MS14-068 Kerberos vulnerability: A simple overview

The below was written as advice for my clients, and has been published openly so that it may assist other security professionals brief less technical staff. The views expressed within are my own, and may not reflect those of any employer past or present. If you need further advice, please feel free to get in touch via the comments or my Twitter

Microsoft have released another out-of-band critical security bulletin MS14-068 and accompanying patch for a vulnerability in their implementation of Kerberos.

Bulletin: https://technet.microsoft.com/library/security/MS14-068
Further information: http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx

What is the vulnerability?
Authenticated users can falsify their account permissions, allowing an attacker to perform privilege escalation to become a domain administrator. This affects every version of windows from Windows Server 2003 and above.

How does it work?
In layman’s terms, this attack literately just scribbles a new set of permissions on your access ticket, lying about who the ticket holder is and what they are allowed to access. It’s a little more technical than that, as it manages to do so carefully so that it fools the security services.

What is the probability of this vulnerability being exploited?
This vulnerability relies on being able to log into the domain directly. This means that, for a properly designed network, it cannot be exploited over the internet. It also requires valid AD credentials in order to be exploited, which further reduces the risk. A local malware infection on a logged in system may offer an attacker enough of a foothold to exploit this attack.
Windows Server 2012 and above are still vulnerable, however the vulnerability is harder to successfully exploit for these systems.

Has this attack been seen in the wild?
Microsoft have seen this vulnerability successfully exploited in the wild, and it was these observations which led to the release of the bulletin.

What is the possible impact of an attack?
Once an attacker has gained domain administrator privileges, there are very few limits to what the attacker can perform. This includes:

  • Installing further compromises that cannot be detected by system administrators, preventing any attempt to stop ingress/egress.
  • Altering system logs to remove evidence of the attack
  • Creating new administrator accounts
  • Destruction, modification or theft of data

Can the attack be detected?
Microsoft’s security blog post recommends comparing the Security ID and Account Name fields in Windows event logs. Normally these would be identical, however any successful exploit will result in records where these two fields show different values. It is worth nothing, however, that unless a separate SIEM or log management solution is in place, an attacker could alter the Windows event log to remove evidence of their attack.
As this attack relies on use of valid credentials, monitoring of logins outside of normal behaviour may also provide insight, as well as monitoring for malware infection and other anomalous behaviour.

Is there a patch available?
Microsoft have released a patch for all versions of Windows from Windows Server 2003 and above. Microsoft recommend that the patches be applied as soon as possible, applying the patches to systems according to the below priorities:

  1. Domain controllers running Windows Server 2008R2 and below
  2. Domain controllers running Windows Server 2012 and higher
  3. All other systems running any version of Windows

Although desktop installations are believed to be not directly affected, patches have been released for these systems to ensure defence in depth. Details of the patches can be found in the above Microsoft Security Bulletin.

What action should be taken if compromised?
If an environment has been successfully compromised through use of this exploit, or is suspected to have been, Microsoft advise that there is no authoritative means to fully identify and correct the effects of any such attack. As such, they advise that the only guaranteed way to be sure an environment is clean and free from infiltration is to fully rebuild the domain.
Due to the severe impact any such exercise will cause, a risk based approach should be taken. It may be appropriate to seek further guidance from Microsoft, infrastructure support vendors, or a specialist information security organisation.
For most organisations, patching alone will probably suffice, and a review of authentication logs could be performed to offer further assurances.

£1 to a good cause is… complex

Today Sky Yarlett made a blog post about how any entry fee is too high for a pride event.

In the below I have used QUILTBAG in general to refer to “Queer/Questioning, Undecided, Intersex, Lesbian, Trans, Bisexual, Asexual, and Gay” people, but LGBT when reflecting legal matters or self-definitions of existing events as such

As a QUILTBAG activist, I of course believe that free events and pride protests/marches/celebrations are entirely preferable, and this allows us to best handle the increased intersectional effects of poverty on gender and sexual minorities.

However, as anyone who has ran an event will know, there are always costs involved. Venues are not free, sound systems cost money to rent, and marquees and tents need to be acquired. That’s not even to mention staffing the place, running a website, event security, licensing, marketing, and all the time and labour in the months in the run-up to get the event organised and tents filled.

Sponsorship is a commonly used approach to cover the costs, but often this can be very harmful. It can further reinforce views that pride is for the gay white man, or even promote companies that actively harm minorities in their advertising. And all such sponsorship leads to a further feeling of commercialisation.

But with further funding, the better events can do more than simply cover expected costs – they can reach out to other groups and actively work to correct for past issues. Nottinghamshire pride was able to do just that, putting on burlesque and circus tents to diversify the entertainment, and helped to fund a highly successful Trans stage ran by Nottingham Recreation. This is well worth remarking upon, as a dedicated Trans stage is virtually unheard of, especially outside London, and they had so many trans and queer performers looking to perform that they actually had to turn people down.

