What's up everybody, Jason here for JasperysHBase.com. This is our last filler, but it might not be actually. We still have 10 spots to sell straight up, so if that doesn't sell out in the next few minutes or next 10 minutes, I'll probably cancel those 10 spots and turn it into officially the last, last filler. But this is to give away 10 spots in Origins Random Teams with this 2019 Mosaic basketball hobby pack break number 368. So again, Randomize Customers Names, Teams, Distribute the Hits out of the pack, and at the end, Randomize the Customers Names again, top 10 get into the Origin Break. So let's do the break guys, roll. It is a one out of six, seven times, good luck. One, two, three, four, five, six, and seven. Peter down to Ryan, seven times. One, two, three, four, five, six, seven. 76ers down to the Portland Trail Blazers. So again, stick to what you got. Now let it switch scenes. Now let's do the giveaways again, top 10, get a team. Roll, six out of two, eight times this time. One, two, three, four, five, six, seven, eight. Eight times, eight. Jeremy, Matt, Eric, Nico, Chad, Chad, Chad, Jason, Kay, Nancy, and Ryan. I would just want spots in that break there. So let's paste your guys' names in here, guys. And like I said, I'll give it a couple of minutes, like maybe 10 minutes or so. If nobody buys spots in that break straight up, then we'll just cancel those 10 spots and turn into one more filler. So appreciate you guys, Gatsby's casebreak.com.


It's the breakfast in Plastivia, Africa, and we take you through the pages at this point of the national dealies. We'll set off with the leadership newspaper this morning. We'll also have the punch amongst orders. Now, G.D. Johnson is on standby. He joins the conversation in no time. G.D. Johnson, good morning, and thank you for joining us. OK, well, we get him as soon as we're able to have him connect with us on the leadership newspaper. Political parties reject drug tests for aspirant, and that's a bold caption for the leadership. Underneath says it's an affront, one NDLEA, not a toy with politicians. CSOs divided over planned drug tests. Tests not to stigmatise aspirants is the NDLEA. So, I mean, the back in 40 yesterday, he talked about this. But of course, no one was anticipating that you're going to have these politicians or the aspirant. These aspirants are agreeing to this. Now, 2023 presidency, again, northern elders say no to zoning. What is the party saying? Nobody can reek 2023 elections. President Mohammad Buhari tells politicians, and the likes of Nyay Tok would say, it's the best thing that happened to Nigerians. I wish they knew. Denies ordering Senate to remove Section 84 and Subsection 12 from electoral act. That's what this rider is quoted to say underneath that board caption. Also talking about 2023, but this time the Niger 2023, blueprint publisher picks APC nomination form. Everyone can pick a form. I take a 6 right of fest refusal from PDP. That's what also you find here this morning on the leadership. Now, these are some of the headlines. But just before we move away from the leadership, Cano, cross-revert, true example of national unity, Emy Bairu, is quoted to say. I'm sure a lot of people might want to argue with that particular postulation that's been put out by the Emy Bairu. That's the much we can take this morning on the leadership. Away from the leadership, I will slide on next to the punch newspaper. The main caption is on the presidency. PDP reps, sons, one Jonathan groups or group threatens suit. What's some riders there? Expressed in Kent contest, it is risky he'll be ridiculed. Falano. Y meccan gigae. Reject APC. Bohari's offer it is offensive. This graceful to all of us PDP reps will go to court if Jonathan joins race. We won't tolerate impunity. Group is quoted in that. The latest in the answer is on above the must head of the punch newspaper. Asu, NLC plans solidarity protests three day one in strike. Train attack terrorists release newborns picture. Can intensifies prayers. I deserve right of first refusal. Attic who tells PDP. Ramos stories NNPC three orders generate 28.02 trillion narrow in three years. According to a report by 80 65 core members to repeat service in on door. All this security challenges. Threats to Nigeria's existence. PDP leaders will work to rescue Nigeria says Makhinde. U.I. students disappears from Lagos construction site. Family panics. Ogun police parade 69 suspected ritualist kidnappers. Others woman pays Lagos traditionalists. 26 billion Nair mercy. It's actually a woman for spiritual cleansing. One person actually not to think it was several but it's never run. Found out it was just one person. Well people do have so much money to throw away. AFC others emerge. Preferred be this for 12 federal highways. All right Nigeria's proven gas reserves worth over 803.4 trillion dollars. That's according to government federal government the class Monday Tuesday public holidays. And those are all of the stories on the front page of the punch newspaper this morning. All right we move away from the punch. Let's quickly take a look at the daily independent newspaper just before we move away. On the daily independent newspaper Ramadan Airlines raised fares to another state by 167 percent. That's boldly written and they say fair determined by demand and supply. That's what you find there. Also on the daily independent Jonathan not qualified to contest for president again. If I'll noise quoted on that it will constitute the crocs of our conversation. As we proceed 2023 presidency. Give me right of fast refusal article begs. The PDP leaders. Also Labour threatened strike over federal governments negligence of us. It might just be a long one. And absolute value resumes suspended strike next week. Federal government state and local government share 19.01 trillion era mineral revenue in three years. That's also another caption. And you find another board headline saying total to put its stake in joint venture on sale. It might just be some business under editorial reports right here. Buhari vows to protect vote of Nigerians in 2023. And all the quarters would say the president saying nobody can wreak these elections. Also vice president debonks to the boost influence in becoming vice president. OK. These are really interesting days and times. These are some of the headlines this morning on the daily independent newspaper. And of course we also have the nation newspaper this morning. Buhari to court electoral act 84 subsection 12 on constitutional. In security sector to arrest and sleep in Niger Republic. Terrorists release photo of baby born by hostage. All right. Most stories on the nation. A PDP sued for her in May 16. APC drops guideline on resignation awaits court verdict. And the F that's not an elders forum chair urges parties this represential tickets open. PDP screams 48 aspirants for governor in southwest south east. Bola Rumi challenges marketing day. Abakiri loses bail battle. ICPC probes FMC bus. Over 176 million narrow COVID-19 cash. Let's see if we can stick all the stories on the nation newspaper this morning. Falunau a Jonathan barred by constitution from contested. OK.  Those are the bulk of the stories on the front page of the nation newspaper this Friday morning. We do have GD Johnson joining the breakfast at this point in time for his thoughts on the papers and looking at some of the top stories on our national dealies. Once again, thank you for joining us GD Johnson. So, um, let's quickly share your thoughts on this one. It talks about the politicians saying they will not adhere to the drug test. And that's on the leadership newspaper this morning. So yes. The drug enforcement agency had mentioned that there was going to be a drug test for politicians as a matter of fact that returned to the APC. Now, the politicians are saying that's never going to happen. So there's a back and forth at this point in time. What are your thoughts on this new development and the actions from, you know, the politicians? I think that the national drug law and the drug management agency are standing. They are standing in the room before we are. They are on the front stage. And I think that they are just trying to stick to anything. And that's why I said I'm not fighting the APC. And then I stand in the door back at this point in time. What are your thoughts on this new development and the actions from the politicians? I think that the party should be a project for the political, for the university and the country in the future. I don't think it's really the problem here. And the L.E. to interfere in a part of the parties and internal parties at this point. Probably after that, it's the candidates and then it becomes part of the process of creating the result. For the candidates that are constructing the lesson. But for the primary, what is the result of N.D.L.E. in the internet culture of the political party? I mean, there are other things that we should be rather focusing on. Because the attention on the political party. I think that's not the attention that has been taken by N.D.L.E. as my president. What's the result of that? The president is actually the main focus. P.D.P. Reps, S.A.N.S. rather, one Jonathan group threatened suit. It's all about his eligibility to contest the 2023 election as the president. And a lot of people and a lot of groups are reacting. How do you reason, JJ? Well, I saw the rights of the monarch of the population. And as we did in his life, it's the political plush that contests the election. Whether I want to go to a city that has been fighting, demonizing in the important, or I want to go back to the community that was a platform community that led the press and the rights of them and then the president. As well as that thing of no bias. So, the content of the issue is respect to whether he could contest a deal and to not contest it in the left of the political party. But that's not the example that I'm talking about. It's entitled to contest the election. It's nearly completed. And it's not in second. If you have no relation with 2015, we'll have completed it as the president, the federal republic for 2017. So, those groups, it's not the political party. It comes from the side whether it's eligible or not. But for me, that was in the first instance. It depends a bit on people. A little bit when you do that, you know. How would this stop people from, for example, a government