The Art and Science
of Security Research
Gregory Conti
[email protected]
http://commons.wikimedia.org/wiki/File:Venus_botticelli_detail.jpg
The views expressed in this
presentation are those of the
author and do not reflect the
official policy or position of the
United States Military Academy,
the Department of the Army, the
Department of Defense or the
U.S. Government.
http://commons.wikimedia.org/wiki/File:Blurry_Prison.jpg
I am not a lawyer
http://commons.wikimedia.org/wiki/File:Honor%C3%A9_Daumier_018.jpg
What is Research?
The search for knowledge, with an
open mind, to establish novel
facts, solve new or existing
problems, prove new ideas, or
develop new theories, usually
using a scientific method.
http://en.wikipedia.org/wiki/Research
Edge of Human Knowledge
Science
Fiction
Classified
Paywall Future
Science
Work
Fiction
Future
Research Work
Papers
Courses
Proprietary
Books
Present 10 years 50 years
Why Research?
Advance human knowledge
Give back, so others can take
your work to the next level
Make yourself an expert
Valuable skill set
Fun and rewarding
Get credit, notoriety, profit
Build you resume
You are already doing the work
http://commons.wikimedia.org/wiki/File:Beakers.jpg
What hackers bring to the table
Native curiosity
Cleverness
Color outside the lines
Hackers do great work
Less constraints, Less fear
Freedom to choose problems
that industry or academia
cant/wont touch
Hackers can build things
Inspiration and obsession
Devious minds
Interesting ideas
Access to interesting data
Interesting acquaintances
http://commons.wikimedia.org/wiki/File:Noise_makers.jpg
http://commons.wikimedia.org/wiki/File:Lamborghini_Revent%C3%B3n_coloring.jpg
Seek to be the World Expert
In fact, researchers have Or at least an expert
settled on what they N world experts in the
believe is the magic room
number for true expertise: Momentum
ten thousand hours. Once at edge you will
- Malcolm Gladwell see problems (and
Outliers solutions) that others
dont know exist
Depth vs. Breadth
http://en.wikipedia.org/wiki/File:D%26D_Game_1.jpg
Strategies for Finding Problems
Challenge Assumptions
http://peshawar.olx.com.pk/we-have-ready-stock-of-used-hard-disk-40gb-80gb-iid-21611687
Think Big
Cooperative Association for Internet Data Analysis (CAIDA)
2007 IPv4 Census Map (two-month ping sweep)
http://www.caida.org/research/id-consumption/census-map/
http://xkcd.com/195/
Think Small
Microsoft Word 2003 .doc Firefox Process Memory
Windows .dll Neverwinter Nights Database
Irritate Software, Hardware,
Protocols, and People
http://commons.wikimedia.org/wiki/File:Pearl_oyster.jpg
Detect Patterns
http://commons.wikimedia.org/wiki/File:Puzzle_Krypt-2.jpg
Detect Patterns
http://slashdot.org/index2.pl?fhfilter=bitcoin
http://justindupre.com/sunday-squakbox-what-are-your-thoughts-on-bitcoin/
Sense a Need
Darmawan Salihun, 2006
2 used from $679.00
http://www.amazon.com/BIOS-Disassembly-Ninjutsu-Uncovered/dp/1931769605/ref=sr_1_1?ie=UTF8&qid=1307758222&sr=8-1
Look at the Intersection of
Your Interest Areas
HCI Security
Malicious interface design
Design of privacy interfaces
Interfaces that lie
Error exploitation
Exploit Crazy Intersections
Carpal Nunchaku
Tunnel
Army
Carpal Tunnel
http://commons.wikimedia.org/wiki/File:Nunchaku_Routine.gif
http://www.medsupports.com/images/products/detail/8_242-&-8_243-Carpal-Tunnel.gif
Look for Pain
Bypassing the HR Filter
http://commons.wikimedia.org/wiki/File:Redbox_Office.jpg
What Makes You Mad
Flying Vodka Bottles
What Makes You Mad
Academic Spam
What Could Possibly Go Wrong
Self-wiping hard drives from Toshiba
http://www.net-security.org/secworld.php?id=10894
What Could Possibly Go Wrong
Voice Analysis Software in Russian ATMs
http://www.nytimes.com/imagepages/2011/06/09/business/AltATM2.html
What Could Possibly Go Wrong
Cloud Computing
http://commons.wikimedia.org/wiki/File:Cloud_applications.jpg
What Could Possibly Go Wrong
Look Under Rocks
http://commons.wikimedia.org/wiki/File:Stones_1646.jpg
Something Old
http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html
Something New
Google Makes Web Pages Load Instantly
The Chrome browser will soon silently fetch pages as you scan search
results so that they load without delay.
