Freedom! Today we went to go look for developers at the University of Philippines! If you're curious on all the stuff that happened on this trip, it'll be on my channel, youtube.com slash Anthony Smith. However, George gave a very compelling talk, which you'll see behind me. If you're curious on what kind of big data solutions we are looking to solve, and what we're looking for in developers, just continue watching. Also, keep in mind you can apply it any time at jobs.freedom.tm. I would go into greater detail, but let's face it, I'm not a developer and I don't understand that stuff, so better leave it to him. Alright, I'm gone! How about Lyravel or PHP? Anyone using PHP? Everyone's probably using PHP. The challenge we have is because we grew so quickly, in about a year and a few months, we went from being brand new to being the largest network on youtube, and so we have a lot of big data problems, we have a lot of scaling problems. And that's why we're here today, to try to see if we can excite some of the developers here who want to solve or help us solve big data problems. When you have 200,000 channels, that means you have, each channel has, let's say, 20 videos. And each video could have 20 comments, so you can see it gets exponential. 200,000 channels times 20 times 20, and then there's a lot of channels that link to other channels. So, currently we've indexed 42 million channels on youtube. 53? 53 now? Okay, so 53 million channels on youtube, of which 200,000 are our partners. But of course, we want to offer value to everybody, so we want to partner 53 million channels. You can see the growth potential for what we're trying to solve. And people like Tiffany are the examples of those 200,000 partners, 53 million of her out there that we can help. So, who here has tried to solve any big data problems? Things that deal with more than a million rows or a million pieces of data. Anyone interested in trying to solve those kinds of problems? Raise your hand. So that's where we're trying to find, because we ourselves don't know how to solve those problems. We've used Amazon clustering to try to scale databases in web servers. We've been using varnished hash to help deliver static data more quickly. We've been using other technologies like node, like Mongo, like Python, to try to leverage the libraries and the tool sets available in those technologies. And so our goal at the long term is to go IPO, to go public. So this company started just a year and a few months ago on YouTube. And because we grew so quickly, our advisors have told us that you should be planning for IPO. What that means is when you go public, it means that the company gets stocks and the people who were part of the company that helped to grow to go public also gained stock options in the company. And that's why big companies like Google and Microsoft and Facebook have all done. They've built a company from being a private company to a public company. And so that's the pitch we make here is first, are you interested in solving big data problems and helping YouTubers grow faster? If yes, then are you excited to be part of a startup that is on the road to go IPO in the next two to three years? And if both those answers are yes, then we'd love to get your resume and have you take our exam. We have a written exam that will take about 30 minutes to an hour. And I'm also here to just answer your questions. Do you have any specific questions about what we do, how this fits with your interests? Feel free to ask now or I'll just keep talking. So I'll first ask the questions. Any questions? Okay, hearing none. We're not just working on YouTube. We're also working on Twitch. Who here knows Twitch? Twitch is a gaming live streaming platform. Amazon recently bought them. Anyone know how much Amazon paid to buy Twitch? I mean, it's more money than I can imagine. So Twitch was recently sold to Amazon. Amazon bought Twitch. Everyone thought YouTube was going to buy Twitch, but it was Amazon. And what they do is they offer a platform for people who play games who want to deliver the video of the game in real time to an audience watching you. So a good live streamer would have like 1,000 people watching them at the same time playing a game. He'd be commentating, he'd be saying, and now we're about to fight this boss. And a lot of people would be watching him and chatting, and he'd be responding. So it's like a real time sportscaster about playing games. So one of the features that we built deals with enhancing Twitch. We can now inject real time stats. Let's say you're watching a League of Legends game. Wouldn't it be cool to see which champions are being used, what the stats of the game are. So when you're just tuning in, you can look down and see, okay, they're using these champions. This is the win-loss ratio and other information. So that's one of the values that we add. We write tools to enhance Twitch, YouTube, Hitbox, even Facebook and Twitter when we get to them to add more relevant data beneath events like live streams or videos. And part of what we're hoping to find here is to find people who are passionate about a particular game. Let's say you love Dota 2. Who here loves Dota 2? So then we would love to have your help to build like a Dota 2 API to build a cool information real time from Dota 2 games. Who here loves League of Legends? We're doing the same for League of Legends. In fact, we have one League of Legends player behind us. His name is Michael from Quebec, and he's also building these components to help bring in the live data into the game when you're watching it on Twitch or on YouTube. So other things that we're doing, we're building music clips. We actually have a player where you can type in any song you want and you'll be able to hear it right away without stalling anything after you've installed our Chrome extension. So the way we