We were studying this session, how to download the Android application, what are the different channels and what are the different versions of the application, training, production and SMS. So we have explained how to download it. So at this moment, you should, if you have installed the application, you should see the screen. And Marta was explaining at the beginning that you could build a QR code because some people find it difficult sometimes and it's the code mistake to mistype this. So we did that for you. So if you have installed the application and you click on the QR code icon there, you should point at the screen and this should take you to the server. And here we are asking you to put the user and password from the previous session. Again, we are talking about the Android user and not the admin user. You will give it to users, one is the admin that we're going to be using to manage the server and one is the Android that we're going to be using when using the Android device. So when you connect, I think Abdel already have shared in the Slack, he was seeing only two programs. So this means that probably he had made a mistake while configuring the program. But this is what you should expect seen. So there is the first one, which is a shared program with all of you that we will be using for support, sorry, for additional exercises. Then we have the second one, which is a data set and aggregate. And then we have the third one. And this is the one that you have set up. And in the previous session, I was telling you, well, if you play with a display and you play with the different attributes, et cetera, depending on what you do, you will be seeing one thing or another one. So this one is my search screen based on the attributes. I have defined as searchable in my server. So this will be once you connect to the application, so you open the application for the first time by default is going to perform a metadata synchronization. This means that loaded all the information it might use when going offline. I'm putting this here because changes in the server are not automatically reflected in your advice. So if you are playing now with the server and you tell me, yeah, but I have changed something in the server, but I don't see my phone. Yes, it's because you need to perform a synchronization. The phone, at this moment, I think it's configured to check every week. So everyone will ask for new metadata synchronization to pull the metadata changes. But if you want to force this, you can go to home.  And then the new changes will be downloaded. So in case you want to change some searchable fields to see how the program search form changes, please do this. That's it. I think, yeah, so exploring the Android app. Marta did a very quick demo at the beginning of the day. So what we're asking you is now to kind of, well, not reproduce a demo, but explore a bit the application. And this is what we're asking you to do as an exercise that you need to submit. So of course, you will need to download the application. This doesn't count for the exercise, but you need to do it because you know you will not be able to do the exercise. You need to submit three screenshots. One is with the search screen. Make sure the mandatory fields match the ones you selected in the previous session. So by default, it's going to match because you have defined some searchable fields. The mandatory, you will see what happens. We're asking you to register and, yeah, you have to register a new TI. So you can register yourself or you can register a fictional TI. And we want to see that you know how to explore and you can go to different stages. And you can, for example, go to the lab request and take a screenshot. Like this, you prove that you know how to navigate. As one thing that you can ask, but we will not create. But I think it's good that you guys know because of the support I was spending a screenshot of the story used by the application. So when you have done perform different things, if you go to the store that I quickly demoed, you could see that it increases when you start registering stuff, but it also proves that you know how to go. Again, this is extra points you can submit or not. But I think it's a good idea if you go to the exercise. Of doing so, that's it. Then you have now five minutes. I know it's not much, but we we still have the next hour doing support. So don't worry. You can stay that hour, but that's optional, but feel free to submit. That's what I'm asking for. And if you want the last the next hour, we're going to be here hoping. This is it. I'm going to leave you five minutes. You can mute me if you want, because I'm going to go through the first five or six slides explaining what this what I miss in the beginning because of the recording. So I don't like this. So second attempt, I'm sorry for those that joined the video. I'm joining offline because I forgot to click on the record button. I think you missed the first four or five slides. So I'm going to quickly go to them. Basically, I was saying that in this session, what we are asking you to do is download the Android application and we will try to explain the difference. And let's do a lot of them. There are several options to load. The first one is the Google Play. Then we have GitHub and then we have the own store. The last one, we're not covering it here. But just for you to know that on the last day, we will be talking a little bit quickly about this.  So you control completely the release time. In the Google Play is the one you maybe know. If you go to Play Store in Google, you can look for the HS2 and you will find this application at the moment we're in the version 2.5. And also to know that we have the GitHub where we produce different, where we upload different versions of the application. And it's important to know that we are going to be talking mainly about two different versions. The first one is production and the next one is training. Production is the one that goes both to GitHub and to Play Store. And the difference between that one and the training is that it's ready for production in terms that some security flags have been enabled. And this is something that you find annoying. But we think, well, we know and we're following a specific security framework called OWASP that says you should enable this security flag for users not being able to do this and this and this. One of those things is, for example, not being able to take screenshots when you're using the application. Another one is not being able to install in root devices. So this is with the production. The first one that you see here in the third one, which is the training, which I put here in both, that is the one we're asking you to download. These security flags have been removed. And this is because in the exercises, we'll be asking you how to... Well, in the exercise, we asked you to submit screenshots, proving that you have acquired an OS and you have gone through the exercise that we are explaining and asking you to perform. So you would not be able to do screenshots if you're installing the one from the Play Store. So please make sure you install the training application. And in order to install the training application, you can go to GitHub. But if you point your phone at the screenshot and the screen, the QR code should bring you already to this website, which is our release website from GitHub. And here now you have the assets. By clicking on the training app, this should pop up something like this in your phone, which is not allowed to install unknown applications. By clicking the settings, you can go to Allow Temporarily, I think it is. I think it depends on the version of the phone. And you should be able to install the application. Once you install the application, you should be able to find it through your list of applications, your application drawer. And one other thing I was saying before that is what I'm mentioning is that if you go to the application and let me quickly demo that, I'm going to share the screen. This is the application. And once I have installed the application, the training one has a different icon in black and orange. So I can go to Settings, App, Details to Training App Stories, and in newer versions of Android, I think from four, which is nothing new anymore, but if you click here for a while and go to App Info, I'm going to be reaching this. This is a useful screen that allows me to see which version is installed, but also allows me to clear the cache and clear the data. Yes, for you to know that sometimes, for example, if you have not properly set up your server, and you have given to a specific user too much metadata to download, your initial synchronization might take too much or too long. So by coming here, you could force the stop of the application, and this will allow you to maybe make some changes on the server and trigger the new metadata sync. I think it's worth knowing this, because some people have issues while troubleshooting, so I could now force stop, and this is going to stop the application. Please understand that if you clear the data and marking it here in red in the application, you will be deleting your local data, so whatever it has not been seen to the server will be lost forever. And I think this is where I started recording, so now you can go jump back to the other session. I'm very sorry for this. I hope it doesn't happen again. We thought that this year was better to break the sessions in different recordings, because last year we were posting it, but then you end up having a very long video. And I think that for those who are following offline, maybe some of you are following two sessions online and two offline, we think it's better to have different recordings. So hopefully it will not happen again. Sorry. So I'm going to start asking questions, answering questions. So I'm going back to the first question from Jean-Paul. I use Google Play to download the details to capture. Where can I find the URL in order to sign in? So in the slides, you can see the URL, which is academy.android.dths2.org, which is the same. If you're asking, actually, yeah, that's the same one that you were using to connect with the admin user. But again, if you have downloaded the version from the Play Store, you will not be able to take screenshots. So you will find new ways. Maybe you want to submit it with another phone, but we are encouraging you to install the training application because the goal of this application is to bypass the security flags and for you to work in a more comfortable way. So thanks, James. I see that you had answered him. Thank you very much. So possible to download from my tablet daily. Yes, Jean-Paul, you can go to the URL that I was showing on the slides.  And from there, you should see the three assets. And you can click on download and install the applications. I'm taking... Okay, we have a question here. I'm thinking, sorry, because this, I think we are already over time in terms of the official schedule. So now we should be starting with the Q&A session. Marta, we're not going to be recording the session, are we? We don't need to record the session. Okay, then what we're going to do, I'm going to stop the recording and we will be answering questions. We're going to be here for 50 more minutes, but I will stop the recording. So we see here, but like this, we stop. Maybe some of you don't want to talk while being registering.