http://www.technologyreview.com/computing/37818/?p1=A1&a=f
Extend / Generalize
For example, sensors
CCD Fingerprint
Method-Identification of
a Video Camera from
Videotaped Images by
Kenji Kurosawa, Kenro
Kuroki, Naoki Saitoh
http://commons.wikimedia.org/wiki/File:Lehrredaktion_Do1_am_Institut_f%C3%BCr_Journalistik,_TU_Dortmund.JPG
Look to Science Fiction
Assume the Worst in People
Look at capabilities
Real Player Spyware, 1999
and not what people,
companies, or
governments say
they do
Sony Rootkit, 2005 Look at incentives
Apple Location Database, 2011
http://news.dmusic.com/article/21084
http://www.mcwetboy.net/maproom/images/sony_rootkit.jpg
Think Like a Nation-State
http://commons.wikimedia.org/wiki/File:Political_World_Map.jpg
Read the CFP
Infection vectors for malware Miscreant counterintelligence
(worms, viruses, etc.) Carding and identity theft
Botnets, command and control Denial-of-service attacks
channels Hardware vulnerabilities
Spyware Legal issues
Operational experience and case The arms race (rootkits, antianti-
studies virus, etc.)
Forensics New platforms (cellular networks,
Click fraud wireless networks, mobile devices)
Measurement studies Camouflage and detection
New threats and related Reverse engineering
challenges Vulnerability markets and zero-day
Boutique and targeted malware economics
Phishing Online money laundering
Spam Understanding the enemy
Underground economy Data collection challenges
USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET '11)
http://www.usenix.org/events/leet11/cfp/
Future Work
Martin Vuagnoux
and Sylvain Pasin.
Compromising
Electromagnetic
Emanations of
Wired and Wireless
Keyboards.
USENIX Security,
2009.
A Good Survey Article or Paper
is Always in Demand
And is an important part of your research program
http://commons.wikimedia.org/wiki/File:Seismic_Survey_Party.jpeg
And More
Work with someone else
Consider edge and corner cases
Examine implementations
Hardware is the new software
Exploit cloud resources
Defcon / BH / RSA talks
Develop a System
Feed your Mind
Have analog hobbies
Lathe and wizards wands
Got to take mind off work
Choose diverse sources
Slashdot
Wired
Technology Review
Books
Magazines
IEEE S&P
Make
Museum of Modern Art, NY Mailing Lists
IEEE Cipher
Blogs
http://commons.wikimedia.org/wiki/File:MoMa_NY_USA_screens.jpg
Build up your toolset
Coding
Hardware
Advanced Techniques
Datamining
Visualization
Information Theory
Speed reading
Communicating
Writing
Public Speaking
Write Down Your Ideas
Document discoveries:
Capture exact details
and dates of conception
Fill Unused
Be able to reproduce your
Space
work
Record ideas, observations,
and results
Chronological record of
your work
Use permanent Ink Date
Never remove pages Your
Signature
Witness
Source: www.bookfactory.com Signature
Other Techniques
Giant Pads of Paper Giant Post-it Notes Digital Voice Recorder
White Board Smart Board
http://commons.wikimedia.org/wiki/File:Integrator_step4_whiteboard_1000.jpg
http://www.amazon.com/gp/customer-media/product-gallery/B000F762Q4/ref=cm_ciu_pdp_images_0?ie=UTF8&index=0
http://www.amazon.com/Sony-ICD-BX800-Memory-Digital-Recorder/dp/B00387E5AS/ref=sr_1_1?ie=UTF8&qid=1308225530&sr=8-1
http://www.post-it.com/wps/portal/3M/en_US/Post_It/Global/Home/Products/Easel_Pads/?PC_7_RJH9U5230OT440II987MUE3CE7_nid=NPC4H48K27gsKK1GCH46K8glN2ZDWKD3XWbl