Nottinghamshire Pride did have to take corporate sponsorship, unfortunately, from E.ON to cover their costs in the run-up to the event. Unlike some other sponsors, E.ON wasn’t an entirely oddball choice, however, as they do have an apparently very active LGBT group and supporting policies*. This did lead them to get three stalls in total and their name on all promotional materials, but it was quite clear that there was still plenty of room for community stalls (and further commercial traders).

Sadly homophobic incidents at Pride events are not an uncommon occurrence, meaning that event organisers are being pushed to find means to improve the safety of Pride events somehow. Whilst I am not entirely sure this is the best approach, one commonly tried and tested solution is to physically restrict access to the event, and place a fee on entry to discourage people who only want to come along to cause trouble. Laws around event licensing may also further encourage this.

The problem is, as soon as you start to charge a token fee, it is extremely tempting to just ramp that up a little, just a little more, may as well charge a lot after all. This is normally accompanied by higher spending of money on big name acts for the white gays and lesbians, which are, as Sky points out, often actually straight. And there are a lot of problems with security on a gate into a Pride event, aside from charging for entry. Many QUILTBAG people have experienced discrimination from people in a position of power before, and adequate training is a rare thing unfortunately.

This again is where Nottinghamshire Pride did something unusual – they posted openly how Nottinghamshire Pride donations where being spent, including the admission fee. Whilst they did have some big names, proportionally they were very much the minority, with local groups and smaller acts having the majority of the stage time.

In contrast, however, we have Birmingham Pride, which erected 6-foot high fencing through the middle of the gay village, and charged £10 for a single day wristband. The money from these was used entirely for bigger name acts and employing even more security for the event. Everyone I have talked to who went to Birmingham Pride stated that it felt lifeless, corporate, and just another White Gay Male pop music festival.

On the point of charging for entry, I have seen people state that charging even just £1 for entry would have had a vast impact on those less well-off. Whilst this is undoubtedly true, I do have to question were those raising these points have came from. In my experience, those who have consistently complained the most about entirely fair entry fees have been those who would think nothing, once within, of buying a lot of alcohol and food. And as someone who has had to live with barely enough for a roof over her head, I found at the time that reasonable and justified prices were not a big deal when they were clearly as such. This is exactly the same issue that we see time and time again over how financially less-well-off people budget and shop for food, which some very incorrect assumptions being made***. I recognise, however, that I’ve always had middle-class-background privilege, even if those months did teach me a lot more than I’d have wished.

Talking to other people at Nottinghamshire Pride, many of whom were experienced activists who had been to many different Pride events across the country, the feeling was generally a very positive one. It was common to hear people say that they couldn’t remember a better Pride**, and that they felt that it was more of a community event than a gay man’s music festival. There was also a wide attendance from many different subcultures, and a good number of families also came along and enjoyed the day. Whilst the price to get in was irritating, the knowledge that they were attempting to be open and transparent regarding it’s usage made it more manageable.

To summarise:

  • Pride events should, were possible, be free, or as close as possible
  • Events, however, unavoidably will incur costs that need to be covered
  • Sponsorship is an imperfect means to cover costs, and has issues associated with it, but works well
  • Security and safety at Pride events is a real concern, but security processes can also harm QUILTBAG people
  • There is a growing feeling that many mainstream Pride events are just Gay White Male pop music festivals, not a celebration of QUILTBAG culture and existence, and have lost their vital protest roots, that are still relevant to this day
  • Even token charges are undesirable, but sadly also understandable and potentially unavoidable
  • If Pride events charge for entry, they must be open and transparent in their spending, and not just spend on more big-name pop acts, were possible helping to fund local groups’ tents and stages, and promoting true diversity for all QUILTBAG/LGBT people
  • Profits from Pride events this should go towards the wider community, and be used to support local LGBT charities
  • Additional security measures and charging at Pride events will marginalise intersectional communities further
  • Birmingham Pride 2012 sucked
  • Nottinghamshire Pride 2012 was utterly amazing!

* Disclaimer: I have friends who work for E.ON
** And they weren’t even drunk, honest!
*** This is a subject for another post, but in summary, the conclusion people tend to reach is that people should buy in bulk and cook from raw ingredients, and avoid all luxuries. This completely ignores the realities of such positions

Poem: Company

It seems that the creative bug has me at the moment, for as I walked home from work, another poem started to come to me. The biggest tip I’ve learnt for creativity is to not delay in acting on it – it is so easy to just think that you’ll note it down later, but by which time the muse will have left you.