How's it going everybody? My name is John Hammond. Welcome back to the Ripeco CTF video. This challenge is called Client Side Again for 200 points in the web exploitation category. So this must be more on the line of JavaScript and client side code. It says, can you break into the super secure portal? We're giving a link here which we can go check out. I will open that up in a new tab. It says, new and improved login. Enter valid credentials to proceed. Again, please subscribe, which is not the password. Weird. So if we're going to view the source for this, we can see that there is a little bit of JavaScript code, but it seems to be obfuscated. There's a lot of random numbers and hexadecimal values used for the different variables, et cetera, et cetera, et cetera, et cetera. Interesting things to note though is that it does include some segments of the flag, just noted as strings at the very, very top. You can track down a JavaScript deobfuscator if you wanted to. I have not had a whole lot of success with JavaScript deobfuscators. If someone tracks one down that does a good job of taking this apart, I would be very, very grateful. This one I haven't seen work just nice. Does that one do it? Okay. Yeah. We can pump that in here and it will try and niceify that JavaScript. It does it a little bit, but it's not like it's going to just give us things as easily as it could right off the bat. We do get to see at least a better output for what these values are listed at the very top of this array here. And an interesting thing though when we mentioned, hey, we see our Pico CTF flag form out there. We can also kind of figure out and decipher just by some deductive reasoning that, okay, it must be Pico CTF, not this again. And that ends with a one there. And I can assume that there's other numbers kind of leading to a closing parentheses or closing curly brace. That must be the very end of the flag. So let me put that together. That should really be what we need for our flag. Let's move into Pico. Let's make directory client side again. And let's create just a simple flag dot text so we can paste the stuff in here and slowly have it grow Pico CTF, the curly brace, not this again. And these underscores helping kind of give it away. That's what's actually building out the flag is really part of it. You can see other strings that are probably useful for the application, like incorrect password or password verified. But really, I know a cheap hack, but a flag is a flag. And we can go in and submit this for 200 points. That's correct. And that's all that I ended up doing for that challenge. The next one is called flags. It says what do the flags mean? And we're given a PNG file to download. Let me mark this as executable. And let's make directory flags, CD flags. W get this guy. And we'll check it out what we're working with here. There's a lot of white space for some reason. Only there's really information at the very, very top left of this. And if you haven't seen this before, maybe you could do some Google like reverse image searching if that's your bag, or maybe you might recognize this right off the bat. These are the nautical flags that are kind of used to note some signals or messages on ships at sea. So we can just translate what each of these nautical flags are and determine what letter in the alphabet they might represent. A good thing to note, however, is that, remember, Pico CTF has been doing a lot of flags with, like, lead speak and numbers that are going to represent or replicate another letter. So we should probably look for maybe some mapping for these nautical flags, including their number representatives. So let's do that. We can Google that real quick. I'll go to nautical flags and numbers. You can see it's in my Google search already. So this looks like maybe a little product we can buy. I don't know. A maritime signals photographic prints, but it is going to act as a key for us. So this is nice and handy. I'll zoom in on that. I'll try and bring this up to the top of the screen, or at least I'll make this visible so that I can see it. Maybe you guys can't just yet. But let's start writing out this flag. So we know we're going to be working with Pico CTF and the hints there told us that, okay, this is actually going to be all capital letters. So let's try that. We need Pico CTF and that is F. And then that looks like the number one alpha golf. Following that, we have five. You can tell because of that number matching just with the color. I'm kind of looking off to my other screen here. And then the Delta, another five. T for tango, U for uniform. And what is that last one F? So flags and stuff. Good enough. Let's go ahead and submit that. That was our reference and that was correct. So if you see those, if you happen to catch those again in another competition, maybe a later game, CTF you're playing, no, be able to identify those squares with a good amount of color and different representations that that's the nautical flags. That is that. Thank you guys for watching. Hope you enjoy this one. Another quick, super simple, quick and easy Pico CTF challenge in video. So thank you guys for watching. Please do like, comment, subscribe. I'll see you in the next one.