Watch for New Pieces of
Information
http://commons.wikimedia.org/wiki/File:Fire_buckets,_Minehead_Station_-_geograph.org.uk_-_1715978.jpg
Choosing the Right Problem
Life is short
Something you are
passionate about
Ability to get traction
Idea maturity
Not too early
Not too late
Develop many in parallel
Who pays your bills
Dont Rediscover Fire
http://commons.wikimedia.org/wiki/File:Feu_-_VTdJ.JPG
Chip Away at the Problem
Final
Goal
Build on What Others Have Done
Avoid duplication
Help energize your work
Give credit where credit is
due
Paywalls
80% is probably publicly
available
email authors
friend in college with DL
subscription, web search
http://en.wikipedia.org/wiki/File:Library_of_Congress,_Rosenwald_4,_Bl._5r.jpg
Reference Management
Lots of choices Aigaion, Bebop, BibDesk, Biblioscape, BibSonomy,
Bibus, Bookends, Citavi, CiteULike, Connotea, EndNote, JabRef, Jumper
2.0, KBibTeX, Mendeley, Papers, PDF Stacks, Pybliographer, Qiqqa,
refbase, RefDB, Reference Manager, Referencer, RefWorks, Scholar's Aid,
Sente, Wikindx , WizFolio, Zotero
See http://en.wikipedia.org/wiki/Comparison_of_reference_management_software
http://www.endnote.com/
Organize your Data
Versioning
yyyymm_na
me_verXX
The mess I
created
1M+ binary
fragments
Backing up
WTC
http://commons.wikimedia.org/wiki/File:Hard_disk_head_crash.jpg
The Target May Move
Final Initial
Goal Goal
Re(Search)
Blind alleys
Knowing something
doesnt work is also
knowledge
http://commons.wikimedia.org/wiki/File:Brick_alley.jpg
Get Feedback
Peers
Panels
Regional Cons
Groups at work
DC groups / 2600 Gatherings
Each makes you stronger and fleshes out
the idea
Collaborate
>How can I get in touch with You probably dont
you?
want to contact William
You can write to me in care of
my publishers. They will then
Gibson
compost your letter, allow it to
ferment for several months,
Google Docs
and eventually send it to me. I
will then neglect to reply, no
Building a team /
doubt suffering an incremental Research group
increase in negative karma. It's
up to you. But remember the
-William Gibson
mythical man month
http://williamgibsonboard.com/eve/forums/a/tpc/f/273109857/m/624109857
Start Local
DC Groups Hacker Spaces ISSA
2600 Meetings LUGs Colleges
Coping with Infinity
http://commons.wikimedia.org/wiki/File:E-portfolios-infinity-design.jpg
Write and Rewrite
Author Guidelines
Editorial Calendars
2012 IEEE Computer Society (Extract)
Look at What Editors Change
Getting to Cruising Altitude
Writing novels is hard, and
requires vast, unbroken slabs of
time. Four quiet hours is a
resource that I can put to good
use.
Two slabs of time, each two
hours long, might add up to the
same four hours, but are not
nearly as productive as an
unbroken four.
Neal Stephenson If I know that I am going to be
Why I am a Bad Correspondent interrupted, I can't concentrate,
and if I suspect that I might be
interrupted, I can't do anything at
all.
http://web.mac.com/nealstephenson/Neal_Stephensons_Site/Photos.html#0
http://web.mac.com/nealstephenson/Neal_Stephensons_Site/Bad_Correspondent.html
Major Life Events
No mathematician
should ever allow
himself to forget that
mathematics, more
than any other art or
science, is a young
man's game.