that has nothing, and then they have to complete this demo. I said, because it's the only white, it cannot seek the election. You give me the wings, another election. That means it's impregnating on the right. It's affecting to not have to be based on different, coming from different views. But who do you know that you do that tomorrow? That's on the people. So, I think that we have very interesting conversations on the papers this morning. On the leadership, you have another caption saying, 2023 presidency, again, nothing elders say, no zoning. Well, there's no zoning in 1999. There's no provision. The zoning arrangement, the PDP's arrangement, was PDP arrangement to use the zoning structure for their party. In 2014, you will recall that in Kwakwasu, I feel cool. And then one of them is the one that came in for the first time in my life. It's a culture. So, it's a culture now. Contested the two-peak supermari in Lagos in 2014. So, in 2019, the state was left to look for Bwari to pick the ticket for the APCI and Bwari at the coup ticket back of PDP. However, we're based on the norm. But politics are not based on norm. Politics are based on respect. If you're based on norm, you don't think that the party will pick their presidential candidate. Both parties will pick their presidential candidate from the south. But in 2019, the presidential candidate of PDP was from the north. However, politics does not work in that. That is the problem here. There is a need for us to have a conversation. And that's how we move this decision forward. But if you ask me the meaning of what better fit as professional president's vision idea, I think we need to set the same federal parameter. We need to do away with this term by term presidency. We need to embrace the principle of merit. We need to elect leaders based on their confidence and not based on where they are from. The reason why we are found ourselves now is that we elect people on the basis of sentiment. And sentiment cannot stop marginal problems. If the best man is from the north, let him be the president. If he's from the south, let him be the president. If he's from the south, let him be the president. If he's from the north, let him be the president. And I think that the way we should be looking at who becomes the president of Nigeria, I will do away with this term by term. Of what benefit has why the president need to be put from president? Of what benefit has about the president been to people from a good state? The interesting thing was not that. Y Adrawa Siwm Cwynag Threyd worries from Cwynag Threyd. Of Asvandhwch Siwm Cwynag Threyd. Now, personally, the vice president has relocated politically to a good state. To a good state by terms in this present democratic position and not in presidency for eight years will get vice presidency for eight years. Mae yw un'r perffidd ddweud am y dylai gyntaf ar gweithio. Dyna'n meddwl am y gwyloedd hwnnw, mae'r ffalu yn yw'r ei ddweud. Mae'n meddwl am y ddweud yn dweud, ac mae'r terfodd yn dweud am eich âchegion arno ar eich gwyloedd. Mae'r ddweud am eich ddweud am eich ddweud... ...fodd yn dweud hatchedii'n fwyloedd. Ac dw i'r agaith y gallwn y bywain i'r dreffwyd. Yna ddweud ar gweithio ar hyn o feddyr y bywain. Ond os yw'r Fygoedd mawr o Gymru? Felly, mae oedd eich gwiaith ym Mwneud eich gwasgau'u. A'r Fygoedd eich gwreith eich gwreith eich gwreith eich gwreith eich gwreith eich cyfnod i hyn o ei ffordd yng論, oherwydd i chi'n ei gyfrifiad yna dw i chi ei fod yn unrhyw ni ar EU rep ru. Felly, mae'r ffordd eich gwreith eich wneud yw'r Pwg Gweithful Ndeig Ddynion. Felly, mae'r fyddi gydiannau mwyaf honno yn gweithio. dyma yn ysgol. Let's see which one you want to just jump on, Gideg? Well, for me, the opportunity is about what it is doing in my place, that it is feeling about that to me that some group of politicians do not think that they have the money to make this decision. So that's, I don't know the entire thing that people don't know, said that I have the money in the bank, I have the money in the bank, whether it's out of the flow, the dummy of Bwari, Bwari has to have the money. Bwari has to have the money. It's not about goods, it's about public health. It's about people that have the capacity to solve a problem. Now, Bwari, the majority of those that are fighting themselves, as presidents, are coming. I've been part and part of the political process. I've almost been part of the sense of what we have to show for democracy. So that is for people like us, people, and people who are fighting themselves to want to become president of Nigeria at what stage of their life. So, let's play a game of the people to decide, and let's play for the delegates of both parties to decide who will be their flag bearer for the election. But as far as I'm concerned, I know who I vote for when the election comes. And I come here to be clear that I vote according to my conscience, I'm not based on the view of the political sentiment, I'm not based on the view of the political party, but I vote on the view of competence, character, and integrity. Jide Johnson, when do you think we're going to get off with... I mean, it's going to be over with ASU and the federal government. It's really sad. I'm asking when do you think that we will get over with the ASU and the federal government saga? I mean, it's telling a lot on the education sector. When the Minister of State for Education doesn't obtain the form to accept an interest to present the election, when the Minister of Labour and Productivity also indicated the future, someone was given the opportunity to manage the department of government, and they have shown the lack of capacity to manage the department of government. And that person has the gum shot to say that they want to be confident. So there's no ending to ASU strike, because government is not engaging them. The people that we have elected are not engaging them. The people, those who are elected are not engaging them. So both ASU and federal government are two perpendicular lines. And we have perpendicular lines that can never meet ASU. And we know it's infinity. So there's no conversation at all about the election. Electrally, I'm completing, I'm taking over. About first, the political class at the start. What the election is in is in place. They don't care about anything. They care about those. Now, it's to say that the Minister of State for Education has no choice of state, including the Minister of Labour and Productivity, that they could even have that thought to say that they want to contest for the president when they can manage the educational sector. They will not commit dual economy into their own hands. What will they do with it? All right, Gide, so before we wrap up this session, let's talk about, do you really think it is fair that the airlines are talking about demand and supply and, right now, they are increasing their fares by 167% to just northern states, really? Are they, in order, in your opinion? Well, thank you. What are you going to do with this, Minister? I was causing my colleagues to complain that they were worried. They were worried that they needed money to make it to a salary that would provide them as kind of a thing. They found out the cost of living. It's much earlier, everybody. The salary of living you buy, you bought for $20,000. That worry and I think that you need to campaign for $20,000. It's not for $18,000 now. So, what is affecting the airline? Are they going to run as a lot? I knew of a standard of hospitality business. I went to his place. The pitch of the game, because the cost of business, business is almost unaffordable.  So, if you factor in, I'm sure, those airlines must have done factor analysis. They must have taken into consideration their income and expenses. And they want the bottom line. So, we don't put the blame on the airline operators. We put the blame on the federal government itself. What is government doing to amenerate the pains of an average Niger? What is the federal government doing to provide incentives for people running their business in the country? So, there's no bailout. In other countries, there are bailouts for critical sector of the economy. What were the bailouts for? We just saw them sharing money. Money that cannot be accounted for. And then, on Justin, you can't blame the airline operator. It is practically almost impossible to run any kind of business in Nigeria. I think that this might just be a plus for us. I mean, just quickly. We know that we're going to be talking about this in the next minute. And the issue of Jonathan saying that, you know, Falana saying that Jonathan is not qualified to contest for the president of the Federal Republic of Nigeria come 2023. What are your thoughts? It is a coach that has decided that it is not the opinion of anybody. So, it's for the coach to decide. Every Niger has a right to contest. The Netherlands has only contested for that topic now. And I think he has a right to contest. But if anybody feels otherwise, the government will approach it. And the government will decide whether it's qualified or not qualified to contest. However, I think that we need to challenge the positionality of that law itself. That law that was signed by the National Assembly, need to be tested at the courts. If you hear that, that law is constitutional or unconstitutional. That's my view on it, with respect to that. But we do not have good luck. After all, his name is good luck. Because he wants to contest the election. But Nigeria is ready for him. It's there for him to decide. If you're still waiting for people to prop him to contest the election, then he's not a man of goodness. He's not sure if he doesn't even know what he wants to do. So, we don't want a lot of time for the president. We want people that have looked at their minds. All right, thank you so much, Jonathan. I'm back on my computer. I saw a different type of person. You must run. You must run. You must run on your phone. You must run on your phone. All right, Jydei Jonathan. Thanks for your thoughts that you have shared today. Jydei Jonathan is the chief lecturer at Nigerian Institute of Journalism. Thanks for your time this morning. All right, it is to the Breakfast and Plus TV Africa. We'll take a very short break. We'll come back and talk about the eligibility of a former person. We're running for 2023 presidency in a moment. You don't want to miss to join us again.


