text:
Black Hat Europe 2010 //briefings
Barcelona, Spain • Apr 12 - 15
//speakers & topics |
Andre Adelsbach
Misusing Wireless ISPs for Anonymous Communication
Most wireless communication techniques are broadcast media by nature on the physical layer, i.e., the actual signal can be received by any party in a certain coverage area. A common means to perform secure unicast point-to-point communication over such wireless infrastructures is by applying cryptographic protocols on higher layers: both communication end-points (commonly user and carrier) set up a session key, which is then used to build private and authentic unicast communication by means of encryption and message authentication. As of today, a common assumption in the design and analysis of such communication protocols is that both end-points (user and carrier) behave correctly according to the cryptographic protocol, because they want to preserve security against outsiders.
However, if carriers have more power/resources in terms of bandwidth or coverage, users may not be interested in protecting their unicast communication against outsiders at all. Instead, users may try to extend their communication power/resources by means of insider attacks against the communication protocol. Therefore, such insider attacks pose new threats to these protocols and have, to the best of our knowledge, been neglected so far.
In this presentation we will present several insider attacks, which break the unicast communication imposed by the carrier of the infrastructure. The most striking example of highly asymmetric resources are satellite ISPs: here the user normally has a terrestrial link to the carrier and no means to broadcast data at all. On the other side, the carrier can broadcast its signals over huge footprints, covering thousands of kilometers. Therefore, we will illustrate our attacks mainly in terms of satellite ISPs, but also discuss other examples such as WIMAX. Our strongest insider attack allows any end-user to make the satellite ISP broadcast data as clear text, even if the downlink (data sent from the satellite to the user) is properly encrypted by the satellite ISP, thereby breaking the unicast communication structure imposed by the satellite ISP. Finally, we discuss how the presented findings can be used to set up communication channels, achieving perfect receiver anonymity.
Iftach Ian Amit
Cyber[Crime|War] charting dangerous waters
CyberWar has been a controversial topic in the past few years. Some say the the mere term is an error. CyberCrime on the other hand has been a major source of concern, as lack of jurisdiction and law enforcement have made it one of organizaed crime's best sources of income. In this talk we will explore the uncharted waters between CyberCrime and CyberWarfare, while mapping out the key players (mostly on the state side) and how past events can be linked to the use of syndicated CyberCrime organization when carrying out attacks on the opposition. We will discuss the connections between standard warfare (kinetic) and how modern campaigns use cybersecurity to its advantage and as an integral part of it.
Patroklos Argyroudis
Binding the Daemon: FreeBSD Kernel Stack and Heap Exploitation
FreeBSD (http://www.freebsd.org/) is widely accepted as one of the most reliable and performance-driven operating systems currently available in both the open source and proprietary worlds. While the exploitation of kernel vulnerabilities has been researched in the context of the Windows and Linux operating systems, FreeBSD, and BSD systems in general, have not received the same attention. This presentation will initially examine the exploitation of kernel stack overflow vulnerabilities on FreeBSD. The development process of a privilege escalation kernel stack smashing exploit will be documented for vulnerability CVE-2008-3531. The second part of the presentation will present a detailed security analysis of the Universal Memory Allocator (UMA), the FreeBSD kernel's memory allocator. We will examine how UMA overflows can lead to arbitrary code execution in the context of the latest stable FreeBSD kernel (8.0-RELEASE), and we will develop an exploitation methodology for privilege escalation and kernel continuation.
James Arlen
SCADA and ICS for Security Experts: How to avoid being a Cyber Idiot
The traditional security industry has somehow decided that they are the white knights who are going to save everyone from the horror of insecure powergrids, pipelines, chemical plants, and cookie factories.
Suddenly, every consultant is an expert and every product is loudly advertising how it solves SCADA SECURITY AND COMPLIANCY ISSUES!!!
And because they don't know what the hell they're talking about - 'fake it till ya make it' doesn't work - they're making all of us look stupid.
Let's sit down for a little fireside chat and discuss all things SCADA and ICS with an eye towards increasing our knowledge to the point where we can confidently say: "I'm not an expert at everything, I can help some, may we work together on a solution?"
It's time to stop being a Cyber Idiot and start being a positive contributor. Learn some truth, look behind the curtain, bust some FUD, Oh - and make government agents have kittens. That's fun for everyone.
Christiaan Beek
Virtual Forensics
This presentation will be about the problems we are facing when forensic research has to be done on environments which are virtualized. What are the differences between 'traditional' system forensics, what techniques & tools can be used? Which files are important when performing forensic research on Citrix and VMWare environments? What about the VMDK file system and what do we need for future research?
Marco Bonetti
Surviving your phone: protecting mobile communications with Tor
Tor is a software project that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security. Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location.
Unfortunately, with the new features of HTML5 and browser built-in geolocation being pushed into the Web2.0 world and on mobile phones and browser, it's becoming harder and harder to keep the users' privacy safe. This presentation will describe the problems which are arising around the use of these new technologies and how they can be (ab)used to attack Tor users. It will also describe where the development is going to protect mobile phone users privacy and let them survive their own devices.
Stephan Chenette
Fireshark - A tool to Link the Malicious Web
Thousands of legitimate web sites serve malicious content to millions of visitors each and every day.
Trying to piece all the research together to confirm any similarities between possible common group patterns within these websites, such as redirectors that belong to the same IP, IP range, or ASN, and reconstructing the final deobfuscated code can be time-consuming and sometimes impossible given many of the freely available tools.
I will present a web security research project called FireShark that is capable of visiting large collections of websites at a time, executing, storing and analyzing the content, and from it identifying hundreds of malicious ecosystems of which the data, such as the normalized, deobfuscated content within them can easily be analyzed.
Mariano Nuñez Di Croce
SAP Backdoors: A ghost at the heart of your business
In any company, the ERP (Enterprise Resource Planning) is the heart of the business technological platform. These systems handle the key business processes of the organization, such as procurement, invoicing, human resources management, billing, stock management and financial planning. Among all the ERPs, SAP is by far the most widely deployed one, having more than 90.000 customers in more than 120 countries and running in Fortune 100 companies, governmental and defense organizations.
The information stored in these systems is of absolute importance to the company, which unauthorized manipulation would result in big economic losses and loss of reputation.
This talk will present an old concept applied to a new paradigm: SAP Backdoors. We will discuss different novel techniques that can be deployed by malicious intruders in order to create and install backdoors in SAP systems, allowing them to retain access or install malicious components that would result in imperceptible-and-ongoing financial frauds.