do it is we simply play a YouTube video without the video. It's a Chrome-less player that plays in the background and you have the option to actually watch the video if you want to see it, not just hear it, but that's another example of a pretty cool piece of technology we build. So now how about the business model? How does freedom make money? Anyone know? We're doing all this for free. No one pays for these music players, these gaming PLI feeds. All the things we build is given away for free. So how do we make money? What's the business model? Advertisements. Who generates the advertisements? YouTube or hitbox? So the reason we make money is because we offer these tools so that the people who make the videos partner with us and then the companies, YouTube, Twitch, hitbox, pay us and then we pay those people. We are like a value add. We're building a platform on top of existing platforms and our business model is based on revenue share deals. There's never a fee. No one pays us any money for using our services.  So that's the whole business. We help people become independent entrepreneurs, help them earn either like a hobby income to get a little bit more spending cash or those people who want to do this professionally make it a full-time gig so you don't have to do anything except make videos or live stream. That's the goal of freedom, to build this platform, this community that helps people do this. And I'm hoping that we can also find some good developers or graphic designers, people with different technical skills so that we could scale this business up from the 200,000 channel partners we have currently to the 53 million that we know are out there. Any questions? So far. So it's all part of Heartbeat and if you want to get it, simply do a Google search for Heartbeat Chrome. This is a Chrome extension. So Heartbeat Chrome, it'll take you to the Chrome web store where you can install it, it's free.  You click it and you can search for any song that you want. And then if you go to YouTube, you'll actually see a lot of extra information. So let's say you're watching a video. What videos do you like to search for on YouTube? If you'd like to admit. Do search for music videos. Out of ponder. Okay, so let's say you're searching for those videos and you have Heartbeat installed, you'll see a few extra links. Those links will let you chat with people. So you know how Facebook has a chat. Does YouTube have a chat? No, but we thought it should, so we added one. Heartbeat enhances YouTube and adds a new button called Get a Room. And if you click that, it'll take you to a chat room that will let you talk to people who are also watching that video. So you can discuss it and see what other people have said about the video. It's like a real-time commenting, but it's chatting. So that's another feature that Heartbeat adds to enhance YouTube. And we have features to enhance Twitch and other platforms and we're building more. So, good question. Any other questions? Yes. System 1? So this is our development team and he's saying that we are looking for a System 1 developer trying to build a System 1 development team. No. All the System 1 developers are working in the company. I'm not so good at these script things. Many of you use Facebook and no one here has written a Facebook app. One person's written a mobile app. So one of the things you want to do with Heartbeat is you want to architect our own app platform. What that means is when someone installs Heartbeat, right now you get everything included. The music player, this get-a-room feature, all the other enhancements, they're just there. But we want to build a system where people can write Heartbeat apps just like people can write mobile apps and then users can choose which Heartbeat app they want to add or remove from their Heartbeat installation. And then in the future, we want to create a whole website which would be like Facebook.com but it'll be www.heartbeat.tm You couldn't get Heartbeat.com so you found .tm, it's like a trademark. It's really bonus points if anyone knows what country T.M. stands for. Not your Anthony. T.M. stands for anyone? Turkmenistan. You're not supposed to know that. It's just a convenient name, but if you want to check it out, we have right now www.heartbeat.tm and we want to build like Facebook.com a whole website with Heartbeat apps and other enhancements into basically a video social network, a Facebook for YouTubers. So there's a lot of cool projects that we are working on. I hope I've piqued your interest. Some of you who may be looking for the right company to do an OJT or if you're graduating to get your first job, we're based in Eastwood City and Eastwood City, you don't know, is in Hazelham City, it's about two hours drive from here. We offer self-housing, which means you can live there if you want at no extra cost. We offer meals, so you'll have lunch and dinner provided and we're trying to illuminate all the distractions. So we have a games room, we have work time that starts at 11 a.m. and we have the two breaks for lunch and dinner and then we start at 8.30 p.m. So that's the general pitch of what is freedom and any TV, so it's not confusing, is the name of the company and freedom is our brand that represents the YouTube network and we'll have other brands like EAT, like MGM but those are for different categories. EAT is for musicians, MGM is for gamers and we have other brands but I don't want to confuse you, so Eastwood offices, lots of perks, pretty cool, we have problems to solve and focusing on the road to IPO, to go public as a stock company. We forgot something. What did I forget? Best developers in the world. Of course, yes, we have the best developers in the country. So any questions before I end? If you think of any, we're right over there, we'll be here today and tomorrow and I encourage you to drop by. Thank you.