live. Let's just start with the introduction. While we wait for people to arrive at the live, arrive at the live, yes, that's a rhyme. My name is Kim Diaz Holm, also called den ungehard Holm. I make art for free use. So you can download my art, you can copy it, you can change it, you can even sell it for profit as long as you keep my name on it. Or attribute me as you want. And today I will be drawing some Inktober is Pinktober pictures from Stuart Sample's Pinktober prompt list. It's the second last one because it's October the 30th. If you like what I'm drawing then go to den ungehardholm.com and use the promo code Inktober 23 for 20% off all October, which means one and a half day left. And if you want to support me so me and my team can do more stuff like more lives, more videos, more shorts, more free art, then consider becoming a member. Now let's flip the camera around and see what we drew yesterday. Hello. Oh, better replace games. Timmer, jammer, crates. Good to see you. Just for fun. Yellow, Mona, yellow.  Good to end it with this. Thank you. We'll see how good it will be. Maybe I'll make it very bad. I'll try not to make it very bad. Hi, how is it already the 30th? Yeah, this month has gone very fast and very slow. I don't think I'll be able to be here tomorrow, but I'll try. Do try. Oh, you know, I'll have more live streams. This has been having a full month of live streams has even with the COVID and the depressions and all of that jazz. It has reinvigorated my love for live streaming. I haven't felt this much fun live streaming since the beginnings of my TikTok live streaming. And this is in a way more fun because these live streams will be up on YouTube for eternity. So for eternity, YouTube for eternity. So I have to be a little bit more careful with what I say or not careful, but I have to try to make a little bit more sense and not wander off talking about YouTube for eternity. Aloha. Let us get this party started. Hello, Kim. Glad to see your streams. Thank you, Lars. I never managed to finish these month challenges. Haha. Well, it took me quite a few years because I started doing in October when it was very new. And I don't know if it was like the first three or four years I tried. I didn't manage to stick the whole month through. I thought I would every time, but I didn't. So sometimes it takes time.  And people started buying them. So I felt, I have to make a new one. This year, I don't think we've sold any of these yet because none of them are scanned yet, but they will be up for sale probably next month. I think we have a few more questions or comments that I will read after I write after dark and number 30. Okay. Hey, Kim. Hope you're okay. I missed the last few streams. I poisoned myself with spray paint, glue fumes, and then had a Halloween party. That sounds like quite a Halloween party. Don't poison yourself with spray paint. Is this the art video where you draw whatever fans request? No, but I will be trying to do that, to take that up again. At some point, the free art show. But I will not be painting people's profile pictures on the free art show either because I paint art for free use, art that many people can use, not just a profile picture. Hello. I'm eating right now, but I'm going to make some cookies after I'm done. I have 10 of the originals. Yes, you, Mona, you started collecting my work a long, long time ago. Hope you are well again. How's it going? It is... I'm better physically than mentally. So I don't know what I'll do for after dark. Good mood, goofy face at end. People do have all these theories about how they can see when I'm in a good mood and a bad mood, and very seldomly do people hit the nail on the head. Sometimes it's very obvious, sometimes it's not obvious at all. Have you drawn Cookie Monster? No. Or I have drawn the Cookie Monster in my lifetime, but I can't draw copyrighted characters on these streams or on my page because I release all my art for free use, which means you can download it, you can copy it, you can change it, and you can even sell it. And that would be very illegal with the Cookie Monster. So after dark, what does that make you think about? Just someone, someone watching in Dark Street, celebrating monsters. Did you hear about Matthew Parris Demises? I'm sorry to hear about him dying. All your pieces have such an inspiration as a horror artist. Batman! Do you use acrylic paint? So right now this is an acrylic ink, and I will probably be using this ink as well, not this acrylic as well, and I'll probably be using some acrylic ink or plain acrylic on top of that. Usually I use a lot of Indian ink, but Indian ink doesn't stick all that well on top of acrylic. So, and I'm, I'm all out, I think. Yeah, I'm all out of my pink ink or watercolor, maybe it is. But you know, you can use watercolor and ink, you can use watercolor and ink perfectly with each other, and you can use them all together with gouache. If you know the, the, you can use gouache on top, but it's harder to use ink or watercolor on top of that again. And then you can use acrylic on top of everything, but it's very hard to use anything on top of acrylic.  Yeah, because we haven't started. Yeah, let's do a pink campfire, because why not? Let's, I have one more of these that I've never even opened. So let's try the black one of these. Let's see how this goes. Oh, interesting, create a rough, sort of, not quite a gradient, but a rough transition here. Nothing that works, yeah. Okay, that's okay with mama. I have some pink shading on the characters sitting around the campfire, like this. Do art, because you love it, not for money. That's my opinion. No, but you have to survive. Do you have to survive? So, or if you want to make art full time, you have to survive, then you have to make money as well. So you have to think about that. And even though I release all my art for free use, that is part of my business plan. It's not out of the goodness of my heart. It is a moral choice, yes, but it's also a business choice. It wouldn't be this easy to make the moral choice if I didn't also have a plan that I think makes business sense. It just took about 22 years for it to make business sense. Yeah, money by stuff, stuff you need to live. Are those postcards? Yes. But I guess that was a reply to the question. How would you go about pursuing a career in art if you were 20 today? First of all, I would, if I was young again, I would, instead of using my talent to not be in school and to not have to educate myself, I would have used my, try to use my talent to educate myself. But, but then when finished with that education, I would probably have done something similar to what I'm doing now. I would not have chased galleries. I would not have chased art jobs for publishers or cover art or video games or movies. I would have tried to become an independent artist from the start using social media. And just gunning down on that angle instead of chasing all the traditional art jobs. Okay. When I was 24, I started working more and more. I started working professionally and started working more and more for publishing and for magazines. And I poured a lot of time and energy into that. And I was also bipolar, but I didn't know it yet. So I'm not saying I wasted the time when I worked for magazines or freelance jobs or stuff like that. But if I could do it all again, it would probably be more efficient to go straight to trying to make it on my own and going all in on being an independent artist because I don't think there's a lot of room for, for art jobs anymore. I think that if you are letting your creativity be a tool for other people, then you will soon find yourself in a spot where either you become one of the few that manages to get a job through everything like like an art director or something to that effect or you will lose your job to AI. Time to drop out. Did you decide to make videos in English to reach more people? Yes. So yes and no. So when I started posting on social media, I, from a kind of early age or early period, I started posting content, not videos yet, but posting comics and blog posts and stuff in both Norwegian and English because I did want to reach a larger audience and I always thought there was an international audience for my stuff even when there wasn't.  But then my first sort of small following of fans was mostly Norwegian. So I did a lot more content in Norwegian and I got a lot of them through working in the NME magazine in Norway and through things like local jobs and illustrating Norwegian magazines and books and stuff like that. Not many, but a few. Then I started drawing extreme metal concerts and that got me a much more international audience and that was the first time one of my social medias sort of took off and I got 5,000 followers on Facebook. So by the time, I think I got 5,000 on Facebook in like 2010 or 11 or something like that. So by the time I started on TikTok with the Daily Ink Monsters, it was natural for me to do the content in English because I was sort of guessing that that was where my audience would be. But I did make a few Norwegian and I did make both Norwegian and English videos on TikTok and that confused the algorithm so much. So I made my own Norwegian TikTok which I'm neglecting at the moment and I'm thinking of doing a Norwegian YouTube as well but right now there's too much work with this one. So yeah I'm not going to do it anytime soon. At least not until I have money to increase my team and to get people helping with editing and all the video production stuff I need to get people to help me with. So that was a long answer to a short question. It wasn't a plan from the beginning to post in English to reach an audience. I always wanted to reach an audience but it wasn't clear to me whether that would come from doing things in Norwegian and then having them translated or doing things that didn't need to be translated or doing things in English. And I always felt some reluctance to do things directly in English because I really think that a lot of Norwegians, for instance a lot of Norwegian bands, write very silly lyrics in English. So yeah everyone like to stream, like to stream, do like to stream, get more people to get in here. That would be good. Click the like button, comment, send super chats. Everything helps to bring more people to the stream and more people to the stream means more people to my content which means more money down the road some place somewhere so I can increase my productivity and my team and make more art for free use. Yes. I think comments bring more people so let's talk chat. Yes. Do you feel it's easier or faster to get a following on TikTok than Instagram or YouTube? I don't know if it is like that anymore but yes it was insanely fast to get a following on TikTok and it was most likely the reason was that they did something that the other social medias hadn't thought about which was try to get content creators addicted not just viewers addicted. That's my theory and I'm sticking to it without any proof but I'm not sure if it's that much easier now because now TikTok has really hankered down on their advertising features which are sort of the worst and least transparent monetization options in the whole social media sphere. It's really awful and now YouTube and Facebook slash Instagram are still trying to catch up with TikTok so right now Instagram and YouTube and Facebook are more desperate to find things that work for them and to make a workable environment for creators there so right now I think it's probably easier easiest on I mean YouTube shorts could be can be easy for a while not easy but it's not that much work comparatively it's always much work but probably this is just the gut feeling from the last month or so maybe Facebook reels is the easiest place to get a following right now out of