G.H. Hardy
A Mathematicians Apology
http://www.slate.com/id/2082960/
http://commons.wikimedia.org/wiki/File:Fliegergriff01.jpg
http://commons.wikimedia.org/wiki/File:%E3%82%BD%E3%83%95%E3%82%A3%E3%82%B9%E3%82%AB%
E3%83%A4%E5%AF%BA%E9%99%A2%E3%83%BB%E8%81%96%E7%B4%A2%E8%8F%B2%E4%BA%9C
%E6%95%99%E5%A0%82%E7%B5%90%E5%A9%9A%E5%BC%8F%E8%A8%98%E5%BF%B5%E5%86%99%
E7%9C%9F.jpg
Find a Place Where You are Creative
Interesting meetings, classes and talks Boring meetings, classes and talks
Airports / Airplanes Mall Food Courts / Restaurants / Pubs
http://www.flickr.com/photos/shootingsawk/2767119981/sizes/m/in/photostream/
http://commons.wikimedia.org/wiki/File:Melbourne_Airport_terminal.jpg
http://en.wikipedia.org/wiki/File:Food_court_edo_japan_la_belle_province_basha.jpg
Think in Terms of
Research Campaigns
Long Term
Inform decision
makers
Communicate
with different
audiences
Research vision
http://www.nps.gov/nr/twhp/wwwlps/lessons/107bennington/107locate2.htm
Research Funding
Small Business
Innovation Research
(SBIR) and Small
Business Technology
Transfer (STTR)
http://www.sbir.gov
NSF
DARPA
Lots of metawork
Lots strings usually
Thai Buddhist Money Trees
attached
Lots of competition
http://commons.wikimedia.org/wiki/File:Wat_money_trees.jpg
DARPA Cyber Fast Track
Designed to make
research funding
available for boutique
security companies and
hackerspaces
Watch
https://www.fbo.gov/ for
details
Also see the ShmooCon
2011 Keynote at
http://www.youtube.com/
watch?v=rDP6A5NMeA4
http://www.youtube.com/watch?v=rDP6A5NMeA4
Methodology, Etiquette and
Rules of the Road
Scientific Method
1. Ask a question
2. Do background research
3. Construct a hypothesis
4. Test your hypothesis by
doing an experiment
5. Analyze your data and
draw a conclusion
6. Report your results (Was
you hypothesis correct?)
http://en.wikipedia.org/wiki/Scientific_method
http://kbagdanov.files.wordpress.com/2009/04/scientificmethod.jpg
http://commons.wikimedia.org/wiki/File:Barbara_McClintock_at_C.S.H._1947-3.jpg
Rigor and Merit
(NSF Review Criteria)
Intellectual Merit Broader Impacts
How important is the Does the activity advance
activity to advancing discovery and
knowledge and understanding?
understanding? While promoting teaching,
How qualified is the training, and learning?
proposer? Include participation by
Does the project explore underrepresented groups?
creative, original or Will the results be
transformative concepts? disseminated broadly?
How well conceived and What are the benefits to
organized is the project? society?
Is there sufficient access
to resources?
http://www.nsf.gov/pubs/2011/nsf11690/nsf11690.htm#reviewcrit
Collisions in IdeaSpace
http://en.wikipedia.org/wiki/List_of_multiple_discoveries
http://commons.wikimedia.org/wiki/File:Sortie_de_l%27op%C3%A9ra_en_l%27an_2000-2.jpg
Institutional Review Board (IRB)
TUSKEGEE SYPHILIS STUDY (1932-1972) Approves, monitors and reviews research
US Public Health Service research involving human subjects.
600 low-income African-American males
from rural Alabama with a high incidence of
syphilis infection, were monitored for 40 Response to research abuses in the 20th
years.
Subjects were given free medical century, including Nazi experimentation and
examinations, but they were not told about the Tuskegee Syphilis Study.
their disease.
Even though a proven cure (penicillin)
became available in the 1950s, the study If you are dealing with human subjects,
continued until 1972 with participants and
their families being denied treatment. you may need IRB approval.
In some cases, when subjects were
diagnosed as having syphilis by other
physicians, researchers intervened to
prevent treatment.
The study was stopped in 1973 by the U.S.
Department of Health, Education, and
Welfare only after its existence was
exposed in a newspaper story, and it
became a political embarrassment.
In 1997, President Clinton apologized to
the study subjects and their families.
http://www.iupui.edu/~histwhs/G504.dir/irbhist.html
http://en.wikipedia.org/wiki/File:Tuskegee-syphilis-study_doctor-injecting-subject.jpg
Responsible Disclosure
Admittedly a
Holy war
How long to
wait before
disclosing a
vulnerability
Social
responsibility
vs. false
security
Siege of Ascalon - 1153
http://en.wikipedia.org/wiki/Responsible_disclosure
http://commons.wikimedia.org/wiki/File:Siege_of_Ascalon_%281153%29.jpg
Keep your Personal Research
Distinct from Work
Use your own time,
hardware, software
Read your employment
contract carefully and any
NDAs carefully
Dont let your personal
work touch your
employers resources.