Anyhow, today’s poem, which never really had a name but I’ve decided to simply call “Company”, for lack of something better. I think it’s a little more raw than the last one, and suffers from never really settling into any sort of style. Going back and actually editing my work is something I still have to work on, and there are people in my life I know I can trust for an honest assessment – which neatly segues us into the poem:

A hug that lingers just a little too long in all the best ways
A desire for company so strong it never wants to end
A gracious interest in what interests you, and in return the same
A delight in each other’s smile, laugh or smirk
A fascination in your life, your ways and your kin
Returned without hesitation, for your interest is genuine
Deep inside you both know pain, in ways you both understand
Shared experiences, encountered separately, yet in a way the same
disability and mental difficulty, measured yet still accepted
For those few small moments you have yet had together
Feel like an eternity
And all the world loses it’s pallor, yet still seems brighter than before
Now seen through, and with, another’s eyes

Now the glimmer of hope you have always grasped within
Feels different and changed
Hotter, yet tempered by what has gone before
older, wiser, more mature
Yet still, yerning for new experiences
With a child-like wonder
It desires to explore

And in each other you may have found
A friend, a lover, a partner, maybe more
Or alternatively, none of these
Just two people, meeting for a while
And later, sailing away
And in that we shall both support
Whatever comes to be
Our separation inevitable
Be it by death, break-up, or simply accident
And so we shall forever aim
To leave the other better off for our company
Stronger, wiser, more aware of themselves
or simply a single happy memory
Of that time we both sat together
Wanting that night to never end
Alone, but in the best of company

Poem: live vicariously

I was talking with my sister, and she expressed concern for how much she geeked to me about things she enjoyed. A gave a shorter answer at the time, but this is a little something I wrote to express how I feel:

I don’t have the time
to experience all the things
so show me your passion
share with me your joy
let me live vicariously

My plans are vast
my dreams infinite
but my not ability
to complete, or even start
to undertake

I love that you love
I’m gleefully glad
That you collect the experiences
That I’ve never had

Tell me your story
Share with me your dreams
let me live vicariously
beyond anyone’s means

All the books I’d like to read
Films I’d love to see
Music to carress me
tender or vigourously
Places so many
stretching off to infinity

Tales of wonder
Hopes for the future
memories for times
that never once where

retrospectives on the present
highlights of times to be
laments for the past
fondness for tomorrow

Show me these things
These things I’ll never see
And I’ll tell you
About my own journey

We are creatures of song
of stories and dreams
made to share what we experience
and experience, what we share

I have done things
that you wouldn’t believe
Felt the fabric
of a plot twist so convoluted
it actually makes sense

I have shaped my body
Tweaked my mind
I’ll let you live vicariously
Through this story of mine

Together we gather
around this campfire
unlit, metaphorical
but burning bright all the same

With passion and fear
and hopes, dreams and memories
To exchange what makes us human
And find our own way

Let’s live vicariously
In all our many ways

Songs I wrote: Infinity (bad power metal)

Sometimes, when the muse strikes me, I find myself with a song that needs to take form. In this case, I had just been listening to the gloriously silly cover of Manowar’s Power Of Thy Sword by Rhapsody of Fire:

(Keep that playing in the background, you’ll want the rhythm and general style…)
For some reason my brain then decided to sing “The power of ONE!” in that amusing power metal choral ending style. But then it started ad-libbing, and this was the result:

The power of one [power metal choral end line style]
of two! [verse continuing quickly after, in a slightly confused style]
of three!
and of four!
The power of numbers!
all great and all small!
Uncountable vastness across all spacetime
but a single one I can call mine
a number so special
it rises above
defending what’s right
defeating what’s wrong
with you I do stand
and stand I do tall!
Together we shall battle them all!
[gitair section with choral rising “ooo! ooooo! oooooo! oooooh!]

Infinity!
It can’t be wrong!
Infinity!
you can’t go beyond!

[back to verse]
it goes beyond all numbers
all big and all huge
vastly negative values
it wraps around again
to the biggest of numbers
no match can be found!

With you I stand here
awaiting the end
safe from measures
that claim there’s an end
uncountable elements
go vastly beyond
the scale of this number
knows no bound!

Infinity!
It can’t be wrong!
Infinity!
you can’t go beyond!

It’s very rough, and could actually do with a lot of work before actually performing it (especially the chorus, it’s terribly weak), but I’m amused by this counterpoint to a lot of sayings, and it’s been too long since I’ve written something creative!

Business lessons learnt from Young Apprentice Season 2 Episode 4 – Over 50’s Market

Task: Select two products from a selection of eight suppliers and sell at an exhibition for the over 50s market
Objective: Raw sales in pounds (costs not considered)

When looking to make deals with suppliers, your enthusiasm for their products can help to secure you deals, such as cheaper prices or exclusivity.

When running a team, it can be hard to let go, but it is important to trust the instincts of your team.