Hello, Defkhan.  My name is Dimitriy Snashkov and I'm part of Partivity Attack and Penetration Testing Team, where I have a chance to do tooling, offensive research, and automation. Shout out to my team at Partivity for making that happen. Today, we're going to talk about SGR's technology as it applies to offensive operations. Being part of the offensive team and task with testing, I sometimes find myself and we as a team find ourselves on unknown boxes. Sometimes we need to leverage the technology that exists there to be able to withstand the onslaught of EDR inspections or defensive technology inspections. SGR's technology here was a curious case when a developer was using SGR's technology to protect trusted credentials, and so the box was instrumented with SGR's enclaves, which we thought, why not use them? And how can we use them to further our goals of bringing payloads and taking care of secure communication for us? But first thing first, SGR's technology developed by Intel Corporation to essentially protect specific code or data from disclosure or modification to adversarial parties. Adversarial parties defined by Intel or SGR's technology is anybody who is running in non-ring three. For example, privileged system code, operating system, virtual hypervisor, managers, BIOS, all the things that work around the hardware. And so SGR's enclaves were born a technology that solved the issue of protecting areas or tries to solve the issue of protected areas of execution and increased security on platforms that are considered to be compromised from all the contacts that runs around them. So SGR's, as we've defined, SGR's enclave was a trusted code. And it's also linked into application. So the application kind of runs in two modes, split personality modes, right? One is the untrusted part of the code, another is trusted part of the code. The trusted or safe part of the code runs in the SGR's enclave, which we construct. And we interact with underlying bootstrapping and orchestration platform to be able to execute or reach into the trusted area and execute very specific operations from the untrusted memory, which is our application. That's possible by SGR's of introducing two new op codes of switching in and out of the trusted area over CPU, which is locked to the enclave, where enclave is encrypted by CPU key. And so this technology is very kind of prevalent in the high security environments. Obviously, part of the wherever Intel Core processor, six plus generation lives on laptops, business, servers and data centers, but also in cloud virtual machines. Namely, we found it on Azure DC level trusted computing machines, right? And so if we find ourselves as operators on those machines, we might be able to use some of that protection for our purposes. So the offensive goals for us here is kind of twofold. The first is understand the technology, how to construct the application so we can actually invoke, you know, SGX and use enclaves to store our data, which is payloads or other things. Also use SGX technology and SDK to try and secure communications with our C2 without revealing keys that we use for our payload encryption. And in the process, try to kind of, you know, have the EDR divert attention from us by splitting the kind of the deployment model between several components that are not fully assembled or introspective. And so in this case, we're gonna do Windows as an example. We're gonna create a system called Xclave or kind of, you know, design a method of communication between our cradle to load securely our payloads, store them in the enclave on the box, but also hide the algorithm of encryption and the keys that kind of travel back and forth in clear text. And so the Windows is the example in this case, but the Linux side will be pretty much the same in concepts, although implementation may be a little bit different. And hopefully we're gonna have fun going through those exercises. One thing to mention is that this talk is not about SGX vulnerabilities or SGX deep dives. We're gonna touch on some of the relevant parts, but refer to other great talks on that matter. The SGX components that will be interesting for us will be the platform software that gets installed to kind of interact with enclave. If we're dropping into a box that has appropriate type of CPU and we're on Windows, Microsoft Windows machine, then operating system would have already have the driver for it because that's a standard update process for it. But you could obviously have other type of platform software if you're operating directly in the environment that SGX enclaves are used by developers to kind of help their applications be more secure. So there's drivers there and the orchestration software, such as attestation service, which talks about and takes care of the kind of signing and verifying the enclaves themselves to the owner and to the system, i.e. the CPU. And also the second part is the SDK, which we will use as part of the software development to create this application, which will utilize enclaves. There are two SDKs we're gonna take a look at Intel for the most part, but open enclave is also available for our purposes. And so the outcome of our efforts would be an application or a set of applications that will be created with trusted and untrusted parts, trusted being an SGX enclave and untrusted being all the bootstrapping code that allows us to share information with our C2 and process payloads from that. And then we're gonna go into how high-level mapping of the calls into C2, into trusted area happens and how we can leverage some of the primitives in the SGX SDK for our purposes, such as configuration signing and loading. Specifically, the problem of payload transfer can be distilled to a few things. So first of all, we do not want to load payloads in clear, we also always want to protect. And commonly we protect that with some X or key, maybe AES key, but the problem is that the key itself may be available in the memory because it's shared key a lot of times. And so it's inspectable, if not real-time in the sandbox, then in the forensic lab, right? And so if we're running long-term campaign, we want to make sure we protect our keys in memory. And also the other thing is the algorithm itself can be reversed and we can be pretty much our algorithm can be known, but not because we don't wanna share the algorithm, but because that algorithm may point to weaknesses in our communication, which may be introspective and intercepted. And so what we're gonna do, the other goal is not only to store payloads, but also use SGX to secure, communicate out to C2. To do that, there are a few alternatives. There are some crypto libraries that come with PSW, the platform code and SDK. It's SGX TSTC Crypto Library. It is fairly limited in what it does because its purpose is to facilitate jobs of attestation and communication for session management. It's not for general purpose crypto, but we can use some parts of it to construct what we want. We can also bring third party to encryption to work with that, for example, OpenSSL or WolfSSL library. But the problem is target availability. We do not know if these libraries runtime are gonna be available on the target. Plus, we want to stay away from loading things from disk as much as we can and operate in memory. And a lot of times it's too heavy or impossible to load those libraries in memory. And the third possibility is obviously with the limited kind of API that we have inside of the SGX SoundClave, the trusted area. We can roll our own, which is probably discouraged in this exercise anyway. And I've mentioned limited access to API and SGX SoundClave. The reason being is because it is itself, because of its kind of reason for existence to protect the code inside of it, it's devoid of support for SysCalls and it has a very limited IO in and out of SoundClave, mostly for state of preservation, but nothing less. So let's see what we can do. We're gonna take the first approach is actually using TC Crypto and see what we can do, how we can build it. So upon research, we kind of came up with three different things that we can do with that crypto in SDK. We can generate an RSA key, actually a pair, a public and private key. We can actually sign something with our public key and, well, actually encrypted with the public key and signed with private key. And we can actually use a routine that works on AS symmetric keys to be able to encrypt something of a value inside and potentially transfer that something, that piece of code or data outside of the enclave into untrusted area. And so the idea here would be for us to create an application where we do just that. The first step would be to generate RSA keys set inside of the trusted PRM, inside of enclave, give the public key out to our C2, have it stored there and then go to C2 and C2 would be able to generate the symmetric key send it to us inside of the trusted PRM. We're gonna store the symmetric