Smart employers/schools
will respect your personal
IP
http://source.nycsca.org/pdf/it/ITF-1a.pdf
Misc
No dual submissions
Academic conferences probably dont pay travel or an honorarium
for speakers/panelists
Avoid asking people out of the blue to read your paper/article, a
thoughtful question or two is much better
Authors are typically sequenced from first author (biggest
contribution) to Nth author (least contribution)
Authors dont need to write a word
Sole author
When in doubt, acknowledge or cite
People get weird when you write up their ideas or work
With some research, discretion is advised
Even when drunk
Especially when the research is someone elses
A bit about Academia
Academia is a Lot Like RE/MAX
Academia and Industry
Follow the money
Research grants
Fads
Customers with money
Industry
Must make case for
bottom line
Your advantages
Passion
Academia
Academic Rank
Instructor
Assistant Professor
Associate Professor
Tenure usually starts here
Professor
Ranking of school != ranking of a
given program
Time
BS, 4 years
MS, 1-2 years
Usually requires BS, but Ive
seen exceptions
PhD, 4-7 years
Can pick up MS along the way
Finish your degree, then cure
cancer (Clark Ray)
http://commons.wikimedia.org/wiki/File:Academia-sumy.jpg
Outputs
Sharing Your Work and Leaving
Artifacts Behind
Slides
Code
Documented Code
Software
Documentation
Hardware
Documentation
Data
Video / Audio
Website / Blog
White Paper
Magazine Article
Research Paper
Journal Article
Book
http://commons.wikimedia.org/wiki/File:Samurai_swords,_Victoria_%26_Albert_Museum,_London_-_DSCF0364.JPG
Reproducibility
Stradivari Violins
Nepenthe
Antikythera Mechanism
Telharmonium
Library of Alexandria
Damascus Steel
Silphium
Roman Cement
Greek Fire
http://www.toptenz.net/top-10-lost-technologies.php
http://commons.wikimedia.org/wiki/File:Stradivarius_violin_back.jpg
http://commons.wikimedia.org/wiki/File:Stradivarius_violin_front.jpg
Write Up Your Ideas
Puts a timestamp on your work
Helps make sure your work is known
Strunk and White
Omit Unnecessary Words
Magazine / journal articles
You dont have to publish
Read authors guidelines
Doesnt hurt if you already subscribe
It is all about good fit
Publication
Getting published is not a problem.
Getting published in the right place
is the goal.
One good paper is better than several
fluffy ones.
Rooter: A Methodology for the Typical Unification of
Access Points and Redundancy
Jeremy Stribling, Daniel Aguayo and Maxwell Krohn
Accepted at WMSCI 2005
Many physicists would agree that, had it not
been for congestion control, the evaluation of
web browsers might never have occurred. In
fact, few hackers worldwide would disagree with
the essential unification of voice-over-IP and
public-private key pair. In order to solve this
riddle, we confirm that SMPs can be made
stochastic, cacheable, and interposable.
Academic Security Conferences
6/ 6/11- 6/ 8/11: POLICY, Pisa, Italy; 6/20/11: DSPAN, Lucca, Italy;
6/ 6/11: ACSAC, Walt Disney World Resort, FL; 6/20/11: FCS, Toronto, Ontario, Canada ;
6/ 6/11: CRiSIS Timisoara, Romania; 6/22/11- 6/24/11: TRUST, Pittsburgh, PA;
6/ 7/11- 6/10/11: ACNS; Malaga, Spain; 6/26/11- 6/28/11: RFIDSec, Amherst, MA;
6/ 7/11- 6/ 9/11: IFIP-SEC, Luzern Switzerland; 6/27/11: STC Chicago, IL;
6/10/11: EuroPKI Leuven, Belgium; 6/27/11- 6/29/11: ICSECS, Kuantan, Malaysia;
6/10/11: DSPSR, Melbourne, Australia; 6/27/11- 6/29/11: CSF, France ;
6/14/11- 6/17/11: WiSec, Hamburg Germany 6/27/11- 6/28/11: STM, Copenhagen, Denmark;
6/15/11: S&P Workshops, SF bay area, CA; 6/27/11: DRM, Chicago, IL;
6/15/11: SOFSEM-CryptoTrack Czech Republic; 6/28/11- 6/30/11: F2GC, Crete, Greece;
6/15/11- 6/17/11: SACMAT, Innsbruck, Austria; 6/28/11- 6/30/11: IWCS, Crete, Greece;
6/15/11- 6/17/11: USENIX-ATC, Portland, OR; 6/29/11- 7/ 1/11: IFIPTM, Copenhagen Denmark;
6/19/11: FAST; Leuven, Belgium; 6/30/11: FCC, Paris, France;
6/30/11: TrustCom Changsha China;
75 More
http://www.ieee-security.org/Calendar/cipher-hypercalendar.html
Publication Hierarchy
Poster Session
Technical Report
Workshop
Conference / Symposium
Journal
Also, Magazines, Books, and Book
Chapters, Technical Reviewer, White
Papers, Panels, Talks
Hierarchies within Hierarchies
Top Tier Security Conferences
IEEE Symposium on Security and Privacy
ACM Conference on Computer and
Communications Security
Crypto
Eurocrypt
Usenix Security
Dear XXX,
I am writing on behalf of the German publishing house, VDM Verlag Dr.
