applies to on-premises implementations Release 13 (update 17D) Part Number E89309-01 Copyright 2011-2017, Oracle and/or
The Value of Creating Simple and Seamless Collaboration
The Value of Creating Simple and Seamless Collaboration A New Era Technology White Paper Executive Summary One of the biggest challenges organizations face today is keeping up with the fast pace of change.
UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Army DATE: February 2012 COST ($ in Millions) FY 2011 FY 2012 Base OCO Total FY 2014 FY 2015 FY 2016 FY 2017 Cost To Complete Total Cost Total Program
INTRODUCTION TO SAIGON HI-TECH PARK
INTRODUCTION TO SAIGON HI-TECH PARK Ho Chi Minh City, September 17 th, 2014 TABLE OF CONTENTS 1. SHTP OVERVIEW 2. INVESTMENT IN SHTP 3. GOVERNMENT SUPPORT IN TECHNOLOGY SHTP OVERVIEW WHO WE ARE? Establishment:
Q2 Fiscal Year 2017 Conference Call. February 15, 2017
Q2 Fiscal Year 2017 Conference Call February 15, 2017 FORWARD-LOOKING STATEMENTS This presentation contains projections and other forward-looking statements regarding future events or the future financial
Request for Solutions: Distributed Live Virtual Constructive (dlvc) Prototype
1.0 Purpose Request for Solutions: Distributed Live Virtual Constructive (dlvc) Prototype This Request for Solutions is seeking a demonstratable system that balances computer processing for modeling and
BSIMM7 Brings Science to Software Security
BSIMM7 Brings Science to Software Security The seventh iteration of the Building Security In Maturity Model project is a tool you can use as a measuring stick for software security initiatives. By now,
AFCEA Mission Command Industry Engagement Symposium
UNCLASSIFIED/ AFCEA Mission Command Industry Engagement Symposium MG Pete Gallagher Director, Network CFT 3 April 2018 Network CFT Collaboration, Fusion & Transparency WARFIGHTING REQUIREMENTS Army Warfighters
Announcement of Request for DoD HPC Modernization Program HPC Equipment Reutilization Proposals
Date: 18 May 2018 Announcement of Request for DoD HPC Modernization Program HPC Equipment Reutilization Proposals I. INTRODUCTION Department of Defense (DoD) High Performance Computing Modernization Program
Psychiatric Consultant Guide SPIRIT CMTS. Care Management Tracking System. University of Washington aims.uw.edu
Psychiatric Consultant Guide SPIRIT CMTS Care Management Tracking System University of Washington aims.uw.edu rev. 9/20/2016 Table of Contents TOP TIPS & TRICKS... 1 INTRODUCTION... 2 PSYCHIATRIC CONSULTANT
Defense Daily Open Architecture Summit EMS Panel
Defense Daily Open Architecture Summit EMS Panel 4 November 2014 Dr. Richard Wittstruck PEO IEW&S Acting DPEO Defense Daily Open Architecture Summit 4 NOV 2014 1 IEWS Concept of Operations IEWS CONOPS:
Quick Start Guide for Cayuse - Cayuse SP/424
Quick Start Guide for Cayuse - Cayuse SP/424 WHAT IS Cayuse? Cayuse (electronic Sponsored Research Administration) is a software tool IIT has adopted for routing proposals, contracts, and other types of
Oracle Taleo Cloud for Midsize (TBE)
Oracle Taleo Cloud for Midsize (TBE) Release 17A1 New Feature Summary January 2017 TABLE OF CONTENTS REVISION HISTORY... 3 ORACLE TALEO CLOUD FOR MIDSIZE (TALEO BUSINESS EDITION)... 4 TALENT CENTER ENHANCEMENTS...