key and then we're gonna have a shared symmetric key without leaking it. So we can kind of generate payload on the C2 side and then keep transferring it into our trusted PRM without having any inspection or being worried about the algorithm disclosure or payload disclosure or key disclosure, right? So it's three step process. First, we're generating public private keys, we're sending them to C2, C2 now has them, then encrypts a symmetric key, sends it to us, we store it in the trusted component which decrypts the key because it was encrypted with the RSA which we already had from previous step. And then we just share the symmetric key between the two and that's how we achieve secure communication. And then, so components that we want to have in this sort of construction is we kind of thought of splitting it in three ways. The application, which will be inspectable by defense and it's loaded from disk, it's your kind of implant or cradle or loader. We went there out of establishing the bridge between enclave and that loader which kind of facilitates in broker's interaction takes data from one passes to another, but it's also a kind of a middle man that can be taken out of the equation upon first load. So the EDR will not see all of the picture and the bridge can come in as a memory loaded module which will be able to kind of broker communication between the two, the enclave and the app at the runtime. And so the bridge is also assumed inspectable and then enclave which is assumed obfuscated. We're gonna have some notes on that later on in limitation section. But yeah, so enclave is where we're gonna store our keys and our algorithm, it will be loaded from disk, but it's also a secure library which may not be introspectable. And yeah, then we need to kind of start building that. And so we come up with that exclave system which we're gonna demo, and then we'll come back to talk more about its construction limitations and all the other things. Let's take a look at the exclave, its components and its operations. Here we have a victim machine with an application which is an agent or an implant. There's a bridge DLL which facilitates interaction with the enclave. It may or may not be on disk, it may or may not come directly from the network and be loaded that way in memory. And obviously, as we mentioned, there is a trusted piece of code that runs in PRM. It makes sense to kind of put the code in perspective in so far as to explain those components. The application finds the bridge, the bridge function is invoked which is exported and found. The bridge itself maps through the EDL to the enclave calls. Here's the EDL, essentially it's a mapping or a matrix of trusted calls that we can invoke inside of enclave and untrusted calls that we are not. And enclave itself is the trusted code that essentially does the processing, does the encryption, and other things that we need to keep secure. And obviously on the other side, it's a C2 that should be able to match the crypto parameters one to one so it's able to successfully decrypt and communicate with exclave that resides inside of the victim machine. And let's take a look at how that works. So essentially we have two screens. One is the victim machine where all these components are deployed and there is a C2. Let's start the C2. It listens on the port and it's responding to communication. Let's start the application. And the first thing it does it's trying to create an enclave. It's a standard procedure to create the memory mapping and launch things into existence. Once this is done, all checks happen. Are we running on the machine that supports SGX? Are we able to create it? What are the parameters and permissions that allow us or not allow us to do this? And then it's trying to generate a RSA key pair for communication. Once this is done, the public key and private key are available. Private key gets stored in enclave and public key gets shared through the bridge into the application which connects to the C2 and solicits for a storage of this public key on our side. Once this happens, the C2 carries out the task. It does its processing, it generates the symmetric key for communication and sends the response back to the application which proxies it to the bridge into the enclave which stores it. And this is what we're doing here. So the shared key is now available and now we are ready to map one to one encryption of the payload or would be payload that would come from C2 into the enclave. Again, through the app, through the bridge into the secure area. And this is what's happening here. We're requesting that payload. The payload gets generated. In this case, it's a very contrived example. And it gets encrypted to match the mode of the capabilities of the enclave. All that processing happens and the payload travels back to the agent and ultimately to the enclave. And enclave having the symmetric key is now able to decrypt the payload. After this is done, the payload gets stored in clear text in the enclave but it's protected from any kind of reachability from the defense and then the attacker can actually work on that. And the last but not least, once we created the enclave, we can destroy it if we don't need it for whatever reason and the duration that we want to use that. Once this is done, everything is good and we are ready to move on. Okay, so we saw a presentation of how Xclave works. There are some assumptions and limitations to this. First of all, it's a bad coding practice. We are weakening the enclaves. We're using it, we're misusing them. And so, but our idea is that while the technology can be used as is, a lot of times, EDRs do not inspect enclaves. In our testing, we were able to use pre-release keys or in pre-release or debug mode, we were able to compile that and then use the byte listing, testing signing keys to do that. It will, in theory, that should prevent us from debugging into it, which is true. The EDRs themselves do not actually make the leap on inspecting enclaves anyway. And so, the other side of the story is that in order to do it properly, you need to assign attestation key and have Intel provision one and sign it with its root key and then you can sign your enclave, which will be undebuggable, right? But in this case, you're running into attestation, meaning attribution issue, right? And so we kind of went the other route and said, hey, what can we do with pre-release or debug versions of it? And so, attestate enclaves are supposed to be inspected, but in practice, they're often not, right? And so, as we mentioned before, as JX provisioned, the PSW services installed or platform is installed and the TC Crypto Library of Cryptographic Primitives is present. That should let us kind of live off the land once we arrive at SGX enabled machine. And one thing to notice is that, how do you help defenders kind of understand what the enclaves are and how to find the rogue ones is that you need to work for signatures, identify non-improved SGX enclaves. The way you would do this is you basically can have really nice tool from Kedelsky's SGX Fund to dump your DLL and kind of see the details of that enclave and kind of latch on to the keys that you have not provisioned. So I'd like to thank everybody who has come to my talk. Here's the link to a proof of concept, the Bridge Library, the enclave and application, which we've used in this presentation. Thank you very much.


Hi again, for today we have a simple challenge, our challenge is get X and Y integer values from the input, that means from the command line, and multiply these values and print the result to the screen. It looks easy, so let's start with our challenge, first what we need to do is to get X and Y integer values from the input. Okay, first I'm going to get X value from the input and store it to our X variable, so let's get our X variable from the input and the same will be from the Y variable, we're going to get variable Y from the input and now we want to multiply these values. Okay, let's multiply them and we want to print the result to the screen. Okay, let's print the result to the screen, but before running this program, we want to think a little bit about our code, because when we get an input from the command line, that input will have string type and we want to multiply these values, so we want to have integer values. Here with this code, we will get string value, but we want to convert this string value to the int, so I'll use conversion to int to both these values and now we can print our result of multiplying. I can also add a few things to make it a little better. For example, let's make it like this and let's save and run our program. For example, let's say multiplying.py. Okay, and now let's run it. For example, let's say that X is equal to 10 and Y is equal to 5 and the result of the multiplication of numbers 10 and 5 is number 50. That's all in this challenge. Thanks for watching, see you in the next challenge. Bye-bye.