After the description of these techniques, we will present the countermeasures that should be applied in order to avoid these attacks and protect the business information, effectively reducing financial fraud risks and enforcing compliance.
Furthermore, we will release a new Onapsis free tool that will help security managers to automatically detect unauthorized modifications to SAP systems.
Is your SAP backdoored? If your answer is "I don't know," then you may consider attending to this talk.
Raoul D'Costa
Verifying eMRTD Security Controls
With the transition to RFID enabled travel documents (including the ePassport and the eID) in Europe, a correct implementation of the authentication and verification of passport technologies is necessary.
The complexity if the technology can cause a myriad of security issues in the identification.
Our presentation examines the eMRTD security controls and suggests correct implementations to enable identification as a mechanism. We also examine the dangers of incorrect implementations and the resulting consequences.
Andrzej Dereszowski
Targeted attacks: from being a victim to counter attacking
This presentation is an analysis of a common sort of targeted attacks performed nowadays against many organizations. As it turns out, publicly available remote access tools - RAT (which we usually call trojans) are frequently used to maintain control over the victim after a successful penetration. The presentation and the white paper do not focus on a particular exploitation techniques used in these attacks. Instead, they aim to get a closer look at one of the most popular remote access trojans.
The presentation describes a way to figure out which particular trojan has been used. It shows the architecture, capabilities and techniques employed by developers of the identified trojan, including mechanisms to hide its presence in the system, and to cover its network trace. It speaks about tools and techniques used to perform this analysis. Finally, it presents a vulnerability analysis and a proof of concept exploit to show that the intruders could also be an object of an attack.
Thai Duong & Juliano Rizzo
Practical Crypto Attacks Against Web Applications
In 2009, we released a paper on MD5 extension attack ([1]), and described how attackers can use the attack to exploit popular web sites such as Flickr, Vimeo, Scribd, etc. The attack has been well-received by the community, and made the Top Ten Web Hacking Techniques of 2009 ([2]). In the conclusion of that paper, we stated that we have bexen carrying out a research in which we test-run a number of identified practical crypto attacks on random widely-used software systems. To our surprise, most, if not all, can be attacked by one or more of well-known crypto bugs. In this talk, we present the latest result of that research, where we choose another powerful crypto attack, and turn it into a new set of practical web hacking techniques.
We show that widely used web development frameworks and web sites are using encryption wrongly that allow attackers to read and modify data that should be protected. It has been known for years in cryptography community that encryption is not authentication. If encrypted messages are not authenticated, data integrity cannot be guaranteed which makes systems vulnerable to practical and dangerous chosen-ciphertext attacks. Finally, we list several popular web development frameworks and web sites that are vulnerable to Padding Oracle attacks, including, but not limited to, eBay Latin America, Apache MyFaces, SUN Mojarra, Ruby On Rails, etc. These are all 0-day vulnerabilities. We show that even OWASP folks can't get it right, how can an average Joe survive this new class of vulnerabilities? We strongly believe that this is just the tip of the iceberg, and the techniques we describe in this research would uncover many more vulnerabilities for years to come.
Eric Filiol
How to operationally detect and break misuse of weak stream ciphers (and even block ciphers sometimes) - Application to the Office Encryption Cryptanalysis
Despite the evergrowing use of block ciphers, stream ciphers are still widely used: satellite communications (military, diplomatic...), civilian telecommunications, software... If their intrinsic security can be considered as strong, the main drwaback lies in the high risk of key misuse wich introduces severe weaknesses, even for unconditionnally secure ciphers like the Vernam system. Such misuses are still very frequent, more than we could expect.
In this talk we explain how to detect such misuses, to identify ciphertexts that are relevant to this misuse (among a huge amount of ciphertexts) and finally how to recover the underlying plaintext within minutes. This may also apply to (intendly or not) badly implemented block ciphers.
To illustrate this technique, this talk will also deal with the technical cryptanalysis of encryption used in Office up to the 2003 version (RC4 based). We will focus on Word and Excel applications. The cryptanalysis has been successfully and we manage to recover more than 90% of the encrypted texts in a few seconds.
The attack is based both on a pure mathematical effort AND a few basic forensic approach. In a more general cases (e.g. satellite communications), we just need to intercept ciphertexts.
In the Office case, we will explain in our sense that the attack does not rely on particular weakness but in a setting that can be seriously considered and described as a possible intended trap. We will develop this concept to explain how in a more general way such trap can be built.
Defending the Poor
The talk presents a simple but effective approach for securing Rich Internet Application (RIA) content before using it. Focusing on Adobe Flash content, the security threats presented by Flash movies are discussed, as well as their inner workings that allow such attacks to happen. Some of those details will make you laugh, some will make you wince. Based on the properties discussed, the idea behind the defense approach will be presented, as well as the code implementing it and the results of using it in the real world.
Thanassis Giannetsos
Weaponizing Wireless Networks: An Attack Tool for Launching Attacks against Sensor Networks
The pervasive interconnection of autonomous sensor devices has given birth to a broad class of exciting new applications. At the same time, however, the unattended nature and the limited resources of sensor nodes have created an equal number of vulnerabilities that attackers can exploit in order to gain access in the network and the information transferred within. While much work has been done on trying to defend these networks, little has been done on suggesting sophisticated tools for proving how vulnerable sensor networks are. This work demonstrates a tool that allows both passive monitoring of transactional data in sensor networks, such as message rate, mote frequency, message routing, etc., but also discharge of various attacks against them. To the best of our knowledge, this is the first instance of an attack tool that can be used by an adversary to penetrate the confidentiality and functionality of a sensor network. Results show that our tool can be flexibly applied to different sensor network operating systems and protocol stacks giving an adversary privileges to which she is not entitled to. We hope that our tool will be used proactively, to study the weaknesses of new security protocols, and, hopefully, to enhance the level of security provided by these solutions even further.
Joe Grand
Hardware is the New Software
Society thrives on an ever increasing use of technology. Electronics are embedded into nearly everything we touch. Hardware products are being relied on for security-related applications and are inherently trusted, though many are completely susceptible to compromise with simple classes of attacks that have been known for decades.
Bolstered by the flourishing hobbyist electronics/do-it-yourself movement, easy access to equipment, and realtime information sharing courtesy of the internet, hardware is an area of computer security that can no longer be overlooked. In this session, Joe will explore the hardware hacking process and share some recent high-profile attacks against electronic devices.