the big established ones because meta is pushing reels really hard on Instagram but that's more established but now they are pushing it really hard on Facebook as well but strictly speaking there is probably some other social media platform which I'm not aware of where it's even easier than that and that will blow up in a year or two or the world will blow up so maybe no social media will be easy ever again thank you Jonathan Reniaz thank you so much for sending that is that a super chat or is that a super duper super I need to figure out what all those things are does anyone know with the super stickers and the super chat and stuff and with memberships can you make custom stickers and custom animated stickers a custom emoji some stuff like that for the chat just testing a super sticker yeah yeah so that was a super sticker thank you thank you that will help getting those will help grow the team get more financial stability and get to do more fun stuff we're closing in on making it sustainable for the three of us working right now so most of all we're working on making it sustainable for me to just focus on this stuff and do less of the other stuff but it also has to be sustainable for Christopher and Don who I work with who also do other jobs and then we will have to you know expand to get probably an assistant for me and probably someone to help with the editing and all that stuff I only have a youtube no insta facebook twitter I know myself well wouldn't be good for me yeah so there is still a lot of room for growth on youtube especially when they feel they have to fight with tiktok so there isn't necessarily any advantage to trying to be on all the platforms right now the reason why I can be reasonably successful on all the platforms is because I got so big on one of them that I managed to get some people to help me and get a team behind me and they do a lot of work with the web store or all the work with the web store and that makes it possible for me to to triple triple publish I publish all my videos now on facebook instagram youtube tiktok and minds of all things so so that wouldn't be possible another super sticker I need to really figure out if I can make my own super stickers because that would be much cooler I mean there's a black cat but I can draw a black cat are you saying I can't draw a black cat youtube so so I yeah I need to do that I think you can yeah I need to figure that out and that's one of the things that now that I have some people helping me I can actually we can actually get it done maybe I'm thinking of quitting X slash twitter because it's never worked for me and I think just the whole feeling of twitter X after Musk took over is it's kind of disgusting I'm not liking it cookings are baked cookies are baking right now cookies this is not much I will join as a member next month thank you so much I need to add payment methods first damn I just followed you a few days just had followed you a few days back what oh oh on X I haven't decided if I will delete my X that sounds wrong Twitter I mean yeah so a lot of people ask me how I pronounce my name and I understand that that can be difficult for others who are not from Norway so I will say this now slowly so you can hear how to pronounce it my name is pronounced Kim that was my name pronunciation joke how much is it to become a member right now I think it is what is $4.99 or $5 and right now there are no real benefits it's just supporting so it's you can also support on Patreon for some other benefits but we will try to make benefits for the YouTube support members and the Facebook members and all of the different members your streams help me be creative thanks thank you your your super chats help me be creative or stay creative I don't know they help thank you the third super on this live stream that is excellent I'm liking this picture it's a silly one so the first first extra you will get by becoming a YouTube member is that you're going to reasonably soon get early access to YouTube videos because I'm in the process of finishing or making I mean three four or five longer videos very simple videos but longer videos and those will be published I guess once a month or once a week or something like that but once I've edited them edited them finished I will release them for my YouTube members now I almost forgot what was the point of this little drawing like this a little man there I also absolutely love coming on your live and on scots because I love your art and the chat is always so kind yeah I need to start finding some moderators for my chats because once in a while we get trolls and it's not always easy for me to to moderate it myself he focuses on art because that will make him famous and gain millions of dollars I'd love that is this drawing based on a game no it's just based on my mind right now let's take these this grass and make it into a little pine forest instead so you can see the scale of the monsters that's so much rupees or I thought you talked about Zelda coins uh yeah so so I absolutely do art because I love the art but but but I do have a business plan in order to get more money for this uh you know it would be cool to sit here and say that oh I only think about the art and I never think about money because I'm a true artist but I think that's bullshit oh no it's not bullshit I think it's actually extremely valuable and meaningful to be an amateur artist amateur meaning doing it for the love of it I think more people should be amateur artists but I have always wanted to be a professional artist and I've been a professional artist since 2004 and now I'm actually in the process of making my art career so that I can be more of an amateur I can be more of someone who just does it for the love banning trolls is just using their proper names Dan came about to buy us how does the free for use model work for your business I love what you do okay so this is an interesting question so the idea with how I always envisioned my business right and this is a sort of a very loose business plan that I made in 2001 and it's starting to pay off this year so it took a little time to figure it out but people share and use my art that means for everyone who is spreading my art that means my value as an artist increases the more people use my art the more they share my art the more it's seen by people the more value I have as an artist that means I can take more money for jobs I can take more money for originals I can take more money for courses and classes and lectures even though I don't do a lot of that now I can take more money for prints especially signed prints and that is the basics of the business plan that's why I do for instance the daily ink monsters fit into that because they are cool small they don't take a lot of time and they are a great way of self-expression for me they are fun but also they're easy to use for people and the metal art fits into that because the bands love the art so they share it and then they spread my name and fans use it as well and the tiktok and the youtube now sort of was one of the missing pieces of the puzzle because if I'm an anonymous artist who just draws cool stuff and no one knows who I am then it doesn't matter if I spread my art or if you spread my art because the value doesn't come back to me as an artist the value is just in the work then but when I have a youtube and a facebook and tiktok and instagram where I shove my face in your face and talk words funny make people think and also show my personality then then there is a place for the value to go back to so so so yeah that's my guys someone are you a troll should I put you on on mute until capitalism is an opt-in system that no one has to participate in we have to make money yes I'll keep my eyes on someone to see if that is a trolling account or if it's just seems like some weird thing do you find brown eyes fascinating like how most find blue eyes beautiful I I think that's how it was okay I haven't been paying attention to all the stuff in the chat so I'm sorry if I called you a troll and he wasn't if you I called you a troll and you was then I'm sorry that you're a troll hey are you friends with Scott Christian Savard of Savard yes he is magnificent he is the darling I would say hopefully we will be doing a live stream together reasonably soon now let's turn this around a little bit are you guys ready for me to do an ink monster as well because I feel I have a little bit more energy on this live than I've had on the last few ones so would you guys like an ink monster yay ink monster after two days is it two days since the last ink monster I true yes please would you like one in color or in black and white dab or blow I recognize them voice yes green ink monster green ink monster it'll be green was the first color I saw that someone replied so it was green so with the green should it be where is my green where is my green where is my green where is my green this is deep green I don't know if I like that I have another green I have another green where is my green there is my green blow swamp thing like I can't make a swamp thing like because I don't appreciate how copyright makes you plagiarize things because most of you in the chat knows that I can't draw copyrighted things because I release it for free use and that would be illegal but often people ask you could you do something that looks like something copyrighted and that is plagiarism that is instead of drawing what you want to draw or you are cheating in order to not have to attribute the ones you're taking the ideas from and this kind of dishonesty is something I don't like and it's something that's incentivized given incentive by copyright let us see this way or perhaps this way this way it's the already couture did I do my swamp hands okay let's try to develop these as hands like almost claws like that okay so I don't know if they work as hands wings wings let's do wings of some sort of bird monster a green rock wings of a totally not uh totally not copyrighted monster yes so now there's really not anything left of the original blob and that's okay it's not about staying true to the blob you get it's about using randomness to be able to draw or paint something that you otherwise wouldn't have come up with that's the point that's something that a lot of people miss about the exercise why not tendrils because because because I always started drawing them as as wings now this ghost dragon it's not going to be a ghost dragon it's maybe a heartbeat it could be a heartbeat let's see looks like a green dragon it does look like a green dragon but I do want it to be more bird-like this time I don't know why let's do some ocean floor creatures 100% there is something that looks like this down there maybe maybe maybe there does that would be cool that would be very very cool and a little scary but mostly cool where did I put that thing oh looks like ketzal wings in water yes they're called fins oh that was uh I forgot to dip let's see how this goes oh mind blown yes the things you learn it could be it's not going to be a ketzal but it could in some way be cookies are out of the oven excellent love you sir thank you looks like a green phoenix yes it could be and I always do this little eagle beak so why not do more of a stork beak like this this is turning out interesting it's almost a green rooster it can be a lot of things it can be a lot of things and will take off a lot of the extra color to dry it out a little bit so it's easier to draw more on it's easier to draw more on that's not the ideal way to draw like this but you know mm-hmm then we will add some blue it is indescribable and that is interesting why are males more beautiful among other animals but not us I think males are beautiful among us we have beards which are kind of like something to make us look pretty we have