After a weekend sweep to Wisconsin, the B. S. U. W dropped to 9 16 and three place in the W. C. H. A. points behind St. Claude will hit the road this w the Huskies for an oppurt them in the standings. A 16 losses coming on frie the key to a successful w with a strong opening ga what Mel Pearson said last year, he said everything because if you don't get not gaining any ground an situation we're in. We ne to cut into that four poin do that. And so we need Friday, but I think this ready for the challenge. that we play like we've Dakota in Wisconsin. I get these six points co and then get the job done I think we're sitting pr If you've enjoyed this seg news, please consider ma contribution to Lakeland


The training will cover the 14 elements of PSM using the 2005 explosion at BP's Texas City Refinery as a model. Look for it soon at csb.gov. March 23rd, 2005, the BP Refinery in Texas City, Texas. Several units at the refinery had been shut down for lengthy maintenance projects which required nearly a thousand contractors to be on site along with BP employees. BP had positioned a number of portable trailers close to process units for the use of contractors and other maintenance workers. Over a period of months, BP had located 10 trailers for workers servicing the ultra-cracker unit including a double-wide wood-framed trailer that contained 11 offices and was regularly used for meetings. Though these trailers were located near the isomerization unit, the occupants were not warned the ISOM unit was about to start up, a potentially hazardous operation. At 2.15 a.m. on March 23rd, overnight operators began introducing flammable liquid hydrocarbons known as raffinate into a 170-foot-tall raffinate splitter tower used to distill and separate gasoline components. Near the base of the tower, there was a single instrument that measured how much liquid was inside. It transmitted this information to both a satellite control room and a central control room located away from the ISOM unit. But this level indicator was not designed to measure liquid above the 9-foot mark. During normal operation, the tower was only supposed to contain about 6.5 feet of liquid. But during start-ups, operators routinely deviated from written procedures and filled the tower above the 9-foot mark concerned that if the liquid level fluctuated too low it would cause costly damage to the furnace. At 3.09 a.m. as the liquid neared the 8-foot mark a high-level alarm activated and sounded in the control rooms. But a second high-level alarm, slightly further up the tower, failed to go off. By 3.30 a.m. the level indicator showed that liquid had filled the bottom 9 feet of the tower and the feed was stopped. The CSB later estimated that the liquid was in fact at a height of 13 feet and the operators could not know the actual level because the indicator only measured up to 9 feet. The lead operator had been overseeing the start-up from a satellite control room within the ISOM unit. At 5 a.m. he briefly updated the night board operator in the central control room about the start-up activities. The lead operator then left the refinery early, an hour before the end of the shift. A new board operator arrived in the control room around 6 a.m. to start his 30th day in a row working the 12-hour shift. He spoke briefly with the departing night shift operator and then read the logbook to prepare for the start-up. But the logbook did not clearly indicate how much liquid was already in the tower and equipment and it left no instructions on routing of the liquid feed and products when the start-up resumed. Instead, the control board operator only found a one-line logbook entry that said ISOM brought in some raft to unit to pack raft with. At 7.15 a.m. the day shift supervisor arrived. Because he was more than an hour late, he received no formal briefing from personnel on the night shift about conditions in the ISOM unit. At 9.51 a.m. operators resumed the start-up. They began recirculating the liquid feed and adding more liquid to the already overfilled tower. As new feed was added, start-up procedures called for regulating the liquid level in the tower using the automatic level control valve. But the board operator and others had received conflicting instructions on routing the product. As a result, this critical valve was left closed for several hours, blocking the flow of liquid from the tower. A few minutes later, operators lit burners on the furnace to begin heating up the feed, part of the normal start-up process. While the start-up was underway, the day supervisor left the refinery on short notice just before 11 a.m. to attend to a family medical emergency. Contrary to BP's own procedures, no experienced supervisor was assigned to replace him. This left a single control board operator, now without a qualified supervisor, to run three refinery units, including the ISOM unit, which needed close attention. The refinery had eliminated a second board operator position following corporate budget cuts in 1999 after BP acquired Amaco. As the start-up continued, the tower steadily filled with liquid, reaching a height of 98 feet, shortly before noon, more than 15 times the normal level. But the improperly calibrated level indicator told operators in the control room that the liquid was at 8.4 feet and gradually falling. Furthermore, the control panel was not configured to clearly warn operators of the growing danger. It did not display flows into and out of the tower on the same screen, nor did it calculate the total liquid in the tower. Meanwhile, the maintenance contractors, who were not involved in the operation of the ISOM unit, left their work trailers to attend a company lunch, celebrating a month without a lost time injury. At 12.41 p.m., an alarm activated as the rising liquid compressed the gases remaining in the top of the tower. Unable to understand the source of the high pressure, operators opened a manual chain valve to vent gases to the unit's emergency relief system, a 1950s-era blowdown drum that vented vapor directly into the atmosphere. Operators also turned off two burners in the furnace to lower the temperature inside the tower, believing this would reduce the pressure. Nobody knew the tower was dangerously full. The operators did become concerned about the lack of flow out of the tower and began opening the valve to send liquid from the bottom of the tower to storage tanks. But this liquid was very hot. As it flowed through the heat exchanger, it suddenly raised the temperature of the liquid entering high up the tower by 141 degrees Fahrenheit. It was now about 1 p.m. Contract workers, unaware of the startup and the looming danger, returned from lunch and began a meeting in the double-wide trailer, in the corner room, closest to the blowdown drum. Over the next few minutes, the hot feed entering the tower caused the liquid inside to start to boil and swell. Liquid filled the tower completely and began spilling into the overhead vapor line, exerting great pressure on the emergency relief valves 150 feet below. At 1.14 p.m., the three emergency valves opened, sending nearly 52,000 gallons of flammable liquid to the blowdown drum at the other end of the ISOM unit. Liquid rose inside the blowdown drum and overflowed into a process sewer, setting off alarms in the control room. But the high-level alarm on the blowdown drum failed to go on. None of the operators knew of the catastrophe unfolding in the ISOM unit. As flammable hydrocarbons overfilled the blowdown drum, operators nearby saw a geyser of liquid and vapor erupt from the top of the stack.  The vapor cloud expanded in just 90 seconds, engulfing the unit and the nearby trailers full of workers. About 25 feet from the base of the blowdown drum, two workers were parked in a pickup truck with the engine idling. As flammable vapor entered the air intake, the diesel engine began to race. The two workers fled, unable to shut off the engine. Moments later, witnesses saw the truck backfire and ignite the vapor cloud. Powerful explosions swept through the area. The blast pressure wave accelerated through the ISOM unit, causing heavy destruction and igniting fires. The workers inside the trailers were right in the path of the explosions. The fires continued to burn for hours. 12 of the 20 occupants of the double-wide trailer were killed, along with three workers in a trailer nearby. 180 workers were injured, many with serious burns, fractures, or other traumatic injuries. The wood and metal frame trailers were blown apart by the blasts. Firefighters struggled to rescue the injured and recover the victims. Fifty large chemical storage tanks were damaged and the ISOM unit remained shut down for more than two years. The disaster at BP Texas City was the most serious refinery accident ever investigated by the CSB.