D x R. nursing INSTRUCTOR MANUAL STUDENT MANUAL TECHNICAL APPENDIX
D x R nursing INSTRUCTOR MANUAL STUDENT MANUAL TECHNICAL APPENDIX Contents Program Requirements...3 Browser Compatibility Requirements...4 Entering the Program...5 Step-by-Step Instructions...6-12 Performing
The Role of Universities in Local and Regional Development
The Role of Universities in Local and Regional Development www.sotarauta.info / twitter: @Sotarauta Many roles! Universities are different Disciplines are different Regions and cities are different Countries
Best Practices for Writing a Successful NSF MRI Grant Proposal
WHITE PAPER Best Practices for Writing a Successful NSF MRI Grant Proposal Eight steps to winning HPC cluster funding. Produced by The Major Research Instrumentation Program (MRI), administered by the
Single Integrated Ground Picture
Single Integrated Ground Picture 2003 Interoperability and System Integration Presented by: Anthony Lisuzzo Director, Intelligence and Information Directorate US ARMY CECOM 732-532-5557 Email: anthony.lisuzzo@mail1.monmouth.army.mil
REQUEST FOR PROPOSAL: SAN EXPANSION & OPTIMIZATION
REQUEST FOR PROPOSAL: SAN EXPANSION & OPTIMIZATION Issued: November 21, 2014 TABLE OF CONTENTS 1. Introduction...3 1.1 Purpose...3 1.2 Background...3 1.3 Summary of Services Required...3 2. Key Information
Freelancer.com reveals the 50 fastest growing online jobs for Q1 2012
PressRelease Under embargo until 26 April, 2012 Freelancer.com reveals the 50 fastest growing online jobs for Q1 2012 The economy cools, but business process outsourcing heats up; VAs allow businesses
VA Maine Telehealth Services
VA Maine Telehealth Services Tiffiny Rooney, MSN, RN BC Facility Telehealth Coordinator Objectives Overview and benefits Present state of VA Maine Telehealth Services Challenges faced through use and implementation
DARPA BAA Dispersed Computing Frequently Asked Questions
DARPA BAA 16 41 Dispersed Computing Frequently Asked Questions As of August 12, 2016 Q33. In the section that describes the Cover sheet, we must list: "Award instrument requested: procurement contract
USING JOBVITE TO OVERCOME THE STEM SKILLS SHORTAGE
USING JOBVITE TO OVERCOME THE STEM SKILLS SHORTAGE CHALLENGE Rapid talent attraction in a time of growth SOLUTION Jobvite Refer Jobvite Engage Jobvite Hire RESULTS 30% of hires came through referrals in
TYLER JUNIOR COLLEGE School of Continuing Studies 1530 SSW Loop 323 Tyler, TX
TYLER JUNIOR COLLEGE School of Continuing Studies 1530 SSW Loop 323 Tyler, TX 75701 1.800.298.5226 www.tjc.edu/continuingstudies/mycaa Education & Training Plan Physicians Office Assistant Professional
Dave Tuttle Director, Digital Strategy TMP Worldwide TMP Worldwide. The Digital Brand Authority.
Social Networking for EPCRecruitment Dave Tuttle Director, Digital Strategy TMP Worldwide Social Networking for Recruiting Show of hands What is a social network? Why social networking is important genda
Pamela Duncan, Ph.D PI COMPASS Trial Scott Rushing, Director Research Information Systems
ecompass for Health: Precision health at its best Pamela Duncan, Ph.D PI COMPASS Trial Scott Rushing, Director Research Information Systems 1 Clinical Informatics Solutions Require Clinical Vetting Value
Agile Working. BCS Wales, Cardiff Steve Gillies, BT. September 2010
Agile Working BCS Wales, Cardiff Steve Gillies, BT September 2010 What is Agile Working? the large scale adoption of flexible working practices e.g. home working, remote working and mobile working + the
Borough of Norristown Plymouth Township Montgomery County, PA
Case Study: Lafayette Street Transportation Improvements Borough of Norristown Plymouth Township Montgomery County, PA Case Study: Lafayette Street Transportation Improvements Context for Revitalization
Small Grant Application Guidelines & Instructions
Small Grant Application Guidelines & Instructions IMPORTANT ITEMS this year 1. Check the RDC website for submission deadlines. Remember that electronic forms are due at one deadline, then signed routed
Making Documents Smarter
Steve Barth Reflected Knowledge Consulting Making Documents Smarter Steve Barth Reflected Knowledge Consulting UN Department of Peacekeeping Operations Acción International Government Savings Bank (Thailand)
Current State WFRPC s current website is obsolete due to the new branding that will happen soon. It is cumbersome and difficult to update or edit.