kim yes I think that that our culture our culture I think that a Eurasian patriarchal culture has de-emphasized the beauty of males I think this is not a phenomena unique to Eurasia but definitely very strong in Eurasian patriarch is like you know the societies of the Middle East and of Europe and of China who all you know bears these all these cultural similarities probably because there are cultural ties even back to the Stone Age hello we have a visitor hey hey you want to join the stream no no my what are you drawing I don't know what you think it is I think it's beautiful a vomit bird it is a vomit bird it's not depressed serious it is happy Esteban hey hey I'm depressed serious I'm seriously depressed words words words love the bird thank you leafy good to see you I didn't see you in the chat earlier and if you're wondering why some have green names in the chat it's because they are members they support no you have to pay I can pay by using your money you can pay by using my money and that's no fun are you a member in your own chat am I a member in my own chat I don't know am I how can I join my own chat first I'm seeing Esteban in the wild no Esteban has been on this live before just not in October yes I have in October yeah I think I've come down here sometimes I'm just to say hello oh yeah yeah yeah but you haven't been on a full stream I guess that's true yes it's been a long time I think it was before summer maybe yes last time right long so you should be on a stream soon no no you don't wanna maybe I don't know you can come on whenever you want Esteban it's up to you is that like one of those birds that flap its wings so fast it's it looks like just a blur no this one is bigger than a colibri it looks big doesn't it so it's a big yeary I don't know I mean it could be the Simurg the Persian god bird king of the birds Simurg I've drawn Simurg before but then I it was more not dog like I didn't quite like my previous Simurg so maybe I'll do this one as Simurg I've heard this creature hunts on halloween doesn't really look like a halloween hunting creature does it it could be it could be I'm yeah it was it was really bright so it lights up everything around it yes parrots in Chernobyl oh hello Steve do you enjoy this true crime not really I've had my periods where I've enjoyed true crime like in my teenage years I had the encyclopedia of murder big book of serial killers and all that crap but it's just lying he enjoys doing true crime no this isn't about doing it it's about uh the genre of true crime yeah but but you're not supposed to talk about all the corpses we keep in the cellar on stream we've talked about this before now you have to go into the hole again oh okay this is all lies all lies yeah you're not doing a good job I think I'm doing a great job there's a place in my country named fontein which country is that leafy there is a place called hell what am I making should it be the god bird simulac or should we find a name for it find the name yeah I vote for find the name I hope the chat is with me they haven't chat the chat Bob the finder is the name ooh South Africa so that means uh it's uh uh based on a Dutch name or not that but but africans name call the color for a bird Steven and then and we also have Bob yeah yeah I'm going to go Bob Stevens no yes but no I think Bob Stevens is a great name yeah where are everyone located we can not call it Esteban we want a pretty name you named me that name regrets I've had a few I'm gonna copyright it now bye you can't copyright names you can trademark them my son doesn't know the difference between copyright and trademark I'm gonna get your I'm gonna get your strike because you're saying about life and that was your son no it's friends not regret I've had a few but then again they ain't gonna block me kill a yeah we have to lay down and see for it uh then unscrupulous yeah and the birds shall be shall be named Bob the birds shall be named Bob no they shall not yes it should no no you shall be named Bob we are the knights who say my house is of the grid so no load shedding what is load shedding what's load shedding and I wonder how I wonder why load shedding is something we're chatting about Bob it is its name why why this okay I must agree I am like 92 percent certain that I've used the name Bob for a monster if not once then maybe twice Bob I love democracy this isn't a democracy what do you want right what do you want right anarchy it's kind of like democracy but real great name Dave anti Bob anarchy I said that I liked the YouTube chat I'm not certain anymore I lost words anarchy is basically war no it is the opposite anarchy we don't have to start the war between you me me me me me me me me me and her scream great bird great Bob that's a greater name not that great anarchy is a safe word for punk say yes yes yes i the judge sentenced you to five years in bobby prison i thought you weren't going to be a part of this dream do you eat meat or are you a vegetarian i eat meat but i would have liked to sometime in the future i would like to not eat industrial meat but that's not a possibility right now it is a possibility but it is not feasible right now i'm too lazy we just ate burger king yeah hashtag not sponsored hashtag not sponsored uh so yeah i i'm uh not a vegetarian at all unacceptable you cannot deny someone rights the right to be called from south africa bob arg yes we need to start not not energy not democracy not dictatorship or bob lives matter i'm disliking this chat more and more bob when it's bob bob's your uncle you like this the god bird we all love it's the great bob yeah just call him definitely not bob yeah we just call him definitely not bob i was at this moment thinking of maybe i should just call him not bob definitely not bob is also good with two o's boob yeah yeah let's call him boob well it will fit into the bird family we have great tits we have a blue footage boobies yes so why don't we have a great boob how do you know all these naughty bird names i know birds we've learned about birds in this school uh your teacher wasn't uh teaching you about birds when he called you a great tit you didn't call me a great tit that would be rude hmm we have voted he will now be known as bob the great it has to be called bob the great i ah shall i surrender to this yes you shall you shall surrender you shall not pass now you shall surrender oh i thought i shouldn't pass you shouldn't pass gas you shouldn't pass away the name bob ah bloody hell bloody it's over it came we have the high ground the if this conversation goes on i officially convert to bobism bobism the great bob cult the cult of the bob the worships of bob stand for democracy or you could you could just name the bird burb burb i will um bobo crazy we don't vote in anarchy we don't vote in democracy we can't vote in uh dictatorship but we will vote in bob crissie or bobber no bobber key or bob dictatorship i mean you can just take over the live if you want and i can go do something else oh let's have some i'll just take over the livestream bye dad okay take over the live stream and now i'll write bob no no no no no no oh okay okay i'm going to name him bob but not because you pressured me into it it is my free will free will not holding a gun right now bob the burb bob the burb i like bob the burb great bob the burb great bob the burb okay well i will name him great bob the burb i just need to i hate you guys like just kidding he loves you guys don't unsubscribe i think naming him in bob serves a few super chats i don't know i'm not going to yeah i can give you some super chats no you can't super chat super chat that felt uh that's a super chat now i feel a little dirty yeah do you have the chat uh have you have you not love me now i'm going to on describe how have you not love me now i'm going uh on describe yes please go on describe i think i think uh autocorrect has kicked in autocorrect has definitely kicked in but i that was poetry that was poetry in motion or outside of motion which number is it what's the no we've done the ping-pong see in that pile i think it is not that one not that one one four two seven yeah two one four two one four two seven then it must be two one four two eight maybe no not two one four there jesus i don't know why do i draw so much art why couldn't i just draw less art it has to be oh these are numbered the same yes oh just off it hates me when i do that yeah you remember when the same you know we're going to say you know we're going to say number but the same you know we're going to say you know we're going to say oh i hate you guys the great bob as estaban is great i agree the great bob the burb the great bob the burb i'm doing this for you estaban now let's sell the draw everyone if someone wants to donate a super shot of one thousand dollars us dollars then we will personally send you the great bob the burb no it has to go through my webshop gosh dang the board the barb the barb was that wrong it looks like it says bob the board it does say bob the board no it doesn't you just the perfect yes it's been like that for all the it's been like that for all of the eternity all of the eternity it's been this way for all the eternity yes for two eternity and be in end yes okay so that means today we have drawn a pink tober picture with someone having a little uh grilling yeah campfire it's cozy yeah campfire why why is the why are the woods so small are they gigantic or are the woods in well we are definitely going to try again to take try again to enormous and then we draw we draw the great bob the burb enough bobism for today yes now i need to do the final little advertising spiel if you like the stream then please do subscribe if you like it even more then become a member of the youtube channel it costs around five dollars i think that will help me and my team make more art more content more lives more art for free use am i technically an anti-member since i cost you money instead of giving you money yes yeah i'm an anti-member please bring out my comment please i love your videos and everything my family to photo for the bread what anymore because for me food kicked off the bed my brother oh no what no uh we shall sacrifice it in the name of the great bob by all your signature looks weirdly like mine love you all bobs bobs your uncle okay uh let's end this live by saying if you want my art then you can go to den ungehardholm.com and use the promo code inktober 23 for two more days and um oh another super uh chat but unfortunately it is a super chat i have to say uh no i mean this could this should be a celda boss definitely but as much as i love the legend of celda wind waker and breath of the wild are among my favorite games ever yeah it should be a celda boss but i can't draw copyrighted characters because i release all my art for free use that means once this baby is scanned once i've scanned this drawing and put it up in my gallery you can download it and you can make it into a boss in your video game and you can even sell it commercial use of my art is legal thank you bleaker street comics so with celda characters i couldn't do that but if you want to make a celda clone game or even if you work for nintendo and are looking for a boss for the follow-up to tears of the kingdom then you are legally allowed to use my art as long as you credit me do not forget me about you uh i'm out anything can be a celda boss with mods yes but but but okay uh what more do we have to say if you don't have the money to support me through becoming a channel member or buying my art or going to patreon.com came home you can support me by using my art downloading it printing it changing it using it as your profile picture using it as your phone background making it into your video game all that helps me as long as you use me use my name by this was great