Vincenzo Iozzo
0-knowledge fuzzing
Nowadays fuzzing is a pretty common technique used both by attackers and software developers. Currently known techniques usually involve knowing the protocol/format that needs to be fuzzed and having a basic understanding of how the user input is processed inside the binary.
In the past since fuzzing was little-used obtaining good results with a small amount of effort was possible. Today finding bugs requires digging a lot inside the code and the user-input as common vulnerabilies are already identified and fixed by developers.
This talk will present an idea on how to effectively fuzz with no knowledge of the user-input and the binary. Specifically the talk will demonstrate how techniques like code coverage, data tainting and in-memory fuzzing allow to build a smart fuzzer with no need to instrument it in any way.
Haifei Li & Guillaume Lovet
Adobe Reader's Custom Memory Management: a Heap of Trouble
PDF vulnerabilities are hot. Several AV and security companies, in their 2010 predictions, cited an increase in PDF vulnerabilities volume, possibly driven by demand from Cybercriminals, eager to leverage them in focused and large-scale attacks alike.
But how serious could it really be, and what's the share of casual marketing FUD spreading here? After all, many PDF vulnerabilities out there are structure (i.e. file format) based ones, and essentially result in heap corruption situations. And everybody knows that leveraging a heap corruption bug into actual exploitation, with execution of attacker-supplied code, is no piece of cake. Indeed, MS Windows' heap is hardly predictable, and is armoured with protection mechanisms such as safe-unlinking.
Yet, the main PDF reader software out there, called Adobe Reader, has a specificity that may lead us to revise our beliefs: for performance purpose, it implements its own heap management system, on top of the Operating System's one. And it turns out that, performance sometimes (often? nah...) being the enemy of security, this custom heap management system makes it significantly easier to exploit heap corruption flaws in a solid and reliable way. Coupled with the very recent developments in DEP protection bypass in Flash (eg: JIT spraying [1]), which we will briefly show to be also valid in PDF context, this makes heap corruption exploitation potentially consistent across a very large amount of setups (a very interesting characteristic for the Cybercriminal, either for "blind-shooting" at a targeted system, or for compromising a large amount of systems at once).
This paper introduces Adobe's Reader custom heap management system, dissects its mechanisms, and points out its weaknesses in order to shed light and awareness on the PDF vulnerabilities issue. In addition, limitations will be discussed and possible mitigation leads evoked.
[1] Interpreter Exploitation: Pointer Inference and JIT Spraying, Dion Blazakis
David Lindsay & Eduardo Vela Nava
Universal XSS via IE8s XSS Filters
Internet Explorer 8 has built in cross-site scripting (XSS) detection and prevention filters. We will explore the details of how the filters detect attacks, the neutering method, and discuss the filters' general strengths and weaknesses. We will demonstrate several ways in which the filters can be abused (not just bypassed) in order to enable XSS on sites that would not otherwise be vulnerable. We will then show how this vulnerability makes most every major website vulnerable to XSS in affected versions of Internet Explorer 8.
Moxie Marlinspike
Changing Threats To Privacy: From TIA to Google
We won the war for strong cryptography, anonymous darknets exist in the wild today, and decentralized communication networks have emerged to become reality. These strategies for communicating online were conceived of in anticipation of a dystopian future, but somehow these original efforts have fallen short of delivering us from the most pernicious threats to privacy that we're now facing.
Rather than a centralized state-based database of all our communication and movements, modern threats to privacy have become something much more subtle, and perhaps all the more sinister. This talk will explore these evolving trends and discuss some interesting solutions in the works.
Steve Ocepek & Wendel G. Henrique
Oracle, Interrupted: Stealing Sessions and Credentials
In a world of free, ever-present encryption libraries, many penetration testers still find a lot of great stuff on the wire. Database traffic is a common favorite, and with good reason: when the data includes PAN, Track, and CVV, it makes you stop and wonder why this stuff isn't encrypted by default. However, despite this weakness, we still need someone to issue queries before we see the data. Or maybe not… after all, it's just plaintext.
Wendel G. Henrique and Steve Ocepek of Trustwave's SpiderLabs division offer a closer look at the world's most popular relational database: Oracle. Through a combination of downgrade attacks and session take-over exploits, this talk introduces a unique approach to database account hijacking. Using a new tool, thicknet, released at Black Hat Europe, the team will demonstrate how deadly injection attacks can be to database security.
Christian Papathanasiou
Abusing JBoss
JBoss Application Server is the open source implementation of the Java EE suite of services. It's easy-to-use server architecture and high flexibility makes JBoss the ideal choice for users just starting out with J2EE, as well as senior architects looking for a customizable middleware platform.
The pervasiveness of JBoss in enterprise JSP deployments is second to none meaning there is an abundance of targets both for the blackhat or the pentester alike. JBoss is usually invoked as root/SYSTEM meaning that any potential exploitation usually results in immediate super user privileges.
A tool has been developed that is able to compromise an unprotected JBoss instance. The current state of the art in published literature involves having the JBoss instance connect back to the attacker to obtain a war file that is subsequently deployed. The tool that will be presented at Black Hat does this in-situ and ultimately uploads a Metasploit payload resulting in interactive command execution on the JBoss instance. On Windows platforms, through the Metasploit framework a fully interactive reverse VNC shell can also be obtained and shall be demonstrated.
Depending on the platform that has been exploited and the level of access obtained, the tool is able to deploy the Metasploit payload as a persistent backdoor in conjunction with the Metasploit framework's antivirus evasion techniques.
Due to the cross platform nature of the Java language, we are able to compromise JBoss instances running on Linux, MacOSX and Windows.
Enno Rey & Daniel Mende
Hacking Cisco Enterprise WLANs
The world of "Enterprise WLAN solutions" is full of obscure and "non-standard" elements and technologies. Cisco's solutions, from the early Structured Wireless-Aware Network (SWAN) to the current Cisco Wireless Unified Networking (CUWN) architectures, only partly differ here. In this talk we describe the inner workings of these solutions, dissect the vulnerable parts and discuss theoretical and practical attacks, with some nice demos.
A new tool automating a number of attacks (incl. taking over the WDS master role, extracting WPA pairwise master keys from intra-AP communication etc) will be released at Black Hat Europe.