Hello, this is Laptop Media, and today, we will show you how to open the Lenovo V15 IML and what's inside of it. This laptop's bottom panel is held in place by 10 Philips head screws. After you undo them, pry the panel and remove it from the chassis. Please remember, it would be of great help to us if you just hit the like button and subscribe to our channel. That would motivate us to make even more and better videos for you. Here, we have a rather small battery with a capacity of 35 watt hours. In terms of memory, you get 4GB soldered to the motherboard, as well as one Sodom slot for further expansion. Storage-wise, the laptop sports 1M.2 PCI-EX4 slot. In addition to that, there is a 2.5-inch SATA drive bay. Unfortunately, there are no mounting and connecting accessories inside the box. Lastly, there is the cooling. It's pretty simple and comprises a thin heat pipe. Respectively, both the heat sink and the fan are of average size. If you'd like to see more disassembly videos of the latest notebooks, we would highly appreciate if you hit the like button and subscribe to the channel.


Suspense! Tonight the Diary of Sopronia Winter starring Agnes Moorhead and Ray Collins. Suspense is presented for your enjoyment by Roma Wines. That's R-O-M-A, Roma Wines. Those excellent California wines that can add so much pleasantness to the way you live. To your happiness and entertaining guests. To your enjoyment of everyday meals. Yes, right now a glass full would be very pleasant as Roma Wines bring you... Suspense! This is the man in black. Here for the Roma Wine Company of Fresno, California. Who tonight from Hollywood bring you as stars Miss Agnes Moorhead and Mr. Ray Collins. Miss Moorhead and Mr. Collins will appear in a study in terror. Written especially for them and for suspense by the distinguished radio playwright Lucille Fletcher. But before we take you to the scene of our drama, let's conjure up a scene of our own. Let's imagine ourselves in sun-drenched Havana, dining in the gay club Momart.  Part of the credit belongs to Cuba he smilingly acknowledges, but part of the credit belongs also to your country for producing this excellent wine which adds so much to our enjoyment. For this says Roma Wine from California in your own USA. Now it is a fact that connoisseurs of many other lands know the excellence of Roma Wines, made in famous wineries located in the heart of the choice wine districts of California. But millions of Americans also know these things and have made Roma by far America's largest selling wines. Here at home, Roma Wines are truly inexpensive, no duty, no overseas shipping cost to pay. And for only pennies a glass, your meals, your entertaining can have the added delight of superb Roma Wines. You will find them a truly excellent flavor and character, fine products of age, old winemaking skill perfected by modern quality controls and tests. Ask for R-O-M-A, Roma Wines, made in California for enjoyment throughout the world. And now with the diary of Sophronia Winters and with the performances of Agnes Moorhead and Ray Collins, we again hope to keep you in suspense. February 1st, St. Petersburg, Florida. I, Sophronia Winters, have hereby begun this diary because on this date I feel for the first time that I've begun to live. Diaries are no good unless one has thrilling experiences. For 40 years I've never had what could really be called a thrilling experience, but Papa's death has changed everything. Here I am in beautiful St. Petersburg with everything to start life anew, money and bike purse, two suitcases full of new clothes and a gorgeous new permanent wave. And Florida is really the land of romance. It doesn't matter whether you're 17 or 70, there are parties and dances and bingo games and flirtations for all. My landlady in fact tells me that people often become engaged and even married to perfect strangers overnight. I'm still shy of course, but just the same it's such fun and so thrilling. To think one's fate may be just around the corner. February 3rd, oh diary it is beginning. This morning when I came out of my lodging house to go down to the beach, I noticed a man, a thrilling looking man, sitting across the street on a bench. It was just as though he were waiting for me, because when I came out, he sort of started up as though he knew me. Of course I didn't speak first, but I knew the minute I started down the street that he was following me. Well, I got to the beach and sat down with my magazines and suddenly there he was, strolling toward me with a broad smile. Well, sitting out here all by your lonesome? Oh, yes, yes I am. And down here at St. Pete Long? Just three days. Three days? That's a long time. It's a wonder I didn't spot you before. Oh, Mr. Ed. Johnson's the name, Hiram Johnson. I came from Green Harbor, Maine, run a big hotel up there summers. Well, that's my whole history in a nutshell. Oh, my name's Sophronia, Sophronia Winders. Sophronia? Yes. But you know that's quite a coincidence. My sister-in-law's name was Sophronia. Sophronia Johnson. Have you ever heard of her?  Sophronia Johnson? No, no, I'm afraid I haven't. Who was she? Someone very famous.  Well, that's all right. Say, look at that sun, will you? I'd say it was pretty nearly time for lunch. You know, Sophronia, it's kind of mysterious us finding that nine-point starfish on the beach together. My sister-in-law, Sophronia, used to collect nine-point starfishes. But think your name, Sophronia. You find a nine-point starfish with me. Well, it kind of draws us together, huh? Harry, darling, he is wonderful. Strong, kind, warm-hearted, so generous. I feel as though I knew him completely, as though I'd known him all my life. What's the good of waiting, Sophronia? I've got to be back at the hotel in a week. We may never see each other again. Oh, Hiram, don't say that. I couldn't bear it. Then let's do it right away, tomorrow. There's a person out on Coral Avenue who'll do the job for us. We could take a nice moonlight drive out to the alligator farm. We could have a nice short dinner. Then climb on board the orange blossom tomorrow night from Maine. Maine? Oh, it's all so wild, so man-so thrilling. But what would your family think? Wouldn't they be shocked? Well, my family's all dead. I'm my own boss. It has to help you run that big hotel. I wonder whether I could do it meeting all those people. Well, don't worry about that. Just think of Maine. The big dark pine woods, the sand, the bay. The two of us alone together. On board the orange blossom. I was married in a wedding dress of Alice Blumauré with a frill of white organ at the collar and wrists and a rhinestone belt buckle. Hiram sent me talisman roses. I'm pressing one precious flower between the pages of this diary for luck. See it beyond this bend in a couple