This episode taught us a lot about how exhibitions work. An exhibition is an event that attracts large numbers of the general public who self-select to be part of the demographic the show is about, and vendors expect to make most of their sales to these attendees.

Amongst the attendees to an exhibition, there is culture of expecting to be offered ‘freebies’ and to be given discounts on the items for sale. On the plus side, there is also the willingness to be impressed by product demonstrations. A high percentage of sales at an exhibition are down to impulse purchases, so a good sales person can actually take advantage of the attendee culture to make sales.

Impulse purchases, however, can be blocked by simple necessity – a bulky product can be hard to carry around and interfere with your enjoyment of the rest of the show. Smaller items will probably perform far better at an exhibition.

Another factor in impulse purchasing is the price. As we saw, however, this isn’t about the price being low – it’s about the price being perceived as right. This is why the vacuum cleaner still sold well despite the fixed price. People consider an item’s quality as well as the price when looking to make a purchase, and sometimes the price can be a factor of quality too, indicating if something is cheap or made well.

No matter where you are, be it in a showroom, your client’s offices, or an exhibition, a good product that can be easily demonstrated well will tend to be easier to sell.

Despite exhibitions being primarily about selling to the public, it is worth remembering that there are other traders there who may also be looking to make deals. This can also help to secure bigger deals, which can be more worth your time. This sort of deal is what a trade show is all about.

Business lessons learnt from Young Apprentice Season 2 Episode 3 – Floristry

Task: To run a market stall florist, and pitch to provide flower arrangements to pre-arranged clients
Objective: Profit (takings – costs)

Florists are able to charge double or triple the raw costs.

All flower arrangements are generally based around two main flowers, one of which being variegated pittosporum. These are generally cheap flowers that help to bulk up a display and provide body, but which don’t look cheap to customers.

The two teams sales people both knew their own strengths and weaknesses. Atomic’s team correctly identified that pitching arrangements would be easiest when talking about positive attributes of the end result – flower arrangements are about “luxury” and showing “class”.

Kinetic’s sales team, on the other hand, were the worst kind of sales people – those that have no interest in the product at all to quote James “I hate flowers, and nature and animals”. They at least had self-awareness, noting “if they see a pretty girls face talking about flowers and they see a guys face talking about prices, then they are going to want the flowers”

The first of the clients we saw was the five-star hotel, hosting a ruby wedding anniversary. They wanted five posies down the table, and a larger arrangement for the mantelpiece. The celebrating guests had requested a preference for red flowers, with a particular preference for red roses.

The sales team from Kinetic asked if they wanted the mantelpiece arrangement to really stand out. This was a foolish question on a number of levels. Firstly, the whole point of a mantelpiece flower arrangement is to act as a focal point for the room. Secondly, however, is that the arrangements of the room should serve to highlight the celebrating couple, not to stand out in their own right – as the staff said, they want their guests to walk in and say “gosh doesn’t the room look lovely?!”.

Atomic’s sales team alternatively

The second of the clients was a west-end musical, with it’s producers looking to arrange four bouquets, two for male leads and two for female leads.

Atomic’s sales team was told that as the cost was £40, so to go in at £80, and once again they went in at a higher bid (£100) than requested by the project manager. Kinetic’s sales team, however, decided to forgo talking to the design team when it came to the pitch, but at least this made them sound like they were in control. However this did not make up for their complete lack of design abilities, which ultimately lost them the bid more than the raw price.

The third and final pre-arranged client was an exclusive women’s hair salon that wanted four window displays. They were given a very clearly defined brief – “colour is my pasion, but when it comes to flowers they have to be simple, chic and done with the upmost of taste”. The hair dressers also seemed the most understanding of the needs of a newly started long term business, encouraging the candidates – “treat these windows as your postcard to the world, really” and “its your opportunity to show us how artistic and clever you can be”

One major business mistake we were reminded of in this episode was letting your phone ring during an important meeting. This gives whoever you are meeting with the impression that you are more concerned about your other contacts than them. Whilst Lewis claimed to not know how to turn the phone’s sound off, this doesn’t help – you are expected as a business person to know how to use your own tools!

Something we saw with all the pitches was that you should always research before a meeting about your client, their needs, and what you can offer them. At the least you should know their names, their business, what they are likely to want, and what hence you can offer them.

Atomic decided to price their spare stock at £3, £5 and £10, going from the start of the trading day with a margin of just double the cost. It is no surprise then that we actually saw customers proclaiming how cheap the flowers were. There’s a further mistake to these prices, however. By not having a £20 offering, they failed to have anything for the higher end of the impluse market, and had no standard higher end offering to make their midrange items look more appealing.

In the end the hotel were not happy with Kinetic’s flower arrangements for them. By trying to cut costs massively, they just ended up insulting the client and providing a sub-standard service. What is most notable is that they didn’t even have to – florists base their business around knowing how to cheaply bulk out displays.