Manish Saindane
Attacking JAVA Serialized Communication
Many applications written in JAVA make use of Object Serialization to transfer full blown objects across the network via byte streams or to store them on the file system. While Penetration Testing applications communicating via Serialized Objects, current tools/application interception proxies allow very limited functionality to intercept and modify the requests and responses like in typical web applications. I'm trying to introduce a new technique to intercept such Serialized communication and modify it to perform penetration testing with almost the same ease as testing regular web applications. For achieving this I have developed a plug-in for Burp Suite as a proof-of-concept. What makes this technique unique is that it is completely seamless and gives the penetration tester the same control and power that an application developer has.
Peter Silberman & Ero Carrera
State Of Malware: Family Ties
Over the last few years malware has gravitated towards a few major families rather than the single or small-sized families of the past. Families of hundreds or even thousands are not uncommon. These families grouped together demonstrate the evolution of malware over time. This evolution may originate in simple bugfixes and small enhancements or entirely new sets of functionality added over an existing code base. Studying the ties between families, both within and across families, provides us with a context in which to study the development pace and technical improvements as they appear. We will examine how families grow and change amongst the mass malware and targeted attack malware. While examining how families grow and change we will attempt to identify features across all families that are both common and implemented in the same way. This could lead to quick static identification of malware features as well as signaturing these features. We hope to show how multiple families are derived from one code base, we will not just address mass malware, targeted malware but also rootkits and code sharing amongst them.
Paul Stone
Next Generation Clickjacking
Clickjacking is a technique that can be used to trick users into performing unintended actions on a website by formatting a web page so that the victim clicks on concealed links, typically hidden within an IFRAME. However, in comparison to other browser-based attacks such as XSS (Cross-site Scripting) and CSRF (Cross-site Request Forgery), Clickjacking has hitherto been regarded as a limited attack technique in terms of consequences for the victim and the scenarios in which it can be used. During this talk I intend to demonstrate that this assumption is incorrect, and that today's Clickjacking techniques can be extended to perform powerful new attacks that can affect any web application.
This talk will cover the basics of Clickjacking, quickly moving on to more powerful, and newly developed, techniques. The presentation will explore further ways in which a user can be tricked into interacting with a victim site and how these can lead to attacks such as injecting data into an application (bypassing all current CSRF protections) and the extraction of data from websites without the user's knowledge. The demo will show several cross-browser techniques, and newly released browser-specific vulnerabilities in Internet Explorer, Firefox and Safari/Chrome which can be used to take full control of a web application.
I will also be demonstrating and releasing a new tool that allows for easy point-and-click creation of multi-step Clickjacking attacks on any web application, by visually selecting the links, buttons, fields and data to be targeted. The tool will highlight the need for improved Clickjacking defences in both browsers and web applications.
Christopher Tarnovsky
Hacking the Smartcard Chip
Roelof Temmingh
Unveiling Maltego 3.0
For a year the Paterva team has been quietly working on Maltego 3 with no new releases since March 2009. For the first time since Black Hat 2009 Paterva will be showing you what they have been up to - revealing an all new Maltego version - built from the ground up. Expect Hollywood quality graphing and animation, endless possibilities of extensions, new analytic views that will make you weep, and brand new transforms to will blow your mind.
Julien Tinnes & Chris Evans
Security in depth for Linux software
In many designs, the slightest error in the source code may become an exploitable vulnerability granting an attacker barely or not at all restricted access to a system. In this talk, using vsftpd and Google Chrome Linux as examples, we will firstly show how to design your code to be more robust to well-known classes of vulnerabilities and secondly, how to generically mitigate the consequences of such a vulnerability by dropping privileges and reducing attack surfaces.
There are a surprising number of options in Linux to manage privileges, but using them tends to be nuanced. This talk will discuss the technical aspects of various options and explain how to mix them to raise the bar to a system compromise from a sophisticated attacker.
While Mandatory Access Control systems are readily available, three of them being merged in the current Linux kernel tree, the ability to drop privileges in a "discretionary" way has to often rely on ancient mechanisms (which may not have been designed for security). We will show the state of the art on Linux and how well-known mechanisms, such as switching to an unprivileged uid, using chroot() and capabilities may or may not be suitable to achieve decent privilege dropping. We will discuss their drawbacks, availabilities to non-root processes and how an incorrect usage could be exploited by an attacker to circumvent security measures.
We will then explain and demonstrate designs, some of them using novel ideas or obscure features that can allow developers to put error-prone parts of their code inside a sandbox, using vsftpd and the Google Chrome Linux sandbox as examples.
We will discuss their limitations and how further kernel support could improve them.
Mario Vuksan, Tomislav Pericin & Brian Karney
Hiding in the Familiar: Steganography and Vulnerabilities in Popular Archives Formats
Exploiting archive formats can lead to steganographic data hiding and to processing errors with serious forensic consequences. These formats are very interesting as they are commonly found on every PC, Apple or Linux machine, and it is popularly believed that they are well understood and trusted. Can exploits ever be present in file formats that have been in use for over ten or even twenty years?
Through deep format analysis, beyond fuzzing, we look at what goes wrong when the format specifications are interpreted differently. Can you trust programs that work with archives? Can you even trust your antivirus? We will answer these questions and disclose for the first time 15 newly discovered vulnerabilities in ZIP, 7ZIP, RAR, CAB and GZIP file formats revealing the impact they have on anti-malware scanners, digital forensic, security gateways and IPS appliances.
This talk will include demo of ArchiveInsider, a new forensics tool that detects and extracts hidden data and fully validates vulnerable file formats. We will demonstrate file format steganography, file malformation, and even data "self destruction," all with tools that you use and trust.
Kyle Yang
Protocol, Mechanism and Encryption of Pushdo/Cutwail/Webwail Botnet
After several months efforts, the pushdo/cutwail botnet author(s) finally released a new pushdo advanced installer(codename "revolution") which not only changed the protocol and encryption totally but also implemented "Services" mechanism. Moreover, a new spam engine was in the experimental phase. In this presentation, I will examine pushdo's brand new protocol and encryption, reveal their "Cyber Crime Services" vendors mapping and disclose the debug version of the new spam engine's protocol and encryption.


text:
Growing Hops In Montana Feb. 27
Growing hops in Montana is the topic on MontanaPBS' Montana Ag Live at 11 a.m. on Sunday, February 27.
Victoria Blake, plant pathologist at MSU, has been testing the potential for growing hops in Montana.
Tune in as she discusses the MSU hopyard and her findings about the future of hops in our state.