of minutes. Bag's heavy. No, not to get over that taxi manifestation. Imagine his insolence saying he didn't want to drive us out. There's the place. Oh, wait a minute. I don't want to look until I put down these bags. Now, where? There. Through those big pines. Oh. It is big, isn't it? 125 rooms. So many fire escapes and balconies and porches and towers. I, uh... I stayed in a hotel like that once, years ago, with Papa. It was very fashionable. My grandfather built that place 50 years ago. It hasn't been changed much. No. Of course you put in modern plumbing. Not yet. Well, here we are. Walk in. What's that? Just a foghorn out in the bay. Fog? We get it almost every night in this kind of weather. What are you locking the gate for? Why not? There's nobody coming in after us. Or going out again for a while. Well, I thought you said the hotel... The hotel's empty. Hyrum? What is it now? Hyrum, darling, I know it sounds silly, but let's not go in there tonight. Let's wait until morning. Why? Oh, just because it's so dark and empty, there's not a light in the whole place and no one's expecting us. What'll we eat and where'll we sleep? Let's stay in the village just for tonight. I've got things to eat, the place to sleep. Come on. Oh, my arm! Hyrum! Hyrum! You remember my telling you down in Florida about my sister-in-law, Saphronian? Well, that's her. Over there on the wall. Take a look at her. Hyrum, darling, just now you hurt me. Do you realize that? You twisted my arm. I said, take a look at her. Tell me what you see. Well, the glass is very dusty. She must have died many years ago. Her face is sweet. It's very sweet. Her eyes... Something very sad and wistful about her eyes. She was a murderous. She was hanged in Portland 25 years ago for the murder of my brother, Ephraim, here in the lobby of this hotel.  It was a summer day. There were guests sitting on the front porch in the rockers. It was just after lunch. My brother, Ephraim, was sitting at the desk, counting his loose change. My mother was crocheting an adipocasa in that old wicker rocking chair. Saphronia came downstairs, humming a hymn. Oh, don't, don't, Hyrum. Please, don't tell me anymore. Why not? Well, it is, and it makes me nervous to hear it like this in this big, shadowy lobby. And her eyes, Hyrum, acting so strange. What's the matter with you, Hyrum? I know it was a terrible tragedy, but it happened 25 years ago, didn't it? Don't touch me, Saphronia. Don't touch you. Do you remember what I said to you in Florida? What did you say? You said a million sweet and wonderful things to me, Hyrum. I said you resembled my dead sister-in-law. Look at her again. Look at her closely. Saphronia. And why? Oh, no. I can't. It's too horrible. I can't look at her face with any pleasure now knowing she was a murderer. You're afraid to look, is that it? No, not afraid. Hyrum! Hyrum! No. Stand there quietly. Like that.  That's all I wanted to see. That's all. February 12th, Green Harbor Hotel, Maine. I cannot understand it. I try to fathom it, but my headaches and my heart is heavy. The hotel is deserted, unchanged, and apparently uninhabited for 25 years. Wash bowls and pitches still stand in the empty rooms covered with spiders and cobwebs. Dust is everywhere, and the printed regulations on the walls are tattered and yellow with age. A row of broken rocking chairs on the front porch faces empty out to sea. Can he mean this to be my home? He's downstairs now on the shabby parlor off the lobby playing the harmonium. Saphronia. Yes? Yes, Hyrum? Sleeping. No, dear. Why is your door locked? Come out. I want to show you around the place. It's all right, dear. I've seen it. I've seen just about everything. No, no, you haven't. You haven't seen the grounds at all. The grounds? But Hyrum, it's after midnight. I want to show you where my sister-in-law, Saphronia, is buried. Well, not tonight, dear. Please, it's so late, and I have a headache. Open the door, Saphronia. I want you to come now. No. No, I shall not. Now go away and let me alone. I won't. I won't. No use carrying on like that. You see, I've got pass keys to all of them. And beyond where those four birches are standing, it's where my sister-in-law, Saphronia, was laid away 25 years ago. It was the biggest funeral in the neighborhood. Folks crowded outside the gate for the dozens, trying to get a look, but we wouldn't let them bury her ourselves, without a service, out here by herself on the grounds. Ephraim is buried in town, but not Saphronia. I had a feeling that I'd have to keep an eye on her even then. Keep an eye on her? Oh, I knew she was one of those restless sleepers who wouldn't stay quiet in her own grave. I knew before the year was out she'd find some way to start roaming around, hunting for mischief again. She was a young she-devil to the core, Saphronia. They could hang her till Tuesday, and it wouldn't do any good. You mean... You mean you think she haunts this hotel? No, no. No, not this hotel. She never had any use for it. Dead or alive. No. She makes for the warmer climates. She was always a cold, blooded little fish, freezing and shivering all the time. It's places like California and Texas. And... Florida. She makes for her. Florida? Yeah, that's one of her favorite haunts. Particularly around St. Pete. She likes the flowers and the sun. And... the romance. How... How am I to feel cold? Do you mind if I go inside now? Just a minute. I... I haven't explained everything. You think I'm crazy, I guess. Crazy. But I'm a lot smarter than some people give me credit for. Because you see, I have found her now. Three times. Do you, um... see that grove of birches over there? Under every one of them's a grave. I've found her wandering the earth in disguise. Three times. And I've killed her three times. And it still doesn't do any good. She's still restless. You mean... you mean you've killed three different women? So now I keep another grave to remind her. It's waiting now. Would you like to see it? No. No, Hyrum. No, please. Are you afraid to see it, Hyrum? No, I... Hyrum, you don't mean to say that. Did you think... just because my name happens to be Sopronia, and that I look a little like... Think what, Sopronia? No. No. February 14th.  I've made a terrible mistake. I must get away from this place. I must get away from Hyrum as quickly as I can. When he generally sits down and parlors, and plays the harmonium, a little earlier, in one of the deserted rooms, and then when his back is toward the lobby, slip out the front door. What's the matter? Anything wrong? No, Hyrum. You didn't want anything outside, did you? Because if you do, you'll have to ask me to get it for you. You see, I always keep this front door locked. Yes, yes, Hyrum. And the back door, too. And all the doors leading out into the porches and the fire escapes in a good many of the windows, makes one feel safe from thieves and peeping towns. Oh. You've got a cold. That's too bad. Yes. I must have caught it last night. Out in the doors. The dance. You ought to be in bed, a good one. The only good bed in the house is in my sister-in-law, Sopronia's old room. Oh, no, no, Hyrum. I'm all right. I'm all right.  