Hi everyone, Joe for jasmizcasebreaks.com coming at you with 2019-2020 Panini Hoops Premium Stock Basketball, Salo Pack Break number 31. Random team break here and at the end we'll re-randomize everybody's names and the top 10 names will get teams and pick your team 13 which will be in a separate video. We don't randomize the team names, we just randomize your names, name on top gets the Kings, 10th name down gets the Raptors, so on and so forth. But let's do the break first. Big thanks to this group right here for getting into the action, appreciate it. Thanks for hanging with us on a Friday night here. All the teams are in, let's roll it, let's randomize it five into three eight times for names and teams, one, two, three, four, five, six, seven, and eight in final time. After eight we got Mike down to Rosario, five into three eight times for the teams, one, two, three, four, five, seven, and eight in final time. After eight we got the Bulls down to the Sixers. So no trade windows in these filler breaks. Here's the first half of the list right here, Mike with the Pelicans, here's the next part of the list right here, Kevin with the Grids. Let's just print and rip, good luck. The final printout right here, hot off the presses, extra, extra read all about it. There's some second year Luca Donic, Lonzo, Jalen Noel, Green, Zach Levine right here. In the bonus pack, a little depot, see Jim McCallum and Dwayne Wade. All right, so nothing too crazy there, but let's see who's going to win those teams in the next break. We've got Mike down to David and everyone in between. Let's get all your names here and let's roll it and randomize that list. Hard four, two and a two. And so we'll match up with the teams right there. Good luck. So top ten after four, one, two, three, and fourth and final time. After four, from 11 down to 30, thank you. I appreciate you giving this a shot. We'll get him next time. Congrats to the top ten happy times for this group. E-10, Nicholas, Roy, John, Martin, E, Anthony, Martin, Martin, Rosario. There you go. Congrats to the top ten. There you go. There you have it. So Rosario with the Kings, very nice. We'll put a little rooftop next to name so you know you won that in this little pack, Martin with the Celtics and the Pistons, Anthony with the Cavsie with the Heat, Martin with the Magic, John with the Bucks, Roy with the Suns, Nicholas with the Clippers and E with the Raptors. I'm Joe. I'll see you next time for the next video, which will be Picker Team 13. Jasper'scasefakes.com.


over here celebrating the ribbon cutting for the employee recognition gallery. We have the 650 names on these panels of glass and representing not only the fact that employees have given but also the fact that they really have owned this campaign, believed in the institution and believed in legacy. I think there's a lot of pride that we see in the employees in this brand new building. Some 10 percent of employees contributed but it brought close to one million in donations for the bricks and mortar of this building and that speaks volumes that employees during a period of austerity could come out and essentially help make that one million dollars possible. Well it's very impressive and I'm really happy to be part of this honestly. Diabetes is a big issue today. I'm happy just to contribute whatever I could. Melanie A. Reed-David. And now that your name is up there it's kind of like you know you feel like you're part of this whole thing. It's a fantastic building and all the lovely things that we're going to be able to do here. It really puts Winthrop on the map and I think we're part of it now and that's a really exciting thing. It's a wonderful recognition of employees that more than 10 percent of our employees participated here. It says something about an organization. It's also nice that Ed and Pat Trellianti had dedicated this area here at Winthrop. Ed has been a great leader of some organizations on Long Island and I can tell you from personal experience dealing with those organizations Ed had great respect and great affection for his team which is what we have here at Winthrop. The campaign is not over. We are at 22 million dollars so we're continuing on and there's still opportunities for employees to give also and the fact employees are still giving. And I'd like to thank Brian Malone and Maddie Hasselman for leading the employee effort and all of the other committee members who helped get rally the employees and bring in that kind of a donation and of course Ramon Sugri and his staff who have done a great job and also Ron McGlynn who towards the end of the employee campaign stepped up and did a matching contribution which really helped the employees bring in a couple of a hundred thousand dollars more. Once again thank you to all of the Winthrop employees for your support of this terrific building. Thank you.


The Mississippi River Delta Plain is a large river-dominated wetland, estuarine system that delivers a total of 6.7 TGC year 1, 1 TG equals 1012 G, of dissolved organic carbon, DOC, into the estuary and the northern gulf of Mexico. This amount of DOC is equivalent to approximately 1% of the annual global oceanic uptake of atmospheric CO2. Extreme flooding events in 2019 and hurricanes in 2019 and 2021 contributed to the delivery of DOC from the river and wetlands into the estuary and the NGOM. Storms and floods can be important sources of DOC that facilitate transport of upstream carbon as well as transformation of carbon in the wetlands, through the conversion of vegetated wetlands to open water. This article was authored by Bingqing Liu, Yuriko J. DSA, Francesca Messina, and others.