Montana Ag Live is a regular call-in program on agricultural and gardening in Montana.
Presented by MontanaPBS in association with Montana State University Extension, the program hosts panels of experts to discuss everything from pesticide use, and large-scale agricultural techniques, to backyard gardening questions, and even which mushroom to pick in the woods.
Visit Montana Ag Live on the Web at: http://www.montanapbs.org/MontanaAgLive/

subset: commoncrawl


text:
Help Centre
Help Topics FAQ
Help Centre Main Content
Help Centre
Got a question with the online application process? Experiencing a technical issue? The answer is sure to be in one of the links in the left hand menu..........and if it isn't? You'll be able to contact our technical support team directly.
Have a recruitment related query? Use the 'Contact Us' link to get in touch with the recruitment team directly.


text:
MONTPELIER, Vt. (AP) — The future of legalized recreational marijuana use in Vermont hinged Thursday on a decision by Republican Gov. Phil Scott a day after the state Legislature became the first in the country to vote to legalize it.
Scott hasn't said whether he'll sign the bill to make Vermont the ninth state to legalize recreational marijuana, but he has said he wants to ensure the proposal addresses public safety needs, such as ways to counter drugged driving.
"I'm going to review the bill as passed," Scott said Wednesday. "But I've been pretty clear that I'd like to see some improvements to the bill to make sure we have structures in place that provide safety to Vermonters."
Other states that have approved recreational marijuana did so after voter referendums. Vermonters are mixed on the idea.
Montpelier resident Brett Campbell, 57, described himself as a recovering alcoholic and said Thursday that he was in favor of legalization.
"I find it really kind of silly that there are a lot of people who are so afraid of a plant that doesn't have the intoxicating effects to near the degree of self-control and control over judgment as you lose when you're impaired by alcohol," Campbell said.
Montpelier attorney Paul Giuliani, 73, said he felt the legislation was a terrible idea. Laws haven't been able to keep alcohol out of the hands of underage drinkers, and they won't work with marijuana users, either, he said.
"It just sends the wrong message," Giuliani said.
Studies by the Vermont Department of Health have found that Vermont has among the highest prevalence of marijuana use in the country and the second-highest use among people ages 12 to 25.
Proponents of marijuana legalization said Wednesday's vote by the Democrat-led House to give final approval to a measure already passed by the Democrat-majority Senate shows the inevitable expansion of marijuana legalization and the recognition by officials that it's better to regulate and tax the industry than to keep it in the shadows.
Regulating and Taxing Marijuana
The vote came six months after residents in Massachusetts and Maine voted to legalize the recreational use of marijuana. Both states are now developing mechanisms to regulate and tax the sale of marijuana. The New Hampshire Legislature is considering a bill to decriminalize the possession of small amounts of marijuana.
"Definitely November of 2016 seems to have accelerated the thinking in the minds of many policymakers," said Matt Simon, the New England political director for the Marijuana Policy Project, which favors legalization. "It's inevitably coming to the region."
On Thursday, the Coalition for a Tobacco Free Vermont sent Scott a letter urging him to veto the marijuana legislation, arguing it could "roll back critical public health gains" in the state.
The National Conference of State Legislatures says almost 20 states have bills pending that would legalize adult-use marijuana. A number of states have rejected such proposals.
If it becomes law, Vermont would become the first state to have legalized marijuana via the legislative process. The other eight states that have legalized marijuana have done so via citizen referendums, but Vermont does not have a legal mechanism to carry out such referendums.
Under the Vermont legislation, small amounts of marijuana would be legal to possess and grow for anyone over age 21. Larger amounts would remain illegal. A commission would develop a proposal to tax and regulate marijuana.
Scott can sign the bill, allow it to become law without his signature or veto it. The legislation did not receive enough votes to override a veto.


text:
Consumer Guide to Buying a Franchise
Created by FindLaw's team of legal writers and editors | Last reviewed September 21, 2022
This article has been written and reviewed for legal accuracy, clarity, and style by FindLaw's team of legal writers and attorneys and in accordance with our editorial standards.
The last updated date refers to the last time this article was reviewed by FindLaw or one of our contributing authors. We make every effort to keep our articles updated. For information regarding a specific legal issue affecting you, please contact an attorney in your area.
Many people dream of being an entrepreneur. By purchasing a franchise, you often can sell goods and services that have instant name recognition and can obtain training and ongoing support to help you succeed. But be cautious. Like any investment, purchasing a franchise is not a guarantee of success.
The Benefits and Responsibilities of Franchise Ownership
To help you evaluate whether owning a franchise is right for you, the Federal Trade Commission has prepared this booklet. It will help you understand your obligations as a franchise owner, how to shop for franchise opportunities, and how to ask the right questions before you invest.
A franchise typically enables you, the investor or "franchisee," to operate a business. By paying a franchise fee, which may cost several thousand dollars, you are given a format or system developed by the company ("franchisor"), the right to use the franchisor's name for a limited time, and assistance. For example, the franchisor may help you find a location for your outlet; provide initial training and an operating manual; and advise you on management, marketing, or personnel. Some franchisors offer ongoing support such as monthly newsletters, a toll free 800 telephone number for technical assistance, and periodic workshops or seminars.
While buying a franchise may reduce your investment risk by enabling you to associate with an established company, it can be costly. You also may be required to relinquish significant control over your business, while taking on contractual obligations with the franchisor.
Below is an outline of several components of a typical franchise system. Consider each carefully.
We make business formation EASY. Click here to start your free LLC.
The Cost
In exchange for obtaining the right to use the franchisor's name and its assistance, you may pay some or all of the following fees.
- initial franchise fee and other expenses. Your initial franchise fee, which may be non-refundable, may cost several thousand to several hundred thousand dollars. You may also incur significant costs to rent, build, and equip an outlet and to purchase initial inventory. Other costs include operating licenses and insurance. You also may be required to pay a "grand opening" fee to the franchisor to promote your new outlet.
- continuing royalty payments. You may have to pay the franchisor royalties based on a percentage of your weekly or monthly gross income. You often must pay royalties even if your outlet has not earned significant income during that time. In addition, royalties usually are paid for the right to use the franchisor's name. So even if the franchisor fails to provide promised support services, you still may have to pay royalties for the duration of your franchise agreement.
- advertising fees. You may have to pay into an advertising fund. Some portion of the advertising fees may go for national advertising or to attract new franchise owners, but not to target your particular outlet.