Little head colds often develop into pneumonia. It's too bad I didn't think of that before. You might have slept in it from the very beginning. Here, up these stairs. All right. What's the matter? Are you so weak? No. No, I'm all right. This room is the cleanest in the hotel, too. I've always had a sort of suspicion about that. There, you see? I've kept everything as it was. What's the matter? Nothing. It's just... Seems kind of familiar. I don't know. I'm just seeing it so clean. Seeing it as though someone were living there as though they'd only just stepped out for a moment. It's just as she left at that afternoon when she walked down to murder my brother. You see her needlework on the table with the needle sticking in it? Her hymn book still open. She was very fond of singing hymns, Sopronia was. Had a nice voice, too. I used to accompany her. Hyrum, turn down the bed for you. Then you can get undressed. Well, I'll make you some hot tea. No, I don't want any. Here's the closet. You can put on one of Sopronia's dressing gowns. Dari, I miss out on myself. I shall go mad. I shall go mad. Two hours have passed since he locked the door on me. Night has fallen. I'm alone.  I'm sitting here at her little wicked table trying to become, trying to write this. Somehow when one writes about a thing it doesn't appear so real. My hand is just brushed against her needlework. Her hymn book. I can't bear having them near me. I must get them out of my sight anywhere in that closet or bureau drawer. Ready for your tea? No. Oh, why aren't you in bed? You'll take worse cold, you know. Well, I'll get in bed in a minute. First I'll... Ah! Brushing up on your needlework again. My needlework? You've got it in your hand. I wasn't working on it, Hiram. I swear I wasn't. I've never done a stitch of needlework in my whole life. I don't know one embroidery stitch from another. Now, let me show you. Look, look, look. I don't even know how to hold the needle. No, get into that, Zephronia. You'll see.  You've got to let me explain. I was born in 1892 in Kalamazoo, Michigan. My name is Zephronia. That's true, but they name lots of people Zephronia. I was named for my grandmother. She just died. Yeah. Oh, no, no. You've got to listen to me. I lived in Kalamazoo all my life. My father was vice president of the Kalamazoo First National Bank. Everybody in town knew him, and they know me. If you'd only just write the letter of sin to Wawa, I'd... February 15th. Now, I live only for moment to moment, listening to each creak of honesty. Oh, my cold is growing worse. I've been in bed all day. It's night now. The fog horn has begun to blow again. February 19th. I woke up early this morning after a wretched night and the date was burning in letters of fire in my brain.  It'll be today. But the hours have been crawling on. It's almost midnight. Why does he torture me like this? I would rather be dead than sit here in this room one moment longer. If he doesn't come in five minutes, I shall force him to come. I shall beat on the door. No. Rather let me sit quiet praying that it doesn't come. Or I want to live. I want to live. Zephronia, come downstairs. I want you to sing me a hymn. Sing? You sing for him before? Well, I've forgotten. And besides, downstairs when my door's locked. It's unlocked. Try it. I've locked. I never knew it. I never knew it. Coming? Oh, you unlocked it sometime while I was just sitting. Why didn't I try a few more times? Zephronia! Years, but I might as well. I'll sing for you out here in the hall. My voice will carry better. It always did carry better in the hall, didn't it, Zephronia? So you remember that, too. Of course you know both the front and back doors are locked. Yes. Yes, Hiram, dear. Shall I sing, too, Zephronia? Would you like me to sing along with you? If it pleases you, Hiram. Work for the night is calm. There's only one more page. Yes, go ahead. March 22nd. I've been sick, I think, for a very long time. The pages of my diary are blank, but I shall take you out again, poor diary, today and start you over again. No. No, I shall never look back at the other pages. I shall only write on and on about this nice, quiet place. So that no one reading this diary will ever know. He did do it, diary. He was smarter than he. When I opened that door at the head of the stairs and heard the music, when I saw the fire ax still hanging on the wall, tiptoed like a little mouse, even as I sang to him into that room where he was playing, if a reflection of that ax had so much as glimmered across the wood, if he had turned, but I was clever. So much cleverer than he. I kept on singing. Free. Free is a bird.  Isn't he nurse? Nurse. Isn't my dear brother-in-law Hiram really dead? Yes, Miss, he's dead. And now I'll thank you to hand me over that diary. The doctor doesn't approve of the patient's writing anything. This is the diary of Sophronia Winters, starring Agnes Moorhead and Ray Collins. Tonight's study in Suspense. Suspense is produced and directed by William Spear. It's my job, it's my privilege to tell you how much pleasure and enjoyment you can add to everyday living by serving Roma wines with meals when entertaining or anytime. And in hot weather, let me suggest Roma wine cooler offers. Just put ice cubes in a tall glass, half fill it with your favorite Roma wine, then fill it up with sparkling water. For a sweeter drink, just add sugar and stir. Ah, that, my dear people, is really something. And it's so simple, so good, and so inexpensive. It's a fact. The cost of Roma wines is only pennies a glassful.  If your dealer is temporarily out, please try again soon. Just be sure you ask for R-O-M-A, Roma wines, America's largest selling wines, all made in California, for enjoyment throughout the world. Agnes Morehead appeared through the courtesy of Metro-Golden Mayor and is currently being seen in their production, Dragon Seed. Next Thursday, same time, in an unusual feature performance, Suspense will bring you in his first appearance as an acting storyteller, the noted American novelist and playwright, Mr. Ben Hecht, sharing honors with Mr. Hecht. The star of the performance will be Mr. Frederick March. You won't want to miss hearing Frederick March and Ben Hecht in Actors Blood, which will be next week's tale of Suspense. Presented by Roma Wines, R-O-M-A, made in California, for enjoyment throughout the world. This is CBS, the Columbia Broadcasting System.