Item number SCP-1254 Object Class Euclid Special Containment Procedures The building SCP-1254 is held in is to be permanently closed to the public. Due to SCP-1254's close proximity to a busy shopping district, a false-storefront owned and operated by a Foundation front company has been constructed in order to allay any possible suspicion. SCP-1254 is to be treated as an active archaeological site, with strict environmental controls and safeguards to prevent any possible damage. Personnel within SCP-1254 must exercise caution at all times, and refrain from causing any unnecessary disturbances to SCP-1254. No further containment measures are necessary. While exiting SCP-1254 are to be fully decontaminated before being allowed to leave the building. Cameras are to be installed in order to observe SCP-1254-1 behavior and the progress of SCP-1254-2's construction. Armed guards are to be kept on standby in the event SCP-1254-2 activates. Description SCP-1254 is the entire stock of books in a ██ bookstore located in ██ California. While SCP-1254 appears to be a set of standard books on the outside, closer examination reveals the interiors of the books have been cored out to construct several miniature civilizations. The inhabitants, dubbed SCP-1254-1, reminiscence of humanoids that were nearly identical to normal humans and never respect, except for size. Their average height was approximately 5mm. Archaeological analysis of the few remaining intact samples of SCP-1254 suggests that SCP-1254-1 possessed the ability or technology to convert paper into any conceivable material. These intact samples contain stone structures that bore many similarities to ancient Greek and Roman architecture. Study of the damaged samples of SCP-1254 shows the remains of more advanced materials such as concrete, steel, carbon fiber, trace amounts of uranium, as well as several as-of-yet unidentified materials. There is even evidence of the existence of organic foodstuffs. In addition, the number of distinct civilizations within SCP-1254 corresponded to the number of different genre sections the bookstore contained. The knowledge base each SCP-1254-1 civilization possessed also corresponded to the types of books they inhabited. For example, the science fiction section showed a more rapid pace of technological development, while the fantasy section largely remained in the medieval era. The civilization in the non-fiction section was the one that most closely correlated to the current time period. There is definite proof that these civilizations were aware of and interacted with each other, with border books exhibiting a blend of various architectural styles that neighboring samples of SCP-1254 lacked. However, 99% of SCP-1254 was destroyed or irreparably damaged due to a fire that took place before its discovery. Public analysis suggests that the fire started in the young adult section of the bookstore. Traced radiation readings, as well as the remains of various types of weaponry, suggest the fire was started as a result of a miniature thermal nuclear war between one or more of the SCP-1254's civilizations, which proceeded to wipe out the entire SCP-1254-1 population. SCP-1254 was first discovered after the previously mentioned fire. The local fire department responding to the call suspected arson and started their own forensic investigation, discovering the remains of SCP-1254. The foundation was alerted and took control of the site, administering amnestics to the entire forensic team. The bookstore had already been closed indefinitely for several months due to financial trouble, although none of the books were planned to be moved due to the possibility of a buyout. As a result, SCP-1254's existence went unnoticed until the fire. Addendum 1 Living specimens of SCP-1254-1 were discovered on ██████ during a routine archaeological survey. Researcher Wilkes caught sight of a small group of SCP-1254-1 survivors and managed to record the entire event with its head mounted camera. Seven individuals wearing full nuclear biological chemical gear were witness moving through a destroyed copy of Harry Potter and the Deathly Hallows, possibly scavenging for supplies. The small SCP-1254-1 group then saw researcher Wilkes and fled deeper into the book, breaking visual contact. Site measures and object classification revised, in light of confirmed existence of living SCP-1254-1 specimens. Addendum 2 Maintenance crew responding to a malfunction in the building's air conditioning systems found a miniature aircraft of unknown manufacture attempting to break through one of the filters. The aircraft was captured and taken to the nearest Foundation lab for research. First to contact the crew were met with limited success, as the only response received were several broadcasted radio transmissions that were a mix of screaming and exclamations of broken Latin phrases. Two hours after the aircraft goes silent, permission is granted to forcibly remove the crew for study. Closer examination of cross sections of the aircraft showed the crew having committed mass suicide. Security cameras observed suspicious movement in one of the storage rooms. Remote viewing by drones and cameras showed groups of SCP-1254-1 gathering as much intact paper as possible and depositing it into the storage room. Further surveillance shows SCP-1254-1 attempting to construct a full-size humanoid with the paper being collected. Based on visual analysis, completion of SCP-1254-2 is at roughly 25%. Containment procedures updated in response.


All right, all right, so we finally made it. I want to give a big thanks to my mate Alex who flew over from Europe He roadtripped the ATMs with me in an escalade from San Jose to here The whole time I'm thinking please don't get pulled over please don't get pulled over Two ATMs in the back of an escalade and about six thousand notes of novelty currency What are you boys up to you know, but we made it and got them to the casino so real good The attraction to target ATMs is fairly obvious I mean they're full of cash But for myself is kind of part of a bigger picture and a bigger plan and that's to our explore systems that when compromised Have direct and immediate consequences You know society relies on various proprietary systems where they be ATM machines medical devices Smart meters parking meters or are the computer system in a vehicle? It's important to research these systems Take you that often not designed with a secure methodology as a result of that research We can use that knowledge to design better and safer products in the future So my goal the goal of the talk is to spark discussion on the best ways to remediate and prevent the attacks So I'm going to be demonstrating the goal definitely isn't to give a cookbook recipe on how to hack ATMs You know, I find the process of finding bone release a little bit more interesting Anyway, the journey not the destination although the destination is pretty cool in this and this one And I hope to change the way