Introduction The West Florida Regional Planning Council (WFRPC) invites web designers to respond to this Request for Request for Proposal (RFP). The focus of the RFP is to select a single organization
Rear Admiral Joe Carnevale
249 Rear Admiral Joe Carnevale To begin, let me make a couple of observations, one at the microscopic level and one at the macroscopic level. I bought a new computer on Friday, and I have spent the whole
UNCLASSIFIED. R-1 ITEM NOMENCLATURE PE D8Z: Central Test and Evaluation Investment Program (CTEIP) FY 2013 OCO
COST ($ in Millions) FY 2011 FY 2012 FY 2013 Base FY 2013 OCO FY 2013 Total FY 2014 FY 2015 FY 2016 FY 2017 Cost To Complete Total Cost Total Program Element 157.971 156.297 144.109-144.109 140.097 141.038
Leading in a global environment
Leading in a global environment What Thai Leaders Can Learn from the Best Companies for Leadership 16 March 2012 Bundit Chamrastarangkool Agenda 1 2 3 4 Latest survey findings Global trends and best practices
PRESENTATION TITLE. Cal State Apply Application
PRESENTATION TITLE Cal State Apply Application APPLICATION WINDOW OCTOBER 1 st NOVEMBER 30 th www.calstate.edu/apply Freshman Requirements URL: https://www2.calstate.edu/apply/freshman Application URL
Fault Tree Analysis (FTA) Kim R. Fowler KSU ECE February 2013
Fault Tree Analysis (FTA) Kim R. Fowler KSU ECE February 2013 Purpose for FTA In the face of potential failures, determine if design must change to improve: Reliability Safety Operation Secondary purposes:
MicroProbe: An Open Source Microbenchmark Generator Ported to the RISC-V ISA
IBM T. J. Watson Research Center MicroProbe: An Open Source Microbenchmark Generator Ported to the RISC-V ISA Schuyler Eldridge Ramon Bertran Alper Buyuktosunoglu Pradip Bose 7 th RISC-V Workshop, 2017
OUTAGAMIE COUNTY REQUEST FOR PROPOSAL FOR TRACT BOOK SCANNING AND HOSTING FOR REGISTER OF DEEDS
OUTAGAMIE COUNTY REQUEST FOR PROPOSAL FOR TRACT BOOK SCANNING AND HOSTING FOR REGISTER OF DEEDS DUE BY: April 13, 2015 1.0 Introduction and Background The Outagamie County Register of Deeds Department
Accelerating Commercial Innovation for National Defense
DIUx accelerates commercial innovation for national defense COMMERCIAL R&D OUTPACING FEDERAL R&D: > 3 to 1 ($bn) DIUx Value Space COMMERCIAL R&D: DIB vs. NEW ECONOMY ($bn) Source: Company filings BREAKTHROUGH
Telemedicine and Business Efficiency: Improving Patient Outcomes. White Paper April 2011
Telemedicine and Business Efficiency: Improving Patient Outcomes White Paper April 2011 Clinicians, Business Efficiency and Patient Outcomes As a healthcare professional, you must efficiently and consistently
REQUEST FOR APPLICATIONS. Health Equity Learning Series 5.0
REQUEST FOR APPLICATIONS Health Equity Learning Series 5.0 APPLICATION DEADLINE: Applications are due on or before October 31, 2017. FUNDING NOTIFICATION: Applicants will be notified of the status of their
UNCLASSIFIED FY 2008/2009 RDT&E,N BUDGET ITEM JUSTIFICATION SHEET DATE: February 2007 Exhibit R-2
Exhibit R-2 PROGRAM ELEMENT: 0203761N PROGRAM ELEMENT TITLE: RAPID TECHNOLOGY TRANSITION (RTT) COST: (Dollars in Thousands) Project Number & Title FY 2006 Actual FY 2007 FY 2008 FY 2009 FY 2010 FY 2011
UNCLASSIFIED FY 2016 OCO. FY 2016 Base
Exhibit R-2, RDT&E Budget Item Justification: PB 2016 Office of the Secretary Of Defense Date: February 2015 0400: Research, Development, Test & Evaluation, Defense-Wide / BA 3: Advanced Technology Development
Post-Masters Nurse Educator Graduate Certificate.