Mller AG & Co. KG. In the course of a research on the Internet, I came across
a reference to your thesis on YYY".
We are a German-based publisher whose aim is to make academic research
available to a wider audience.
VDM Verlag would be especially interested in publishing your dissertation in the
form of a printed book.
Your reply including an e-mail address to which I can send an e-mail with
further information in an attachment will be greatly appreciated.
I am looking forward to hearing from you.
--
Sebastien Latreille
Acquisition Editor
VDM Publishing House Ltd.
17, Meldrum Str. | Beau-Bassin | Mauritius Tel / Fax: +230 467-5601
[email protected] | www.vdm-publishing.com
Structure of a Research Paper
Title / Author List /Abstract
Background and Motivation
Related Work
Design
Implementation
Evaluation
Analysis
Conclusions
Future Work
Or
Publish it yourself
Self-publish a book
Start your own
conference
Self Publishing in the Underground Seek your own
Defcon 15
patent(s) and
trademarks
Start your own
business
http://video.google.com/videoplay?docid=3533339596291562602#
Patents
Cost
Time
Profit
Documentation
Closed Source
US Patent 5,571,247
Self Contained Enclosure for
Protection from Killer Bees http://www.crazypatents.com/images/Large/5571247.jpg
Parting Thoughts
Dont Self Censor
Good research is often disruptive to the status quo.
Dont be afraid to choose something controversial.
http://commons.wikimedia.org/wiki/File:Tuol_Sleng_Barbed_Wire.jpg
Help Others
http://commons.wikimedia.org/wiki/File:Helping_Hands_sculpture,_Mandela_Gardens,_Leeds_-_DSC07711.JPG
Believe in Yourself
The research space isnt as crowded as youd think,
and your kung-fu is strong
http://commons.wikimedia.org/wiki/File:Kung_Fu_Shaolin_03.JPG
Develop a Sense for Open Problems
http://cdn.inquisitr.com/wp-content/2010/08/p-not-equal-to-np.jpg
The Good Idea Fairy
Working on your
own ideas is
probably more
fun than working
on someone
elses.
http://www.flickr.com/photos/58512268@N00/2261036762/
Keep Pulling the Thread
NAND gate built from relays
Image from Code by Charles Petzold
Balance Inputs, Processing and Outputs
http://commons.wikimedia.org/wiki/File:Peddler_Balance_A117319.jpg
Fight Uninformed Law
Honored visitor of
phenoelit.de. Much
to our regret, this
site is no longer
available in the form
it has been since
the late 1990s.
It became illegal.
Find Inspiration in Others you Respect
Know what you dont know
[T]here are known
knowns; there are things
we know we know.
We also know there are
known unknowns; that is
to say we know there
are some things we do
not know.
But there are also
unknown unknowns
the ones we don't know
we don't know.
Donald Rumsfeld
http://en.wikipedia.org/wiki/File:Rumsfeld_and_cheney.jpg
Dont Expect to Get Rich
* I saw the NOP Sled License plate at an ACM CCS conference parking garage in DC
http://commons.wikimedia.org/wiki/File:White_Ferrari_Scuderia_Spider_16M_in_Lugano_-2.jpg
Build Momentum
http://commons.wikimedia.org/wiki/File:Ashton_Frost_engine_flywheel.jpg
The Journey Itself Has Many Dividends
http://commons.wikimedia.org/wiki/File:Hudson_Bay_Exploration_Western_Interior_map_de.png
Questions?