people look at devices that from the outside are seemingly impenetrable So current attacks the skimmer, which is certainly a fan favorite small overlay that slides over the card slot and the pin pads Manufactured to blend seamlessly with whatever particular ATM. It's manufactured for designed to both capture the track data on the cards as well as the pin numbers and You know technology and some of these is no joke data that gets transmitted over GPS Some even have tamper protection. They wipe themselves and find out and send the remaining data back to the attacker Physical theft and ram raids you may have all seen those YouTube videos or a couple of good old boys He'll through the front window of a store Attach the chain to an ATM and the other end to their pickup truck and take off of it Not the most subtle of attacks, but That's ninja status compared to some of the other ones And we have card trapping and card snooping Card trapping where our someone will insert a small shim commonly known as the Lebanese loop into a slot Traps the card and that design is such a way that when the cards read it will be read But won't be returned to you often combined with shoulder surfing to get your pin or they'll get your pin in our ways It may not be quite as friendly then safeguarding the frontal attacks basically going at the ATM with a pair of pliers and a blowtorch Explosives which is surprisingly popular which I find a bit odd The attack is literally tying a bunch of explosives to an ATM and blowing the crap out of it Now you think blowing up an ATM will be somewhat counterproductive, but this is big in Australia. So you go figure sorry Australians and And data breaches hacking the back end so hacking the bank processor Harvesting the card data an example This would have been the compromise of the Royal Bank of Scotland will pay back end Certainly the safest and was the most technically sophisticated attack that I've seen think about 9 million was stolen during that attack And then I guess we have miscellaneous Other So there would have been the default passcode attack from a couple of years back Where if the operator password was left unchanged on the machines you could reprogram the ATM to think there was a Lower denomination in the machine and there actually was so you know you could program think it's for the $5 notes when it's really full of 20s and I'll be adding some more to the other category Practical attacks, which in my opinion blow John Connors one right out of order So I've picked standalone ATMs and there's a few reason a few reasons for that first off They're pretty easy to get a hold of you know you jump online and like anything on the internet. You just add to cart Getting the ATMs delivered to your house though is actually quite interesting I had the ATM delivery guy literally wheel in one of the ATMs And he came in he's like one after you need an ATM in your house for and And I was feeling a little bit cheeky at the time So I just looked them like I don't like the transaction fees me and he just kind of shook his head and went on his way But also they're everywhere, you know every bar convenience store market and they're often in secluded areas You know they'll be out by the restroom tucked away in corners But I will be discussing attack methods for both standalone and hole in the wall ATMs I will go over walk-up style attacks But then I'll shift focus to a far more important vector and that's the remote attacks and particularly what an attack You can leverage through a successful remote compromise and when I say remote I mean remote default because that's the only way to roll really So just to get an idea of how popular these ATMs are This is just one block on my street from a bit of a pub crawl I Must say my favorite is the guy who owns a Mexican restaurant here holding his bottle of tapatio over the top of the ATM It doesn't exactly look chuffed to be there though, but you know So this is a standard specs of a new model retail style ATM generally Windows CE running an ARM processor New models support both TCP IP and dial up by default Optional wireless when I say wireless I mean our CDMA not 802 11 because you know so no drive by ATM attacks Unfortunately thought it would be kind of cool to ride by and just have ATMs spit out cash Although maybe the grug could possibly do something with this It's a cell support and a triple desk encrypted pin pad So the pin pad performs all the encryption within the device itself has anti tampering mechanisms And I may talk a bit more about that beast a little later So this is a typical ATM internals Bit hard to see but is a receipt printer over to the right a card reader and is a serial interface at least down to the safe Which is wired to the Spencer and there's various motherboard inputs multiple USB SD cards The network connection and some debugging ports on this one. There's actually a cover in there That's protecting the circuit board. I simply just removed it for photo purposes But I guarantee both of these ATMs are completely untouched and completely unmodified Now funny funny enough all the ways that an ATM talk could possibly be disrupted It was actually almost my cat who took it down for me I had a USB keyboard plugged in and he was chasing a moth or something and He ripped out the USB port and then pulled out the process of plugging at the same time But luckily the only damage was the USB plug that was easily sold it back in but anyway bad kitty So in my opinion a presentation shouldn't really view a full-blown technical tutorial So I'll be following up later With a white paper that goes into more technical details, but rather than digging deep into the ins and outs of C internals I thought I'd sum up the security hurdles I faced with this quote We were concerned about protection, but not about security We weren't trying to design an airtight system like Windows NT And this was from Thomas Fenwick who was the creator of the Windows CE kernel And this quote came from a book called Inside Windows CE which is Interviews with the core developers of CE and it's an interesting read on design design approach that was taken But essentially there were not many roadblocks There'll be the technical information. I think lends itself better to a white paper, which I'll be following up with So before we can even think think about giving that dude from Terminator 2 a run for his money and actually start devising attacks The first step is to be able to interface with the ATM and gain access to the file system So once we have access to the file system, we can then pull the executables and be able to do some reverse engineering Now unfortunately when the ATM boots it boots directly to its own proprietary application So there's no explorer shell and we need a shell to be able to make things easier Originally, I suppose naively I thought I could just plug in a keyboard and alt tab But of course that wasn't to be the case But to get a shell we'll need to have explorer execute