Dear Prospective Student: Thank you for your inquiry regarding the Post-Masters Nurse Educator Graduate Certificate. This program is an innovative, online program that provides MSN-prepared registered
Team 3: Communication Aspects In Urban Operations
Calhoun: The NPS Institutional Archive Faculty and Researcher Publications Faculty and Researcher Publications 2007-03 Team 3: Communication Aspects In Urban Operations Doll, T. http://hdl.handle.net/10945/35617
Psychiatric Consultant Guide CMTS. Care Management Tracking System. University of Washington aims.uw.edu
Psychiatric Consultant Guide CMTS Care Management Tracking System University of Washington aims.uw.edu rev. 8/13/2018 Table of Contents TOP TIPS & TRICKS... 1 INTRODUCTION... 2 PSYCHIATRIC CONSULTANT ACCOUNT
Change Management in Emergency Department: Implementation of Mobile. Communication Device at the IWK Health Centre Halifax Streamlining Emergency Care
Change Management in Emergency Department: Implementation of Mobile Communication Device at the IWK Health Centre Halifax Streamlining Emergency Care Using Technology Project By Zachariah Mathew B00609427
OPEN TECHNOLOGY AT THE CORE OF GLOBAL PAYMENTS %
OPEN TECHNOLOGY AT THE CORE OF GLOBAL PAYMENTS 160+ GLOBAL REACH Convenient access to local acquirers and alternative payment methods in 160+ countries 50% BUSINESS GROWTH Planet Payment won 50% more clients
Collaborative R&D Funding Infineon UK
Collaborative R&D Funding Infineon UK Electric Vehicle FP7 Funding Information Meeting SMMT 28 th June 2010 Helen Finch helen.finch@infineon.com First Collaborative Projects The Story So Far... Infineon
UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Army DATE: February 2012 COST ($ in Millions) FY 2011 FY 2012 Base OCO Total FY 2014 FY 2015 FY 2016 FY 2017 Cost To Complete Total Cost Total Program
FMS Education Reimbursement Expense Report (ER)
FMS Education Reimbursement Expense Report (ER) Important Information! You are required to complete and submit an Expense Report (ER) that is tied directly to your approved Travel Authorization (TA) 100%
Service Description: Cisco Managed Services for Application Centric Infrastructure (ACI)
Page 1 of 1 Service Description: Cisco Managed for Application Centric Infrastructure (ACI) Technology Addendum to Cisco Managed for Enterprise Common Service Description This document, referred to as
Depression in Late-Life Initiative
Depression in Late-Life Initiative Care Partners: Bridging Families, Clinics, and Communities to Advance Late-Life Depression Care Full Proposal Guidelines Background Archstone Foundation is a private
UNCLASSIFIED FY 2016 OCO. FY 2016 Base
Exhibit R-2, RDT&E Budget Item Justification: PB 2016 Army Date: February 2015 2040: Research, Development, Test & Evaluation, Army / BA 3: Advanced Technology Development (ATD) COST ($ in Millions) Prior
AIR COMMAND AND STAFF COLLEGE AIR UNIVERSITY UNDERSTANDING THE UNIQUE CHALLENGES OF THE CYBER DOMAIN. Kenneth J. Miller, Major, USAF