Kinetic sending Harry M and Gbembi to sell to local businesses was a sensible idea. Businesses are more likely than consumers to be able to order larger quantities of higher quality flowers, and use of this strategy or lack thereof has made or failed teams on The Apprentice in the past. And we saw a perfect example of the effectiveness of this strategy when Harry M managed to sell the heliconias, finding the perfect location for them, and securing the sale by appealing to a business’s existing customers for social approval for the pitch.

Team atomic: total sales £858.25, costs £407.29 profit £450.96
Team kinetic: total sales £912.10 costs £448.58 profit £463.52

Atomic surprisingly lost, by only £12.56, however. As their failure was by such a close margin, it is hard to really say what cost them the win, however failure to secure the hotel pitch and failure to price stall sales high enough were their only faults. I think the only practical thing they could have done would have been to price their stall offerings a little bit higher, perhaps if just to have had the £20 price bracket offering.

Things to ask about when it comes to decorative sales:
colour
size
how much of a statement you need to make
What do the flowers need to say
Existing theming to fit in with
budget

Business lessons learnt from Young Apprentice Season 2 Episode 2

Task: Design a product (including packaging) for baby and toddler market and pitch to retailers
objective: total value of unit orders

Like always on the apprentice, teams start by thinking of inventions, not thinking about the market and the pain points. This approach is a very bad idea.

Clothing and some accessories will be purchased multiple times, toys once

girls team finds existing products in their niche – this is a good thing, as it validates their concept. and the girls don’t worry about this!

don’t be confused or conflicted in front of your designer- this destroys their passion for your work

The easiest pitch is to let a product sell itself – base the pitch around why they should stock the product, not around explaining what the product is – this should be apparent in the first minute, followed by how it’s different from the rest of the market. Pitches should never just be a feature list.

research your targets before pitching – and if for some reason your targets are fixed but your product isn’t, invent for your targets

If a presentation receives poor feedback, look to improve before giving it again to address the main issues

Botique Department store Mothercare Total
Boys 1200 0 4000 5200 Units
Girls 0 0 7500 7500 Units

boy’s failure was due to the pitch quality, rather than product. The book idea was ok, but it would have been a harder sell to some of the retailers

Ben really did not seem to do anything in the task, but that could be an editing decision.

Business lessons learnt from Young Apprentice Season 2 Episode 1 – Frozen treats

The BBC’s Young Apprentice has returned for a second season, and a lot of people watching it, especially young people, will be inspired to try their hand at business. This is a good thing in general, but the show as a whole doesn’t teach you the whole truth about business. But what can we learn from it?

Firstly, some general points about The Apprentice show as a whole. These are always worth keeping in mind when watching the show, and are what sets it aside as being entertainment television, rather than factual:

  • The applicants have clearly been selected for screen presence. Yes, they pick a range of personalities, but that is only because it gives better television
  • The contract that goes with The Apprentice is one hell of a gamble – few people serious at business would take it on. Applicants are required to sign over all their business ideas whilst on the show and for the year following if they win or come second
  • Each episode starts with an montage intended to make you already have a feeling about each applicant before you’ve even seen them in action that episode
  • The show is highly edited to create a storyline for each episode, and a character for each applicant
  • The Apprentice tasks are all one-off events, with no need to maintain a good reputation, and in general you can expect to see all the bad habits of pop-up businesses being played out
  • The Young Apprentice prize fund of £25k is nothing, and won’t cover modern tuition fees. They are being offered basically a year’s graduate salary. The big win, however, is the easy industry contacts and the television coverage
  • For businesses shown as the winning team ‘treat’, the apprentice is very much a major boon. These businesses are presented as the life of luxury, and are probably offering their services for free in return for an incredible advertising opportunity
  • The team discussion after a failure is not about trying to actually figure out how to improve, but who to blame and how to make good tv. Engineers know that this sort of situation is ideally suited for root cause analysis. Sadly a culture of blame makes for better TV, but I worry about the precedent this is setting
  • A regular feature in The Apprentice post-failure reviews is “what did you actually do?”, and sometimes this has to be asked as part of a root cause analysis. This is why it’s important to track what you do, keep a list of things done, and as a manager, ensure you have the statistics and analytics to make decisions based on evidence
  • As the Apprentice operates pop-up businesses, come the end of the day they normally slash prices to near cost to clear stock. Businesses that are not pop-up traders would only do this with stock that would otherwise had to be disposed of, or if the goodwill was worth it. At the end of the first episode, Lord Sugar states “the fact that you ended up selling off a load of stuff in the end is, really unforgivable”, but that’s patently not true!
  • One of the sad things we see every time on the Apprentice is that there is no incentive to really try and build an effective and working team. Time and time again we see a newly formed team descend into some form of infighting, often about who came up with what idea. This infighting directly interferes with the process of team formation. In the real world, it would probably better to acknowledge mutual input and praise, however there are no incentives to do this on The Apprentice

At the start of the first episode, Lord Sugar states that he doesn’t care what class people come from, only if they’re ‘first class’. This is entirely false – class advantages affect how people act, and have been shown to make a huge difference in business. Those applicants from better backgrounds will almost certainly do better on the show, unless any of the others have been suitably mentored.