at boot time So the CE application boot sequence is fairly straight course straight forwards the kernel NKEXE runs falsely It's dot exe falsis sets up the registry and file system and then it executes the applications that listed in the registry key Hklm and that so the trick is to patch the application we want executed into that boot list So of course we want to get explore into the boot list and there's two approaches basically The first approach assumes you have a copy of the CE ROM image The registry file can then be extracted modified to recompile it into the image This requires a way to rewrite the flesh whether it be serial ethernet JTAG or what have you and the other approach is do patch and explore while you're debugging and this of course requires some sort of debugging capability JTAG ethernet 0 etc So I decided to go with JTAG because it's a fairly straightforward way to accomplish our goals JTAG is a hardware debugging interface which essentially gives you unrestricted debugging access to the processor core Now the hardware to do this used to be pretty pricey But these days with open OCD and some of the open source projects you get needed hardware for less than a hundred bucks Now with JTAG access you can remotely debug with GDB to bug the kernel the boot loader and so on now JTAG has been talked about to deaf and I went to Alana and there's a lot of resources online with a lot more information So here's just our hardware the bugger connected to the motherboard now It's probably obvious but the use of hardware the buggers and things of that nature have absolutely nothing to do with the ATM attacks That I'll be demonstrating. I just simply used to initially gain access so we can then go on to find real vulnerabilities but um Speaking of JTAG. I actually learned a valuable lesson when I was missing with one of the ATMs I had the JTAG hooked up and I was screwing around and I accidentally wiped out a massive chunk of the firmware and Overwrote all the ATM files on it now at the time I couldn't get hold of the software to reflash it because I wasn't an ATM distributor So I actually had to call a licensed ATM technician to come around to my house Now three guys arrive and of course they ask again You know why are these ATMs in your house? And I thought I haven't moved them to my store yet and all this type of thing But anyway, see what happened? How did you remove all this? Oh, I had it on a card I was trying to change a splash screen and all just wiped out. He's like, yeah, no, they'll do that. They'll do that and You know any so he starts going to work on the ATM and I'm like firmware. What is that mate?  I mean he ends up teaching me a hell of a lot about hacking ATMs I got his business card. We kept in touch Unfortunately after this presentation that relationship may be severed. Oh, yeah So the lesson is always back up the firmware first So now that we can debug we need a way to inject with the debugger connected simply set a breakpoint on create process And that the offset was found by simply dumping the memory from the ATM and just doing a bike compared to an offline version of core DLL Now when working with the arm processor the parameters when a passive function are passed and registers before they utilize the stack So our zero will have the first parameter, which is the executable what you want to execute We simply replace that string with with what would normally be the ATM executable An override of explorer.exe now if explorer doesn't exist on the image Then you just put a copy of explore on a removable drive and pass that full path to create process and So then you get a shell on the ATM when I first was playing around with the ATMs I was quite excited just to have a little shell on them.  So it will not be replacing the flat screen So now we've explored we can plug in a USB drive and a keyboard and copy off the files for reverse engineering Then we can modify the registry so explorer will always boot Now remote debugging with JTAG over gdb is not the ideal way to debug a windows machine So the next step is to set up a better debugging environment And there's a way to debug windows c applications without having active sync installed And that's to debug with visual studio over ethernet So you simply build an empty project overwrite the local executable with the executable from the device that you want to debug Set it to set the correct tcp settings copy the file over run it under the bugger And you have application debugging with visual studio So now finally we have everything in place to be able to reverse engineer the software to locate vulnerabilities But to also test any software that we create for the ATM So planning an attack, uh, there's a fairly limited attack surface really we have the card reader But assuming we have an overflow or some other string based attack via the card tracks There's a limited amount of characters in a very restricted character set So i'm not going to say it's not possible, but I will say it would be unlikely to be practical or reliable Uh, the keypad another long shot, but maybe there's possible master passwords or backdoors left in by the developers Then the network so any open ports and answering phone line any options for a remote attack And we also have the various inputs on the motherboard itself, but of course this requires access to the motherboard Um, so of course progress has never really made about a few failures along the way And in my attempt to come up with a terminator 2 s-cac I made this little device It's basically an electromagnet wired up to an amp which is connected to a media player And you create a web file which is created to simulate the data on a magnetic stripe Um, the electromagnet plug into the ATM flick the switch play the web file And the ATM will think of magnetic stripes being read technically it works fine, but it was actually bugger all help So the goal of course is to execute code on the ATM So I'll talk about these walk up attacks first Now the cash dispenser is housed at the very least by a safe if you take the cheapest option If you spend a bit more you can get even more heavy-duty protection. The motherboard on the other hand is protected by A one key fits all lock And this is this is actually standard practice across the board And these keys like almost everything else on the internet are easily available to add to cart And uh, funny enough there used to be die ball keys last year when I was looking um, but they've since vanished But I'm sure of a little creativity. They could be found but as you can see most manufacturers Take this approach So the walk up attack so now with your master key you have access to the usb slots and what other inputs So you can pop open the motherboard compartment instead of usb key in a couple of seconds A lot faster than installing a skimmer, right Now even though the attack time here is short There's still the possibility of being detected But you know, I suppose that's a great thing about these