AU/ACSC/MILLER/AY10 AIR COMMAND AND STAFF COLLEGE AIR UNIVERSITY UNDERSTANDING THE UNIQUE CHALLENGES OF THE CYBER DOMAIN by Kenneth J. Miller, Major, USAF A Short Research Paper Submitted to the Faculty
ARMY RDT&E BUDGET ITEM JUSTIFICATION (R-2 Exhibit)
COST (In Thousands) FY1999 Actual FY 2002 FY 2003 FY2004 FY2005 to Army Joint STARS (TIARA) 5316 25676 17898 17713 12833 14372 11527 Continuing Continuing A. Mission Description and Justification: The
Computer Science Undergraduate Scholarship
Computer Science Undergraduate Scholarship Regulations The Computer Science Department at the University of Waikato runs an annual Scholarship examination. Up to 10 Scholarships are awarded on the basis
Turnpike Mitigation Program Application
Ohio Department of Transportation - Ohio Turnpike Infrastructure Commission Turnpike Mitigation Program Application The application has been improved to enable project sponsors to save the application
UNCLASSIFIED. FY 2016 Base FY 2016 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2016 Air Force Date: February 2015 3600: Research, Development, Test & Evaluation, Air Force / BA 3: Advanced Development (ATD) COST ($ in Millions) Prior
Site Manager Guide CMTS. Care Management Tracking System. University of Washington aims.uw.edu
Site Manager Guide CMTS Care Management Tracking System University of Washington aims.uw.edu rev. 8/13/2018 Table of Contents INTRODUCTION... 1 SITE MANAGER ACCOUNT ROLE... 1 ACCESSING CMTS... 2 SITE NAVIGATION
Research Opportunities at the NSA. William Klingensmith IAD Trusted Engineering Solutions MARCH 2015
Research Opportunities at the NSA William Klingensmith IAD Trusted Engineering Solutions MARCH 2015 AGENDA Innovations Broad Agency Announcement (BAA) Special Opportunities Request (SOR) Innovative Mission
BUILD OPERATE SECURE DEFEND
BUILD OPERATE SECURE DEFEND Moving Forward for the Warfighter Defense Information Systems Agency RADM Nancy A. Norton, USN Vice Director 1 Leadership DoD CIO USCYBERCOM LTG Alan Lynn Director, DISA Commander,
AIM Alberta Online Measurement Tool Manual. Instructions for Use Part 1: Set Up and Data Collection
AIM Alberta Online Measurement Tool Manual Instructions for Use Part 1: Set Up and Data Collection Spring 2015 Table of Contents Introduction... 2 Getting Started... 3 Set up your Clinic Profile... 4 Enter
HOW CONNECTING DISPARATE COMMUNICATION SYSTEMS CAN IMPROVE PATIENT OUTCOMES
HOW CONNECTING DISPARATE COMMUNICATION SYSTEMS CAN IMPROVE PATIENT OUTCOMES SM H HOW CONNECTING DISPARATE COMMUNICATION SYSTEMS CAN IMPROVE PATIENT OUTCOMESS High-performing healthcare systems are adopting
20% 20% 15% 10% 10% 10% 10% 5%
The AWA Award recognises excellence in workmanship, design, functionality and style of showrooms. The AWA Design Awards aim to: Entry conditions Only AWA Members may apply. The showroom must be in Australia.
Note: This is a must read for parents to avoid issues, missing deadlines, and unnecessary stress.
Subject: Online Registration for the 2017 NSF Regional Contests Dear Parent, Note: This is a must read for parents to avoid issues, missing deadlines, and unnecessary stress. Happy Diwali and New Year