The Task: frozen treats (ice cream, sorbet, etc)
Objective: profit (takings – costs)

Only one of the teams attempted to estimate their sales quantity, but in my opinion they went about it wrong. Don’t simply assume a quantity you will sell per hour when estimating supply – estimate instead this figure from footfall, how many you will catch to pitch to, how successful on average pitches are (assume a rate of failure), and on the time you will need to pitch and serve customers.

In this exercise, costs for raw materials were very low, so the cost of having spare stock was minimal. As in the end both teams sold out entirely, the teams would have been better to produce more stock, with the reserve plan of having to try and sell at cost.

Kinetic (the girls’ team) based their branding around “Treat and Trim” – this is utterly awful, as they are still selling ice cream. People don’t want to be reminded of a negative when they are going for an impulse buy. This might work out better when it comes to the long-term branding of a product, however, as you can switch the consumer from impulse thinking to brand association.

Some materials are commonly purchased by weight including wastage. This needs to be accounted for. Similarly, be careful proceeding with purchases reliant on another delivery that you are still waiting on – if this messes up, you may have excess material on your hands. For a pop-up business having any excess that can’t be used can be a disaster. Thanks to forgetting about this, Kinetic were forced to dump 30 litres of ice cream mix.

Atomic priced at £1.50 for one scoop, and £2.00 for two, which was sensible. This clearly shows to the consumer that it is better value to buy two scoops, and makes the upsell more likely. It is always easier to secure one customer and upsell, than it is to secure two customers, and this helps to also shift stock.

Atomic’s pricing strategy was to undercut the market on price – whilst potentially income, this often can help to increase sales. Of course, they didn’t then have the stock to take advantage of that and, as we saw later, it turned out that by charging so little they lost a lot of potential revenue. Something we did see here however was that most of their sales team were keen to have a low price, and proceeded to sell well thanks to having confidence in their price as well as their product.

Kinetic performed the legally dodgy activity of giving people extras and only afterwards charging for them. They also gave children ice cream and then hassled their parents for money. This would quickly get you in trouble if you where an established business, but as a pop-up business such tactics made sense to them. Ultimately, however, any long-term business trying this would get in a lot of trouble for such tactics.

James’s acting as pirate vanilla was a good idea “it created a bit of interest. It was more than what you normally get at an ice cream stall”. Characters help to get attention, and would work long term very well. Having lived in a coastal town, I know that the local characters and stories are essential to the community. Life outside of the main summer months is boring, and the colourful members of the community retain your adoration and such business become heavily used and loved by the locals. This generates initial trade, giving social approval of your business to the tourists, helping to build up trade further.

Kinetic also attempted colourful promotion using mascot suits, however these have a number of drawbacks. On a hot sunny day, these quickly become uncomfortable to wear for extended periods. Mascot suits do make you stand out, but in my experience they can actually be a detraction as a lot of people are very wary of them.

Both teams charged extra for sprinkles and toppings, in an attempt to drive up profits. These extras are very cheap, typically, so most businesses offer them for free – like condiments in fast food places. Free extras make customers like you more. Offering free things actually is a sales pitch – if you say “FREE CONE AND TOPPINGS”, it implies that other people charge you for these, instantly making your prices seem better.

Kinetic promoting to the audience waiting for the animal shows was genius – this is an entirely fair form of promotion. This is what kebab van owners do after gigs, or ice cream vans do at school closing time, and is the entire core business of many retailers.

Harry H decides to try and do deliveries to people on the beach – they can spare the people to make the deliveries, and this is a sensible way to access a market their competitors are not in. This is also something you can charge extra for doing, and people will accept. I actually did this back in school, covering the costs of my own chocolate by charging for deliveries.

It was no surprise that both team’s best selling products were established flavours that the market already likes – “cookies” “strawberries and marshmallow” “chocolate and banana” – better sticking to established successful products when in this for the short term. “apple and watermelon” is a nice flavour for a ice crush or smoothie, but as a frozen yogurt it didn’t appeal. Further, frozen yogurt is still a small market segment. In fact, vanilla would have made a lot of sense, as people do actively default to it if they want an ice cream but don’t like the other flavours offered.