To ensure uniformity, franchisors typically control how franchisees conduct business. These controls may significantly restrict your ability to exercise your own business judgment. The following are typical examples of such controls.
- site approval. Many franchisors pre-approve sites for outlets. This may increase the likelihood that your outlet will attract customers. The franchisor, however, may not approve the site you want.
- design or appearance standards. Franchisors may impose design or appearance standards to ensure customers receive the same quality of goods and services in each outlet. Some franchisors require periodic renovations or seasonal design changes. Complying with these standards may increase your costs.
- restrictions on goods and services offered for sale. Franchisors may restrict the goods and services offered for sale. For example, as a restaurant franchise owner, you may not be able to add to your menu popular items or delete items that are unpopular. Similarly, as an automobile transmission repair franchise owner, you might not be able to perform other types of automotive work, such as brake or electrical system repairs.
- restrictions on method of operation. Franchisors may require you to operate in a particular manner. The franchisor might require you to operate during certain hours, use only pre-approved signs, employee uniforms, and advertisements, or abide by certain accounting or bookkeeping procedures. These restrictions may impede you from operating your outlet as you deem best. The franchisor also may require you to purchase supplies only from an approved supplier, even if you can buy similar goods elsewhere at a lower cost.
- restrictions of sales area. Franchisors may limit your business to a specific territory. While these territorial restrictions may ensure that other franchisees will not compete with you for the same customers, they could impede your ability to open additional outlets or move to a more profitable location.
Terminations and Renewal
You can lose the right to your franchise if you breach the franchise contract. In addition, the franchise contract is for a limited time; there is no guarantee that you will be able to renew it.
- franchise terminations. A franchisor can end your franchise agreement if, for example, you fail to pay royalties or abide by performance standards and sales restrictions. If your franchise is terminated, you may lose your investment.
- renewals. Franchise agreements typically run for 15 to 20 years. After that time, the franchisor may decline to renew your contract. Also be aware that renewals need not provide the original terms and conditions. The franchisor may raise the royalty payments, or impose new design standards and sales restrictions. Your previous territory may be reduced, possibly resulting in more competition from company-owned outlets or other franchisees.
Before Selecting a Franchise System
Before investing in a particular franchise system, carefully consider how much money you have to invest, your abilities, and your goals. The following checklist may help you make your decision.
Your Investment
- How much money do you have to invest?
- How much money can you afford to lose?
- Will you purchase the franchise by yourself or with partners?
- Will you need financing and, if so, where can you obtain it?
- Do you have a favorable credit rating?
- Do you have savings or additional income to live on while starting your franchise?
Your Abilities
- Does the franchise require technical experience or relevant education, such as auto repair, home and office decorating, or tax preparation?
- What skills do you have? Do you have computer, bookkeeping, or other technical skills?
- What specialized knowledge or talents can you bring to a business?
- Have you ever owned or managed a business?
Your Goals
- What are your goals?
- Do you require a specific level of annual income?
- Are you interested in pursuing a particular field?
- Are you interested in retail sales or performing a service?
- How many hours are you willing to work?
- Do you want to operate the business yourself or hire a manager?
- Will franchise ownership be your primary source of income or will it supplement your current income?
- Would you be happy operating the business for the next 20 years?
- Would you like to own several outlets or only one?
Selecting a Franchise
Like any other investment, purchasing a franchise is a risk. When selecting a franchise, carefully consider a number of factors, such as the demand for the products or services, likely competition, the franchisor's background, and the level of support you will receive.
Is there a demand for the franchisor's products or services in your community? Is the demand seasonal? For example, lawn and garden care or swimming pool maintenance may be profitable only in the spring or summer. Is there likely to be a continuing demand for the products or services in the future? Is the demand likely to be temporary, such as selling a fad food item? Does the product or service generate repeat business?
What is the level of competition, nationally and in your community? How many franchised and company-owned outlets does the franchisor have in your area? How many competing companies sell the same or similar products or services? Are these competing companies well established, with wide name recognition in your community? Do they offer the same goods and services at the same or lower price?
Your Ability to Operate the Business
Sometimes, franchise systems fail. Will you be able to operate your outlet even if the franchisor goes out of business? Will you need the franchisor's ongoing training, advertising, or other assistance to succeed? Will you have access to the same or other suppliers? Could you conduct the business alone if you must lay off personnel to cut costs?
Name Recognition
A primary reason for purchasing a franchise is the right to associate with the company's name. The more widely recognized the name, the more likely it will draw customers who know its products or services. Therefore, before purchasing a franchise, consider:
- The company's name and how widely recognized it is. -- If it has a registered trademark.
- How long the franchisor has been in operation.
- If the company has a reputation for quality products or services.
- If consumers have filed complaints against the franchise with the Better Business Bureau or a local consumer protection agency.
Training and Support Services
Another reason for purchasing a franchise is to obtain support from the franchisor. What training and ongoing support does the franchisor provide? How does their training compare with the training for typical workers in the industry? Could you compete with others who have more formal training? What backgrounds do the current franchise owners have? Do they have prior technical backgrounds or special training that helps them succeed? Do you have a similar background?
Franchisor's Experience
Many franchisors operate well-established companies with years of experience both in selling goods or services and in managing a franchise system. Some franchisors started by operating their own business. There is no guarantee, however, that a successful entrepreneur can successfully manage a franchise system. Carefully consider how long the franchisor has managed a franchise system. Do you feel comfortable with the franchisor's expertise? If franchisors have little experience in managing a chain of franchises, their promises of guidance, training, and other support may be unreliable.
A growing franchise system increases the franchisor's name recognition and may enable you to attract customers. Growth alone does not ensure successful franchisees; a company that grows too quickly may not be able to support its franchisees with all the promised support services. Make sure the franchisor has sufficient financial assets and staff to support the franchisees.
Shopping at a Franchise Exposition
Attending a franchise exposition allows you to view and compare a variety of franchise possibilities. Keep in mind that exhibitors at the exposition primarily want to sell their franchise systems. Be cautious of salespersons who are interested in selling a franchise that you are not interested in.
Before you attend, research what type of franchise best suits your investment limitations, experience, and goals. When you attend, comparison shop for the opportunity that best suits your needs and ask questions.
Know How Much You Can Invest
An exhibitor may tell you how much you can afford to invest or that you can't afford to pass up this opportunity. Before beginning to explore investment options, consider the amount you feel comfortable investing and the maximum amount you can afford.