retail and standalone type ATMs You know, they're out by the restrooms are out of sight off by the siggy machine or something And I suppose then there's that also select psychological psychological aspect of using an ATM machine It's kind of considered rude to look over someone's shoulder And uh, unless of course you're a criminal and then he would probably learn a trick or two anyway Now all ATMs need a way to upgrade their firmware and this is most often leveraged via their removable drives So the ATM application checks the drive for a valid upgrade But valid firmware is found upgrade and store whatever we decide to add in there Now, of course the firmware is typically a proprietary format. Um, They're checksums encryption And the algorithms are easily figured out by reversing the code on the ATM side So once you can create your own firmware package that adheres to the correct format Well, then you can upgrade but upgrade with a few modifications, of course Now the most important attack is the remote attack Now most if not all ATMs that run on a windows based OS support some form of remote monitoring or remote configuration So this allows you to log into your ATM remotely Review or change the settings get stats change the splash screens and so on Another quite useful feature is the ability to remotely upgrade the software Now this is sometimes a feature but always something you can leverage if you have a vulnerability Now, obviously authentication is required to be able to do anything useful Uh with the particular model I'll be demonstrating both a serial number and a remote password are required And they're both made up of a combination of numbers and letters And a five second delay is forced after each connection attempt. So a brute force is basically other question So we require a vulnerability within the authentication process And just so happens So let me introduce Dillinger Dillinger is my remote ATM attack or administration tool. Whatever way you want to look at it Dillinger named after the bank robber, of course Um, so we've talked we've talked about loading code on a local ATM machine with a master key and a flash drive In the correctly formed firmware, you're basically set But the obvious drawback here is you have to interact with the machine itself So the ultimate win would be able to execute code or load code remotely. And that's where Dillinger comes in Um, so Dillinger takes advantage of a fairly severe vulnerability in the ATM management capability And interestingly although most operators don't use the remote monitoring It's enabled by default on this particular manufacturer. So touching Now typically to log into the machine remotely we require Yeah, the knowledge of the serial number and the password but due to an awesome vulnerability I can bypass all authentication on the device And the remote attack is 100 reliable So Dillinger supports tcpip and it supports dial up as well And I heard through a fairly knowledgeable source that most of these stand-ups uh standalone About approximately 95 of them are still on a dial up connection Now of course back in the day finding an ATM over the phone line would be a long process of nights and nights of war dialing But you know, thanks to tools like hdmore's warvox You can map out modems on exchange in a matter of hours Then write a custom tool to find the ATM responses and you're away So Dillinger features so Dillinger will allow you to manage an unlimited amount of ATMs through its interface Uh, you can add a group say you add a city Under the city you add each individual ATM either its ip address or its phone number Now the heart of the tool of course is the authentication bypass that it exploits And this is the stepping stone to be able to do anything useful So one feature in Dillinger is to be able to test the bypass in a way which confirms the vulnerability But doesn't actually modify the remote ATM in any way or leave any trace So the obvious problem of finding a remote ATM is that you have no idea of the location So Dillinger can pull the ATM settings from the device which includes all the master passwords But it also includes the receipt data and you know when you use an ATM at the bottom of the receipt Always has the location or the name of the business Um, so even if it doesn't have the exact, yeah, it doesn't have the exact location will have the name of the business And of course the best feature is to upload my root kit Again bypasses authentication initializes software uploads Um, the root kit and then basically lets me uh, Overwrite the entire firmware of the device So in general someone is going to need to be at the ATM if you want to get any sort of payout So again, I added a feature so it'd be possible to carry out in the tech without ever visiting the ATM at all So when someone inserts a card the track data is captured and saved and I can then retrieve that track data remotely And find all the remote jackpot which kind of speaks for itself So Scrooge is the ATM root kit Um developed specifically for ATMs running on Windows CE Scrooge implements the typical root root kit technology to expect hides itself and its friends by various CE system hooks Hides itself from the process list hides itself from the file system by hooking syscalls and filtering the results And there's a hidden pop-up menu which can be activated by both a special key sequence on the ATM Or by inserting a card with custom track data Now it'll run on any arm or X scale based ATM until with a few tweaks Originally I was designing for both Intel and ARM, but it turns out that CE on x86 is actually pretty rare and basically non-existent in the ATM world So the code for interfacing the ATMs has to be customized for the different ATMs As they all use different peripherals and kind of non-standard ways of communicating So Scrooge is hidden menu. I just use a standard set windows hook filter to capture the side buttons on the ATM Although set windows hook is actually undocumented in CE it still exists and it works as expected So a combination of keys will trigger the hidden menu and it's varied enough not to be launched by accident But maybe if there's a kid playing around with the ATME may end up scoring big units And the card reader is hooked by an inline detour style patch So this is where you essentially patch a branch instruction into a piece of code You like to intercept the branch jumps to your code your code executes then returns to your original function Now with the hook in place is a check on the read buffer for track data that matches gimme the loot And if it matches the menu is brought up in that way as well So the menu functions are fairly standard for what you'd expect you can dispense from each cassette to print out stats Which include the remaining bill count and you can exit So yeah to add my own functionality. I've added a few inline patches Essentially you can patch a smaller sembler stub into the functions you want to hook The stub then calls a function external