thank you you are better than leonard do davinci at least i'm more alive okay speaking about mods you found some people that would moderate the stream not yet but it would be people that are seen on the stream a lot and that do and that want to moderate um so a few of you i know and oh spunky thank you for a big super chat don't end the stream okay we'll answer a few more questions is that okay answer a few more questions this guy is better than the another davinci thank you just tuned in that's a very good bird thank you do anyone have any final questions so we don't have to end the stream we can super ur chat to keep the kim forever and then you would have to super chat a lot because this isn't this isn't the hourly wage we're we're counting on but but it's really appreciated and it makes fun and you know as a thank you i have no problems with answering a few questions do you have any fall recipes you like to make or eat uh fall recipes i mean when it's rainy and cold i do like to make a lentil soup um doesn't sound uh that fancy but it's great more bobs in the future what kind of music do you like i like good music better than bad music i like some bad music i like a lot of metal music metal has always been my genre of choice but i also like all other kinds music i mean i listen to a ton of country music lately i've been listening to a lot of chilean folk music i listen to classical i listen to hip hop i listen to techno i listen to pop and yeah so uh but but metal has always been closest to my heart how long have you been painting i'm guessing you mean drawing like this all my life i have a question please question go up a few jokes and you know where that mask is go down to the color of a song i hope you like it i don't know what that means ever heard of poets of the fall finish rock band the name sounds familiar but i don't know if i've heard them have you ever used natural pigments like plant-based watercolors a little bit but not enough did you see house of the dragons not yet but i we should definitely later the stream just wanted to say thank you for all you do your inspiration thank you what's your favorite fun fact favorite fun fact what is my favorite fun fact i should have a favorite fun fact i'll see if i come up with it have you watched our flag means death yes we're watching the latest season right now it's very fun insomnium also a name i've heard um can't place it wrote a song for you and i hope you like it i love it love your life hard sometimes it's okay it's okay i got a bird mark on stage super bad i don't understand your comments favorite hip-hop artist um yeah favorite hip-hop artist i would guess roots manuva do you play any video games on ps5 or pc very little pc gaming these days because my laptop isn't up to snuff i'm playing uh alan wake 2 on the playstation 5 these days i'm playing minecraft uh with my kids uh i played a little bit of starfield love that i've been playing a charted uh collection in in spanish because i'm trying to learn spanish can i watch you a song please do you play any of the spider man games yeah you haven't played the spider man games because from what i hear uh the violence in them is uh a bit more than the comics and the movies and uh i couldn't play a spider man game in my house without my eight-year-old serious joining in alan wake 2 has a band called old gods of oscar they they are poets of the fall interesting i'm gonna like you song right now it's one my grandpa learned me today i will die tonight i will lying your lie in your arms today tonight i will love you guys yes yes no no way or one with the sky above we that was my best song today there's violence but there isn't any blood yeah i i'm very tempted uh to go for spider man too don't be a meanie to anyone it's okay favorite prog band oh favorite prog band i'm not deeply into prog um and a lot of the uh prog bands uh like roxy music i like better when they stopped being prog i like their pop um but rush is a band i really really love rush's 70s stuff um even though they sing about evil trees going on a strike um i like more in the metal genre i love enslaved which is basically black metal rush selene just take it easy and uh you know take it easy and take care um do watch much youtube yes i do if so who uh who do i watch on uh youtube um uh i watch a lot of dan mclellan's videos mclellan you can find about the bible and stuff like that i um watch digital foundry because i love uh game technology i watch a bit of proko tv for art stuff um in terms of i follow too many people i i watch a lot of exercise content i more than anything i sort of used youtube to find you know interesting things and interviews and lectures and stuff like that uh i watch let's talk religion i will uh watch uh whoa monsterum sorry for your loss uh selene but uh don't hug or hog the whole chat love your videos thank you could you draw subatom no i can't maybe i will someday see them live and draw them if my favorite prog metal band will be opeth for me opeth is good i will probably get the chance to draw them at the next draw them live at the next tons of rock festival watch the new spider verse yes liked it i think i like the first one better and uh oh gore brah uh would you ever draw video game things even if you don't don't don't scan them yeah i draw fan art with my kids and even for myself i i am a fan of things um i haven't seen the new avatar yet i did like the original avatar so i know that not everyone liked it but i thought for what it is it's great so i would love to see the new one just haven't gotten that far yet but yeah i do draw fan art on my own just not in a professional capacity because that would be very very illegal for me releasing my art for free use now i think i've gone on as long as i can these streams are cool thank you so much is that a new that is a member that i haven't have i seen you yeah probably yeah thank you so much thank you for becoming a member i look forward to seeing avatar 2 at some point and i will be back tomorrow for the final inktober is pinktober stream and then in octo in november i would probably be back streaming somewhat regularly maybe we'll get a regular stream schedule so that you all know when to tune in thank you so much it's been very fun happy birthday


Hello Hakers. This is a talk about a bug in microchip. And I'm Nini Chen, a security researcher at Devcore. We are from Taiwan. And I'm also a member of Belsen city of team and a member of ondefine. Okay. Why? Why the router OS? Because we want to participate in the Ponzu on Torrento in 2022. As one of the targets, the rotable of microchip hasn't been exploited in the previous event. More correctly, no one tried to demo exploit against this target in the context. You may already know the rules of the event. Participants must find a pre-O's RCE with no user interaction to acquire the points of the target. And the sole host mesh up, a special category was introduced in 2022. Participants have to change the router when site exploits and another device exploits to earn the points and bounty. The bounty and point in this category are relatively high. So it's a good target for us to earn more to win the contest. Let's recap some better things quickly. The router board of microchip is quite popular and the router OS is the operating system of router board hardware. By scanning the microchip, we can observe about 3 million devices online. Router OS is a standalone operating system based on the Linux kernel. And microchip also offers ISO images so we can run it as a VM. It's closed source and also closed ecosystem. According to the download terms on microchip's website, you pay 45 bucks to get a GPOS code. What a bargain. And currently, there are two versions of router OS, the V7 and the V6. They should be considered two branches because their implementation are slightly different. And the cloud hosted router is the router OS image for VM. But only the AMD64 version is available. Most of the services on router OS are implemented by microchip themselves. And they share a similar architecture. So we named them NOVA binary afterward. And they use NOVA message to talk to each other. Though the router OS is based on Linux kernel, users are trapped inside a customized COI. And there's no official method to access the underlying Linux system. Only developers can install a backdoor package to access the Linux system for debugging purpose. And the router can manage their routers via the web panel or Winbox, which is a Windows GUI application. It's also a popular attack service because the Winbox interface on the router can be used to talk to other NOVA binary. Some of them can be accessed without authentication. To understand how people research the router OS, let's have a look at past CVEs of the router OS. There are a total of 80 CVEs. And 28 of them are pre-auth exploitable. And the victim is the router itself. 16 out of the 28 are those in various components. 8 out of 28 are DNS poisoning, allowing attacker to MITM, or firewall evasion. Only 4 pre-auths vulnerability in history can lead to a shell, or locking us at a mean directly without user interaction. These are what we care about. 3 out of 4 were found between 2017 and 2019. And 3 out of 4 are in the wild. Let's have a close look. CV 2017 20149, aka Gmail rate, is wonderfully exploited from the CIA in the 2017. By sending an HDTV request with crafty content lens, we can corrupt stack to execute arbitrary code by stack clash. CV 2018, 7445, is a buffer overflow in SMB, found by black box fuzzing. CV 2018 14847 is also one of the exploits leaked from the CIA in 2017. This bug allows unauthenticated attackers to read arbitrary file on router OS. It sounds not a big deal in the first place, but since the password stored on router OS was from simply repeating XOR password in plain text with the hash of the username and the fixed string at late time. So the password can be recovered easily, and the bug with arbitrary file reading is sufficient to lock in us at a mean. CV 2021 41987 is a hip hop overflow in the code of the ACP service. This was discovered on an APT C2 server in 2021. As we can see, these vulnerabilities are mostly in the wild. We can learn too much from them directly. So let's take a look at some talks and articles about the router OS. In 2017, there are three talks, and they are about a package format adopted by the router OS, the developer's back door, how the router OS store the password, et cetera. Talks are interesting and helpful to have a big picture of the router OS. In 2018, the talk bug hunting in router OS analyzed the normal message in binary and JSON format. Introduced the how Winbox client talked to the Winbox interface by normal message and found the post-OS stack overflow. In 2019, the first one is the same as the previous one. So the next one is my critique firewall and Netbypass. It's a talk about the vulnerability in the Winbox that can be used to scan the intranet if the Winbox is exposed to the intranet. The next, finding an exploiting CVE found a stack buffer overflow in SMB by black box passing and explained how they got the shell with their exploit on the router OS VM. And the deep dive microchip exploit is a security analyze about the CIA exploits and the massive exploit event based on the liquid payload. The next one, help me vulnerability, you are my only hope, release a tool to help users to jailbreak their device to check if liquid exploit was already compromising them. And the last one, router OS trying to root is about chaining DNS poisoning vulnerability and a downgrade attack to get a shell. Finally, in 2022, polling microchip into the limelight talk more about NOVA message and disclose post-OS vulnerability in triple W, they can be used to jailbreak. They also release a tool to help researchers quickly get a shell on the MD64 