Both teams managed to sell out, which was surprising given the difference in location and price. Kinetic were priced above the market rate for their location, and probably were generating disgruntled customers. However Atomic found that a seaside audience may be at a British beach to save money. In effect, this showed that the most important aspect of this week was pure sales ability, and pricing the product right. As both teams were able to shift all stock for at least cost, unusually cost management wasn’t a factor this week.

Kinetic’s project manager ended up operating in the back room, which should have been a very process-driven environment. By this point, the product was already agreed upon, and there was no checks really required for quality control (since they were operating a pop-up business). This prevented her from reigning in an unruly field team on the production day.

When in the board room getting the results, we saw that Kinetic had no idea how much was spent on raw materials. Never ever as a business lose sight of your costs.

Atomic spent: £117.92, sales: £677.17, profit: £559.25
Kinetic spent: £131, sales: £839.34, profit: £708.34

Interestingly, this is one of the few times that an apprentice task has seen a team take home an amount that would cover their wages!

Ultimately, Atomic lost because of their low pricing. To quote Lord Sugar, “That is the most heinous of crimes, as far as I’m concerned, when it comes to business. Cutting the price before you even start”. There are a number of things Atomic could have done better, but the first is obvious:

  • Higher prices – this is really why they lost in the end
  • Charge for everything – this is very mean but what pop-up businesses do! They could have even charged extra for the delivery
  • Replace the frozen yogurt flavour with something more generally agreeable. It is important to note that the apple and watermelon frozen yogurt was not the cause, as it did sell out in the end, and the prices were just too low

People tend to dislike someone who is attempting to claim all the credit – wrongly or rightly. We saw this in the boardroom discussions around Mohammed, with his lines like “I personally think I was the best salesperson in this whole team. I was pushing for sales. I was making people come” ultimately causing people to respond “Mohammad should be fired purely for his contribution, his lack of ability to accept when he has done something wrong”.

Similarly, one very true lesson for the real world is that people like people who admit they were wrong, and will show them consideration for the admission. Harry H also demonstrated that the converse is also true, failure to admit mistakes gets you disliked: “I have a thing I don’t like about you James – you can’t accept when you’re wrong”.

In my opinion, Mohammed was fired because:

  1. Actually causing problems
  2. They’ve had their TV fun from him
  3. james is likeable
  4. Harry H has yet to fail properly

Something Mohammed said at the end I thought was odd was “I’m really surprised I’ve been fired. I’ve still got my successful business, I’m still going to be a success”. In a way, this shows why they were fired more than anything. In business you should try to never be surprised by a negative outcome. Always try to know everything that’s going on to the best of your abilities and anticipate everyone’s next move.

So, how I would have done this week’s task?

  • Stuck to established, well-liked flavours – no time to establish new ones
  • Stock was cheap, margins were very high, selling was relatively easy – always produce more stock!
  • Theming and theatrics – helps to bring in people
  • Delivery/selling to captive audiences
  • More closely match competition’s prices, perhaps beat them if confident enough in theming
  • Just give away extras like cones, toppings, etc – better to charge more for the base product
  • Remember – a free thing that everyone does is still A FREE THING TO PROMOTE
  • Try to get people to promote you for you to other people, or repeat visits
  • Stuck to some kind of luxury treat theme
  • Sell through being awesome, not dubiously illegal tactics – just good sense

As it’s now approaching winter, ice cream sales isn’t really testable, however

BiCon 2011

Earlier this year, I decided to do something about missing regular queer company, and got myself along to the Brum Bi Group. This turned out to be a lovely bunch of people of all genders, and amongst all the new friends I found that several old ones where regulars, too!

It was at the Brum Bi Group monthly meets that I heard talk of BiCon coming up in the summer. As a long time LGBTQUA+* activist, I’d heard of BiCon, but for various reasons I’d never actually attended one before. Now that I had a car and regular income, though, was this a possibility?

  • I checked my calendar – that weekend was free!
  • I checked with the girlfriend – she wasn’t going with me, but was happy for me to go!
  • I checked with the bank – I could afford it!
  • I checked with friends and family – several of them were going! “That settles it, “, I said, “I’m totally going to BiCon 2011!”
  • Unfortunately I didn’t have enough leave from work to go for the Thursday and Friday, but cost-wise that about worked out to my benefit (as I couldn’t afford a full pass). So after work on Friday, I spent the night with my girlfriend, then headed up to BiCon for Saturday lunchtime.

    My past experience with similar events was strictly limited to Anime conventions, small student day-long events, and the occasional corporate event. Sadly as a science and engineering student, my course load made it hard to attend NUS events.