Know What Type of Business is Right for You
An exhibitor may attempt to convince you that an opportunity is perfect for you. Only you can make that determination. Consider the industry that interests you before selecting a specific franchise system. Ask yourself the following questions:
- Have you considered working in that industry before?
- Can you see yourself engaged in that line of work for the next twenty years?
Do you have the necessary background or skills?
If the industry does not appeal to you or you are not suited to work in that industry, do not allow an exhibitor to convince you otherwise. Spend your time focusing on those industries that offer a more realistic opportunity.
Comparison Shop
Visit several franchise exhibitors engaged in the type of industry that appeals to you. Listen to the exhibitors' presentations and discussions with other interested consumers. Get answers to the following questions:
- How long has the franchisor been in business?
- How many franchised outlets currently exist? Where are they located?
- How much is the initial franchise fee and any additional start-up costs? Are there any continuing royalty payments? How much?
- What management, technical, and ongoing assistance does the franchisor offer?
- What controls does the franchisor impose?
Exhibitors may offer you prizes, free samples, or free dinners if you attend a promotional meeting later that day or over the next week to discuss the franchise in greater detail. Do not feel compelled to attend. Rather, consider these meetings as one way to acquire more information and to ask additional questions. Be prepared to walk away from any promotion if the franchise does not suit your needs.
Get Substantiation for Any Earnings Representations
Some franchisors may tell you how much you can earn if you invest in their franchise system or how current franchisees in their system are performing. Be careful. The FTC requires that franchisors who make such claims provide you with written substantiation. This is explained in more detail in the section "Investigating Franchise Offers." Make sure you ask for and obtain written substantiation for any income projections, or income or profit claims. If the franchisor does not have the required substantiation, or refuses to provide it to you, consider its claims to be suspect.
Take Notes
It may be difficult to remember each franchise exhibit. Bring a pad and pen to take notes. Get promotional literature that you can review. Take the exhibitors' business cards so you can contact them later with any additional questions.
Avoid High Pressure Sales Tactics
You may be told that the franchisor's offering is limited, that there is only one territory left, or that this is a one-time reduced franchise sales price. Do not feel pressured to make any commitment. Legitimate franchisors expect you to comparison shop and to investigate their offering. A good deal today should be available tomorrow.
Study the Franchisor's Offering
Do not sign any contract or make any payment until you have the opportunity to investigate the franchisor's offering thoroughly. As will be explained further in the next section, the FTC's Franchise Rule requires the franchisor to provide you with a disclosure document containing important information about the franchise system. Study the disclosure document. Take time to speak with current and former franchisees about their experiences. Because investing in a franchise can entail a significant investment, you should have an attorney review the disclosure document and franchise contract and have an accountant review the company's financial disclosures.
Investigating Franchise Offerings
Before investing in any franchise system, be sure to get a copy of the franchisor's disclosure document. Sometimes this document is called a Franchise Offering Circular. Under the FTC's Franchise Rule, you must receive the document at least 10 business days before you are asked to sign any contract or pay any money to the franchisor. You should read the entire disclosure document. Make sure you understand all of the provisions. The following outline will help you to understand key provisions of typical disclosure documents. It also will help you ask questions about the disclosures. Get a clarification or answer to your concerns before you invest.
Business Background
The disclosure document identifies the executives of the franchise system and describes their prior experience. Consider not only their general business background, but their experience in managing a franchise system. Also consider how long they have been with the company. Investing with an inexperienced franchisor may be riskier than investing with an experienced one.
Litigation History
The disclosure document helps you assess the background of the franchisor and its executives by requiring the disclosure of prior litigation. The disclosure document tells you if the franchisor, or any of its executive officers, has been convicted of felonies involving, for example, fraud, any violation of franchise law or unfair or deceptive practices law, or are subject to any state or federal injunctions involving similar misconduct. It also will tell you if the franchisor, or any of its executives, has been held liable or settled a civil action involving the franchise relationship. A number of claims against the franchisor may indicate that it has not performed according to its agreements, or, at the very least, that franchisees have been dissatisfied with the franchisor's performance. Be aware that some franchisors may try to conceal an executive's litigation history by removing the individual's name from their disclosure documents.
The disclosure document tells you if the franchisor or any of its executives have recently been involved in a bankruptcy. This will help you to assess the franchisor's financial stability and general business acumen and predict if the company is financially capable of delivering promised support services.
The disclosure document tells you the costs involved to start one of the company's franchises. It will describe any initial deposit or franchise fee, which may be non-refundable, and costs for initial inventory, signs, equipment, leases, or rentals. Be aware that there may be other undisclosed costs. The following checklist will help you ask about potential costs to you as a franchisee.
- Continuing royalty payments.
- Advertising payments, both to local and national advertising funds.
- Grand opening or other initial business promotions.
- Business or operating licenses.
- Product or service supply costs.
- Real estate and leasehold improvements.
- Discretionary equipment such as a computer system or business alarm system.
- Training.
- Legal fees.
- Financial and accounting advice.
- Insurance.
- Compliance with local ordinances, such as zoning, waste removal, and fire and other safety codes.
- Health insurance.
- Employee salaries and benefits.
It may take several months or longer to get your business started. Consider in your total cost estimate operating expenses for the first year and personal living expenses for up to two years. Compare your estimates with what other franchisees have paid and with competing franchise systems. Perhaps you can get a better deal with another franchisor. An accountant can help you to evaluate this information.
Your franchisor may restrict how you operate your outlet. The disclosure document tells you if the franchisor limits:
- The supplier of goods from whom you may purchase.
- The goods or services you may offer for sale.
- The customers to whom you can offer goods or services.
- The territory in which you can sell goods or services.
Understand that restrictions such as these may significantly limit your ability to exercise your own business judgment in operating your outlet.
The disclosure document tells you the conditions under which the franchisor may terminate your franchise and your obligations to the franchisor after termination. It also tells you the conditions under which you can renew, sell, or assign your franchise to other parties.
Training and Other Assistance
The disclosure document will explain the franchisor's training and assistance program. Make sure you understand the level of training offered. The following checklist will help you ask the right questions.
- How many employees are eligible for training?
- Can new employees receive training and, if so, is there any additional cost?
- How long are the training sessions?
- How much time is spent on technical training, business management training, and marketing?
- Who teaches the training courses and what are their qualifications?
- What type of ongoing training does the company offer and at what cost?
- Whom can you speak to if problems arise?
- How many support personnel are assigned to your area?