version of router OS with the vulnerability. It seems like the whole world is talking about the NOVA message in the IPC of the router OS. So we also try to understand what it is. Let's talk about IPC of router OS with an example. While I use the login through the telnet to access the console of router OS, the telnet will immediately call the EX ECL to execute the login process to ask the user for a username and password. Then the login process will send a NOVA message with your username and password. So the user process to check if they are correct. The user process also responds in NOVA message. The NOVA message consists of key value pairs and the key can only be numbers. The key, the sys2 and sysform are arrays containing the ID of NOVA binary and the ID of the handler. The communication between two process is something like this. Every message is sent to the loader via socket and the loader dispatch the message to the corresponding binary. The login process send a request with a username and password to the user process. The value of sys2 means the target is the handler 4 and the binary ID is 13. And the process itself doesn't have to fill the sysform with its process ID because the loader we do that based on which socket is received the message from. Next, the loader remove the target binary ID in sys2 as the source ID to sysform and then forward the message to the target process. When the user process receive the message from the socket, it also remove the handler from the sys2 and pass it to the corresponding handler. Then the handler does the rest of the thing. We mentioned that Winbox interface on the router OS is a popular attack service since it can be used to access all the process. That's because the protocol Winbox client use to talk to the interface on the router is basically a normal message in the TCP packet. So if the target handler fail to check the sender's privilege, that can cause problems. No, normal message is type value mapping and can contain various types and also normal message itself. Because the JSON format of the normal message is deprecated, we only talk about the binary form today. Okay, the M2 at the beginning is the magic bytes for the normal message. Then the useful bytes to describe a key. The first three bytes of key are ID and the last byte is type. And bytes following are the value for that key. So this message is ID types and values look like this. Types like bool can be expressed with one bit directly using the lower bit of the type bytes. To understand which binary corresponding to the ID in the sys from and sys2, we need to pass X3 file under the loader directory. It's kind of XML but in binary form. If the binary was introduced by installing the package, its ID is under the loader directory of that package. Some IDs can be found in the X3 file because the process is not persistent. The ID is just a serial number like the locking process we just mentioned. Our binaries also have X3 files for different purpose. For example, the X3 of triple W describe which URI should be handled by which servlet. It seems like it's a good target for fuzzing, right? But we can't just fuzz it and expect we get something after two months. Now, it's a spoiler. While we were writing our exploit with the vulnerability that I will introduce later, talk at POC 2022 micro tick router OS security, the forgotten IPC message. Though I think it's far from forgotten but anyway, the talk is about fuzzing and the NOVA message. And it found lots of post-os CVEs. By the number of CVEs, it looks like the father has been running for a long time. A bit of an effort thought. I don't think we can get a better result if we do the same thing at the time. Not to mention that we only have two months. So, is this still possible to point the router OS? Review these CVEs again. Most of the vulnerability we think interesting will discover many years ago. Researchers also found lots of vulnerability. But as we can see, the micro tick becomes safer and safer. But in 2021, a vulnerability in the SCEP server we just mentioned was discovered by analyzing and in a wild exploit on the APT C2 server. Was it discovered until land because it was not a default feature? Or is it just because people have overlooked something? Most talks and articles focus on jailbreaking, analyzing the in the wild exploits and NOVA message in IPC. I have a summary after reading them and starting to reverse by ourselves. That is, no one with sanity will like to dive into the details of NOVA banners. I mean, expect for the exploits from the CIA and APT. Most of the research about bug hunting is fuzzing the protocol playing with NOVA message or fuzzing NOVA message. By the outcome, it seems like attackers are familiar with the router OS laners. We need more details about the NOVA message. And don't get me wrong, I'm not against fuzzing, but we have to ensure we check everything to take advantage of the context. I don't think the system is perfect now. There is a gap between researchers and attackers. So what was missed if we want to find some pre-oath RCE bugs in router OS? The first question is where are the entry points to the customized IPC? Most of them can only access by authentic user. We can foresee the playing with NOVA message in IPC will result in lots of post-oath bugs. IPC is just a part of implementation of the most functionality. We want to review the crucial part directly and carefully. For example, how does the DHCP process pass a DHCP packet to extract the info in it? Then we have to mention the architecture of the NOVA message, NOVA binary. Every NOVA binary has a looper. The looper use port to check the status of socket and process event in each loop, just like the regular event loop you've seen everywhere. Looper is responsible for the communication between the current process and the loader. The looper register a special callback for a unique socket, which is used to communicate with loader. The special callback on MSG sock will dispatch the message to the corresponding handler once it received NOVA message from the socket. So how does the handler work? While the looper receive a NOVA message, you dispatch it to the corresponding handler. Look at the right hand side. And let's assume that handler one is responsible for the NOVA message. And then your code function in V-table with the CMD prefix, like corresponding to the command specified by the CMD. There are many functions here, but because the handler is the best class, commands relative to objects are unimplemented. The CMD unknown is often overridden and used to extend the customized command. Sometimes the developers override the handle CMD instead of the CMD unknown. You may have already read some of this in the past research. But most of the time the NOVA binary use the derived classes rather than the best handler class. The derived classes can store a collection of objects of a specific type. For example, while the user is setting up a DHCP server, they will send a message to the handler zero of DHCP process to create a DHCP server. The handler zero, which is an instance of AMAP, calls the function on its V-table with offset hex 7C to create a DHCP server object and insert it into a tree. The 7C is the offset to the constructor of the inner object. And you can find the offset of such function in other derived classes by reversing the CMD 8 object. In the previous example, the web panel sends a NOVA message to DHCP to create a DHCP server. But why if I told you that some functionality don't even use the NOVA message? Take the CDP and the LLDP for example. They are implemented in Discover. The looper registers two codec functions. The looper keeps looping and check the status of sockets. If there are incoming packets, the looper call the codec function. The codec of CDP will check if the interface they receive the packet is not filtered by firewall rule. Then extract the information from the packet and store them directly into another ASIC map without sending NOVA message. So there's no NOVA message here. So we started to review the router OS by enumerating functions and reversing them. Then we found something strange. One day, while plugging and unplugging some cable, connect to the router, suddenly the log file showed that RADVD crashed several times. So we tried to reproduce the crash by manually plugging and unplugging cables about a thousand times. But couldn't figure out the crash condition. The condition is unknown and the crash appears randomly. Instead of mindlessly unplugging and plugging the cables, we reversed the RADVD to see if we can find something interesting. We didn't find the root cause of the crash, but we got something better. So why is RADVD? RADVD is a service about SLAAC of IPv6. Let's say a computer or a node want to get an IPv6 address. It will first mud case the router solicitation to all router prefixes. Then if a router receives the OS, it will mud case the router advertisement with network prefix to all nodes. After that, a node can calculate its IPv6 address by combining the network prefix and EUI64, which is calculated from the MAC address. Another scenario is that if an upstream router, router A, maybe it's an ISP, they give you a prefix with slash 40A, which assign in advance by email or something. Then you can use them with whatever you want in your LAN. Then here comes the link prefix and router prefix. First, the router B act as a node on the interface with the router A. The router B ask router A for a prefix. The router A send a slash 64 prefix for router B to calculate its IPv6 address. Router B calculate an IPv6 address. Let's say it's 201, colon DBA, colon colon 1. And use it on the interface that links with router A. So now the router A can route all traffic to the address on the slash 40A to router B. Now when nodes want to get IPv6 and send RS to the router B, the router B just mudicates the slash 40A prefix to nodes. Then the nodes act as usual. So the functionality of RADVD in router OS should have two functionality. First, it can act as a node to receive RA. And it can also mudicates RA to the LAN. Let's follow the execution flow of RADVD to find the bug. The RADVD have a similar design pattern to the discover process we mentioned earlier. We register a callback, the looper pull a socket in every loop. And if there is an incoming ICMPv6 socket packet, the looper call a register callback. What callback do is roughly like this. It check if the packet is a valley RA or a valley RS. If it is a RA, then extract information and store them in the handle one, which is a map. And if it is an RA, it will mudicates the RA immediately. Sorry, if it is RS, it will mudicates RA immediately. There are three cases the router OS will mudicates the prefix to nodes. The first one is when you receive the RS from nodes. The second is when you receive an RA from upstream router. The last one is when it, sorry, the last one is when you receive the RS from the router, it will mudicates prefix in the default period, which is in 200 to 600 seconds. And yes, the router will mudicates the RA to nodes once it receives the RA. But it's hard to trace this behavior directly because this is about a subscription I will talk about later. We didn't know that then. But the other two cases, the RADVD code send RA right after it receives an RS. The handle one registered a timer to send RA periodically. So we can find the send RA function by tracing these two methods. Following the send RA function, we found something interesting while the RADVD deal with DNS advisory. It will advise DNS to nodes based on the DNS list it received from upstream. The ADD DNS function is used to flatten the DNS tree and add it to the ICMPV6. The RA row is the ICMPV6 payload, which is the local variable with the size of 496 bytes. Step into the add DNS and we can immediately