    Even though I was only there for barely two days, every hour was eventful. Rather than try and remember all the details, here’s an unordered list of the highs and lows of BiCon 2011:

    • In terms of the grounds, the location was quite nice, and managed to create a relaxed feel
    • By arriving at midday on Saturday, there had already been two whole days of BiCon by this point. It felt very much like everyone had already met, so mingling was very hard
    • …and on that note, BiCon does suffer very strongly from cliques. As a first-time attendee, it would have been easy to feel lonely. Thankfully I had some family there to support me, but it still felt closed. I suspect this relates to joining on the third day, though
    • I fell totally in love with the con badge sticker system. BiCon has for a number of years done a craftwork badge system, wherein you are given the bare minimum of pre-made card and are pointed to a stand to decorate it yourself. This alone is cool, but what really make this work is the sticker system (from BiCon 2010) – the community agrees that certain stickers on a con badge have certain meanings. Unfortunately there tends to be a lot of sticker meanings, so they are hard to remember, but you tend to recall the ones you are most interested in. Very cool, I wish every event had something like it!
    • …Sadly by the time I arrived, though, there were only a few stickers remaining. So I had to make do with only a few and a lot of “ask me!” stickers. Still, the system’s so cool, here’s a photo of my badge:BiCon registration badge
    • BiCon started as a conference, but the name grew out of the Scifi convention community. This holds true across the whole of the event. In parts it felt like a student-organised workshop conference, with poor organisation but great workshops and lots of inclusion. At other times, there were some very hard-hitting talks, like an academic conference. All the while, though, there was the party atmosphere one expects from a convention. Definitely took some getting used to!
    • Some of the more academic talks were very good, and quite surprising to see come up. Very much approved of the opportunity to attend these
    • I heard that some of the workshops sounded good, but were aimed at a less experienced audience than the one that attended. This shows great things about the people who attend BiCon, but perhaps is something to think about
    • Some of the workshops I missed, however, sounded positively fascinating. The brainstorming walls from a few of them remained up afterwards, revealing some incredibly deep discussions about Being a bi person. I was tempted to photograph them, but it didn’t feel respectful of their creation within a safe space
    • One I felt safe to photograph, however, was one of the clear similarities to a scifi convention. There was at one point a discussion about bisexual fiction, and afterwards their recommendations were posted for everyone to enjoy:BiCon scifi recommendations 2
    • As the party unfolded on Saturday night, update newsletters about tomorrow where handed out. This was a great idea, and something I wish they had done at Ayacon a few weeks previously
    • BiCon was one of the most inclusive spaces I have ever been in. I noticed a number of people with impairments, there were quite a surprising number of out trans people, and generally everyone was able to be themselves
    • The party on Saturday night was good, however I missed my normal rock DJ
    • …However there was a period on Saturday night that felt like “get hitched hour” – people’s body languages became distinctly about sleeping with people, it seemed
    • Although staying with family off-site was cheap, it did prevent getting an early start
    • The BiCon closing ceremony felt like a community love-in. This is understandable, since every community needs one, but as a first time attendee I didn’t get anything out of it (other than the location and committee of next year’s BiCon)
    • Something that appears to be a yearly meme is accommodation issues. I didn’t meet anyone with anything positive to say about the accommodation this year or in previous years. People are optimistic about next year’s arrangements, however I know people who have stayed in the halls that will be used, and no comment
    • BiCon was a very white-dominated event – which thankfully the community is already working to address
    • In fact, there was a workshop about BiCon itself, and from the wall of notes, it seems that the event is aware of almost all it’s failings. This is very much a rarity, but the real test will be how they act on these
    • Finally got to meet some incredible people I’d known online for a while!

    All in all, BiCon was a very mixed event for me. Some of best things about BiCon was less the new, and more the time I spent with my family and old friends. Some of the worst would have probably been addressed by attending for the full duration.

    There’s a strongly related unConference called OpenCon. Sadly I wasn’t able to attend this year, so I was very much pleased to find that Ludi had done a rather wonderful write-up of OpenCon. Although this was written about OpenCon, one passage applies to BiCon:

    I think it was because many people had very little chance to talk about sexism in their everyday lives

    For a significant group of people attending, BiCon is their only chance to be Bi or otherwise queer. I’m guessing most people would have never noticed this, since I’m more sensitive to body langauge, but it certainly created an odd atmosphere at times. It makes me wonder what can be done for these people outside of BiCon. I think events like BiFests and the local Bi groups are an important start, but clearly more needs to be done.

    All in all, BiCon 2011 was a very mixed event for me. On the journey home, I was unsure about going to BiCon 2012. But almost two months on, I find myself remembering all the good bits and really wanting to be in such a space again. And as an activist, I know there’s only one way to improve community-ran events – to dive in and do what you can to make them even better!

    Next up in my calendar is Brum BiFest, which clearly still needs some work on understanding the gender spectrum. I’m going to get involved with the community and see about improving everything I can. And, with any luck, see you at BiCon 2012!

    * Lesbian, Gay, Bi*, Trans*, Queer, Undefined, Asexual and plus all the rest. Bit of a mouthful, but at least it’s now properly inclusive