- How many franchisees will the support personnel service?
- Will someone be available to come to your franchised outlet to provide more individual assistance?
The level of training you need depends on your own business experience and knowledge of the franchisor's goods and services. Keep in mind that a primary reason for investing in the franchise, as opposed to starting your own business, is training and assistance. If you have doubts that the training might be insufficient to handle day-to-day business operations, consider another franchise opportunity more suited to your background.
You often must contribute a percentage of your income to an advertising fund even if you disagree with how these funds are used. The disclosure document provides information on advertising costs. The following checklist will help you assess whether the franchisor's advertising will benefit you.
- How much of the advertising fund is spent on administrative costs?
- Are there other expenses paid from the advertising fund?
- Do franchisees have any control over how the advertising dollars are spent?
- What advertising promotions has the company already engaged in?
- What advertising developments are expected in the near future?
- How much of the fund is spent on national advertising?
- How much of the fund is spent on advertising in your area?
- How much of the fund is spent on selling more franchises?
- Do all franchisees contribute equally to the advertising fund?
- Do you need the franchisor's consent to conduct your own advertising?
- Are there rebates or advertising contribution discounts if you conduct your own advertising?
- Does the franchisor receive any commissions or rebates when it places advertisements? Do franchisees benefit from such commissions or rebates, or does the franchisor profit from them?
Current and Former Franchisees
The disclosure document provides important information about current and former franchisees. Determine how many franchises are currently operating. A large number of franchisees in your area may mean increased competition. Pay attention to the number of terminated franchisees. A large number of terminated, cancelled, or non-renewed franchises may indicate problems. Be aware that some companies may try to conceal the number of failed franchisees by repurchasing failed outlets and then listing them as company-owned outlets.
If you buy an existing outlet, ask the franchisor how many owners operated that outlet and over what period of time. A number of different owners over a short period of time may indicate that the location is not a profitable one, or that the franchisor has not supported that outlet with promised services.
The disclosure document gives you the names and addresses of current franchisees and franchisees who have left the system within the last year. Speaking with current and former franchisees is probably the most reliable way to verify the franchisor's claims. Visit or phone as many of the current and former franchisees as possible. Ask them about their experiences. See for yourself the volume and type of business being done.
The following checklist will help you ask current and former franchisees such questions as:
- How long has the franchisee operated the franchise?
- Where is the franchise located?
- What was their total investment?
- Were there any hidden or unexpected costs?
- How long did it take them to cover operating costs and earn a reasonable income?
- Are they satisfied with the cost, delivery, and quality of the goods or services sold?
- What were their backgrounds prior to becoming a franchisee?
- Was the franchisor's training adequate?
- What ongoing assistance does the franchisor provide?
- Are they satisfied with the franchisor's advertising program?
- Does the franchisor fulfill its contractual obligations?
- Would the franchisee invest in another outlet?
- Would the franchisee recommend the investment to someone with your goals, income requirements, and background?
Be aware that some franchisors may give you a separate reference list of selected franchisees to contact. Be careful. Those on the list may be individuals who are paid by the franchisor to give a good opinion of the company.
Earnings Potential
You may want to know how much money you can make if you invest in a particular franchise system. Be careful. Earnings projections can be misleading. Insist upon written substantiation for any earnings projections or suggestions about your potential income or sales.
Franchisors are not required to make earnings claims, but if they do, the FTC's Franchise Rule requires franchisors to have a reasonable basis for these claims and to provide you with a document that substantiates them. This substantiation includes the bases and assumptions upon which these claims are made. Make sure you get and review the earnings claims document. Consider the following in reviewing any earnings claims.
Sample Size. A franchisor may claim that franchisees in its system earned, for example, $50,000 last year. This claim may be deceptive, however, if only a few franchisees earned that income and it does not represent the typical earnings of franchisees. Ask how many franchisees were included in the number.
Average Incomes. A franchisor may claim that the franchisees in its system earn an average income of, for example, $75,000 a year. Average figures like this tell you very little about how each individual franchisee performs. Remember, a few, very successful franchisees can inflate the average. An average figure may make the overall franchise system look more successful than it actually is.
Gross Sales. Some franchisors provide figures for the gross sales revenues of their franchisees. These figures, however, do not tell you anything about the franchisees' actual costs or profits. An outlet with a high gross sales revenue on paper actually may be losing money because of high overhead, rent, and other expenses.
Net Profits. Franchisors often do not have data on net profits of their franchisees. If you do receive net profit statements, ask whether they provide information about company-owned outlets. Company-owned outlets might have lower costs because they can buy equipment, inventory, and other items in larger quantities, or may own, rather than lease their property.
Geographic Relevance. Earnings may vary in different parts of the country. An ice cream store franchise in a southern state, such as Florida, may expect to earn more income than a similar franchise in a northern state, such as Minnesota. If you hear that a franchisee earned a particular income, ask where that franchisee is located.
I'd Like Help From a Lawyer
Contact a qualified business attorney to help you navigate the process of starting a business.


text:
With a generous 11.5-point type, reading God's Word is easier and more enjoyable than ever! You don't have to sacrifice references for readability either. The King James Version Personal Size Reference Bible, Giant Print, offers an extensive end-of-verse reference system help you unlock the riches of Scripture.
Book introductions and outlines, concordance, and maps offer additional resources for getting the most out of your Bible study. This easy-on-the-eyes edition offers lasting value in an affordable package. Plus, it comes with a lifetime guarantee.


text:
At the crossroads of Egypt in all its majesty, Italian craftsmanship and French elegance stands, Elisa. Launching for the Spring/Summer 2020 collection and inspired in part by the hold that Egypt has had over Christian's imagination since childhood, this brand-new handbag is already an icon. Its eye-catching CL twist lock clasp invokes the splendour of ancient Egypt, its lines echoing the rounded rectangular contours of the hieroglyphic pharaoh's cartouche.The belt is crafted in Loubi red-lined black calfskin and the pouch-like bag that is slipped on at the waist is in calfskin. Whether large, small, mini shoulder bag or belt bag, the Elisa adapts to the many lifestyles and needs of the modern woman. -Flat sliding chain to easily switch the type of wear: cross body, long & short shoulder -Leather pad for comfort-Divider with zipped pocket -External flat pocket-Interior flat pocket-Four card slots
Color : COURTISANE
Material : Calf
Dimensions : 110mm x 185mm x 35mm
Lining : Leather
Collection : 20S