find out there is probably a stack bubble overflow. The function add DNS to packets by memory copy without any bundling check that causes stack bubble overflow if the DNS is big enough. The DNS addresses are from the RDNSS of the RA. But the max length of the RDNSS of an RA is 8 by 8 bit, which is insufficient to override the return address. But if this is not the first time the router always receive an RA, the RADVD have to inspire all RDNSS. They make the RADVD flatten another tree to override more bytes for us. So, what we have to do is we have to act as a Bay neighbor, let's send a router to the RADVD and then send another RADVD with the big RDNSS list. Now the return address is overwritten with an IPv6 address in the RDNSS of the first RA. It is time to construct the exploits and it looks easy because there is detection enabled. So, let's find a way to jump on the stack and run our shell call. That should be easy. Thank you. The overflow IPv6 addresses are sorted since they were stored in the tree. To make the order of the IP addresses stable to ensure the shell call is good, we can use part of the IPv6 prefix as a serial number and put a jump at the end of each address to jump over the prefix because there are not very instructions. But because of the delay slot of MIPS, which means the instruction after the branch instruction will always be executed before the branch instruction itself. We have to move the jump instruction forward. But the other problem is that you cannot do a syscall in the delay slot. So, basically, this is a bad idea. It's actually a CDF 101 problem. Just make a prefix a valid instruction. They won't affect our gadget or shell call and everything is fine. And because we didn't leak any stack address, plus we didn't find any gadget that can be used to move stack pointer to register T9 for jump instruction in the first place. So, what we did here is first write our gadget on memory, then jump to that gadget. Finally, our shell call will be executed. Sounds good. But there is iCache. The MIPS CPU has two cache, the instruction cache and the data cache. While writing our gadget on memory, we are actually writing on dCache. Now, when we try to control the execution flow of execute, sorry, to execute the gadget for running our shell call, the processor first check if the instruction are already in the iCache. Because we wrote our gadget on the data section, the cache always miss it. So, the memory content will be loaded into iCache. They cause the processor to execute a bunch of nope until the program crash. To flush the dCache, we need to make the processor content switch or exhaust the dCache whose size is 32 kilobytes. There is no slip in RADVD. Other functions we also trap into the kernel, but they don't guarantee the content switch will always happen. To make our exploit consistently successful in maximizing the chance to win the game, we have to flush the 32 kilobyte dCache. Luckily, the value in randomized VA space of router OS is 1, which means the heap is not randomized. The only things we need to do is do some memory allocation to extend the heap and write some gadget on it. We may run out of bytes for shell call because of that. But the DNS addresses were stored in a tree that caused lots of memory space. The heap is already larger than 32 kilobytes during the processing of a request. So, we can call the memory copy by GOT hijacked to write 32 kilobytes garbage on the heap to flush the dCache for our shell call directly. And profit. The vulnerability was assigned CVE 2020, 2023, 32154 and it's already been fixed. After that, we found the vulnerable call had existed at least since the router OS v6. This means the vulnerability has existed since 2013, nine years until we found it and ten years until they're fixed. So, no one with sanity would like to dive into the details of a normal binary, QED, you're welcome. Combine the exploit with our exploit for the Canon printer for the point to own. The attacking scenario is that an attacker is a bad neighbor of the microtik router, sending crafty ICMP v6 to attacking the router. And if we compromise the router successfully, we can forward our payload to attack the printer behind the router. The whole setup can be simplified as such in the contest. Just let our laptop act as the upstream router of the target router. We can almost see our 100k bolting. But, another but, our exploit only working on Mac OS and fail on Ubuntu, whether it's a VM or not. We try to debug the exploit by running the exploit on VM and recording the traffic, download traffic and replay it, it just fail as we expected. We also done the traffic from Ubuntu and replay it on Mac. However, it somehow succeed. So, we guess there is an OS that will reorder the packet. We put a signature on router to monitor the traffic from Mac and Ubuntu. And because the AF packet is not affected by any firewall chance, the result should be reliable. But they look the same. The last result could be that I have to go to torrento in person, but we can't live it like that because who knows if the bug will suddenly happen again during the contest, even on the Mac OS. Eventually, we find the problem. It's all about speed. The gaps look tiny and you may never notice in Washak. But the difference between them is actually 390 times. The problem is not on Ubuntu, it's just because the Mac sends to packet too quickly, causing rest condition. Plus, we were lazy and did not actually calculate how many bytes we need to override the return address.  So, the solution is put a slip before sending the second RA and fixing the offset of our payload. Then, it's very stable. The probability of success is almost 100%. But how? The RADVD is only one thread. How could there be a rest condition? I didn't mention that while the RADVD parsing the incoming packet, the DNS address are stored in a vector. But somehow, the handler passed a DNS tree to the addDNS function. What's the relationship between these two members? It's actually about why we can't find where the Colbert function, multi-casular RA, when you receive an RA packet. Let's look closely at the Colbert function. There is an array responsible for storing something called a remote object. Then, it looks straightforward. Just eat the new DNS vector, then do RODNS on each of them and append the result to the DNS remote object vector. So, what is the remote object? The remote object is a mechanism to store common resources in the process, and other processes can access them via ID. For example, a DNS remote object is actually stored in the handle 2 of the resolver, and the RADVD only preserves the ID of the object in handle 1. Now, let's talk about the subscription in Nova binary. The binary IP pool 6 is responsible for managing the IPv6 address pool. The DHCP subscribes to it, so the DHCP can react to the change. It's done by sending a subscribed Nova message, and the sys-notified CMD can specify which command you want to subscribe to. The FE-000B means notification. So, if there is another binary, try to add an object to the handle 1 of IP pool 6. By sending a Nova message, the add object of handle 1 will be executed. In most cases, the add object will send notifies to notifies subscribers who subscribe to FE-000B to inform them that the IP pool 6 has changed. So, when the RADVD receives an RA from the upstream router, it calls RODNS to create DNS remote object for each IPv6 address in the RADNS of RA. The command add object of handle 4 in the resolver is responsible for such request, and will add the IPv6 object into the handle 2. Also, because the handle 1 of RADVD subscribes to the resolver's handle 2, the handle 2 will notify it with every DNS address it has now. So, handle 1 constructs the RA for LAN with least DNS addresses. The problem is in the implementation of RODNS. Let's send Nova message by post message which is non-blocking. It means the remote object will get the object ID immediately. So, if we send request too fast, the second RA arrives before the RADVD gets the object ID of the old remote object. The RADVD can only stop the delete those old objects rather than really delete them. They cause the RADS condition. This is what happens if we follow them step by step. Because both processes are single thread, let's assume they are in the first loop of the looper while the RODN RADVD receives the first RA from when. With one DNS address, the RADVD creates a remote object in the resolver by sending the normal message. And the resolver will set up a timer after receiving the first request because it cannot tell how many operations should be grouped. It should just set a timer and send only one notification when the time is up. Apart from notification, the resolver should send the response back to tell RADVD the object ID of the remote object it just asks for. But if we send the second RA quickly before the resolver sends the object ID back, the RADVD can only mark the old DNS remote object as destroyed. Then keep going to create the DNS remote object for the RADNSS in the second RA. They will send a request to the resolver, but as I say, we send the second RA too quickly. The resolver is still in the first loop which tries to send the object ID it created in the first loop, so our request will stay in the socket. Now, the resolver sends the object ID back. The response handler is a callback registered by the first request will handle the response. The handler finds out the object has already been marked as solved delete. So it won't update the object ID. Instead, it will post another request to the resolver to delete that object. The request will be processed in the third loop of the resolver after the request of creating the DNS remote object for the second RA. In the second loop of the resolver, it processes the creation request with the DNS address from the second RA and the response with object ID. Now, time's up. The timer of the resolver thinks a group of 18 operations should have been done, and it's time to notify everyone what DNS addresses it has. And because the handler 1 of RADVD subscribes to the handler 2 of the resolvers, it receives the DNS addresses in the normal message, then store them as a tree and use them to construct the RA for LAN in the RA routine. At that moment, the result of two requests is missing. That's why our first version of the exploit can only work on Mac OS because we trigger the REST condition. It seems hard to achieve a REST condition because there is a timer, but the mechanism is actually more complex than I just explained. So the REST would always happen as long as the two RAs arrive at the router in the short period. So the pattern of the REST condition in the remote object is as follows. Use non-blocking method to create, delete, remote object. And the target process subscribes to the remote object. Then we can mix the result of two requests into one. They may make us bypass some checks in the binary. We try to find other vulnerability with this pattern so that we can, so that we could register the LAN category of the router in PON2ON. But we ran out of time and did not manage it to find other vulnerability to exploit the LAN side of the router OS. But at least we are the first team to exploit the so-host mesh up category successfully and also won the title of Mesh of PON. Okay. In summary, MicroTik re-implemented everything with its own design IPC. The business logic is scattered all over. We have to have an abstract concept of normal binary to find the most critical code to reversing. And there is a pre-auth RCE on when that has been leaked for nine years. Also, we introduce a pattern of risk condition in remote object due to non-blocking method to you. And the last thing, we will drop tools that we use in the PON2ON event to ease the reversing of router OS at GitHub. And that's it. Any questions?