DLL Overwrites any overwritten instructions and then continues as normal. This could be done dynamically But the fact that the ATME vulnerabilities allow me to replace the executables entirely We can make these patches permanent which is actually far more reliable And it's also a lot easier on arm as every instruction is 32 bits long as well So I place hooks at the card reader the pin pad and the parser that handles remote configuration plans So with those hooks I can now add my own handy features So I can save the track data capture the pin pad have a few custom remote commands So pull the track data sure remote jackpot might as well All right, so there's going to be quite a lot of demos So I went through that a bit quick because I think it's probably 25 or so minutes of demos So I may as well put my money where my mouth is or the ATMs money where it's mouth is I guess Okay, so this is our Dillinger's interface We can add a group so we'll say black hat add an ATM Barnaby's ATM Location on stage air black it and Dillinger supports both dial up and TCP IP So in this case, I'm using TCP IP of course By the way, just to reiterate this is by default Um Remote functionality is enabled on all of these ATMs as they ship out This one here at least not the other one Okay So now I can right click on my ATM. I can then test the bypass upload the root kit Reset to default get the track settings get ATM settings, etc So, uh, let's see. I'm trying to think if we should switch to the ATM You know not not just yeah, okay, so I can test the bypass connects to the ATM Testing ATM authentication bypass success and it disconnects Now we'll actually blow up the ATMs in a sec, but All that shows on the ATMs is just rms process I have to wait till that it goes away So it's nothing too noticeable, you know, if you're if you see this ATM Actually, if someone close to the thinker, let me know when it's uh, it's gone. Okay So now, um, most important feature of course is to upload the root kit So we'll upload scrooge the final version connects Sends a bypass successful Initiates upload and it's uploading it to the ATM now This is bypassing all authentication in the ATM and by default Now even though it's over the network, it takes a little while because they have their own proprietary protocol Which acknowledges each packet and then it has a small delay and so on Um proprietary protocol of course has its own proprietary encryption And you all know what happens when people implement proprietary encryption It's it's fairly easy to make your own Okay, so when it finishes uploading the ATM should reboot and if we could uh flick to the ATM now on the screen It takes a little while window see, you know, it's not the not the fastest beast out there Yeah, if we could just pan out just a bit too If we could get the screen and the dispenser Yeah, that's cool What's that? Oh, that'll be spitting money, mate. Don't worry about that Okay Let me make sure I have my little card here So as I said, there's two ways To input to get the remote menu to or the hidden menu to pop up One is with a special card with the track data. So if we insert Okay I always say it's 100 reliable and why doesn't it work? There we go. Okay. So that card now has popped up my hidden menu Um, you can dispense 50 bills from abc or d which are the four cassettes in the dispenser You can print statistics which give you the master passwords and so on or you can exit So I'll just uh dispense 50 from The first cassette So these um, these are million dollar bills, but it will Probably not much use at the craps table The other the other one will spit out a bit better currency Okay, so now we can exit and I said there was a a key sequence which you could also enter to pop up their menu These buttons were a bit bugged Let's try that again I've obviously pressed these buttons a fair few times. There we go. So we can exit from that too Okay, so can we cut back to the computer? Okay, and um It'd be nice to know where this atm actually is as well. So we can retrieve the atm settings Connects achieves the settings And saves them to disk Now you can see um, so up here are the passwords to the atm itself Um, I don't actually live on 123 Kiwi street, by the way But I do live in San Jose and then it has the uh phone numbers as well as the ip addresses And the receipt coupons and all that type of thing now, um of course the One of the greatest things about this is The fact that you can retrieve track data from people who insert cards. So would anyone like to volunteer? Is brandon here? There he is brandon. I think has a custom credit card, especially for this So can we flick to the atm again, please? Can we cross to the atm? Okay, so just insert your card as you normally would use an atm All right, thank you sir So back to the computer, please So now let's see if we can get the track data that he just inserted connects Retrieves the stripe card data Saves it to disk Okay, so you can actually see from um, the first one was the gimme the loot where I was actually had My demo card and then the next track data. This doesn't look like a credit card brandon Dr. Raid of the Buster Cardi with the card leak leak leak leak leak leak leak leak leak But of course, uh, it will capture any credit card that's entered into the machine and Finally, um the remote jackpot, which is always handy. So go back to the atm issue the jackpot command We have a winner Now before I um, I'm not going to let the other one get off scot-free So I will quickly demo the walkup style attack. Now. I'm not as fast as this as I should be but I will try it anyway So remember the walkup attack is simply popping open the cabinet inserting a usb and restarting it so Right, so that's the attack done. I wouldn't be spotted if I was out by the restroom um, I think just for Just to make it look a little better on stage. I might just open the cabinet here not opening the safe Of course, it's the cabinet So the other attack was somewhat practical this one. Um, you'd probably end up on world's dumbest criminals As you'll probably see soon Okay, so it boots right now. It should be reading the firmware off that usb drive Uh copies of firmware over As it initializes the little black hat logo floating around the screen Obviously in the real world, it would be a root kit not a black hat logo But so I kind of tailored this for both black and for vegas as you'll see Um nine processes and not the fastest I just want to see how long it actually takes to dump its entire dispenser It will start with million dollar bills and it's going to switch to IO active currency Which also doubles as invites for the party. So I want there to be a big pile at the end It still hasn't got to the IO active currency. I should have put that first, I guess There we go Okay, we cannot probably flick back to the presentation now Okay, so countermeasures Uh the obvious physical I may just disconnect the sounds really quick Uh, so the obvious physical countermeasure to prevent the walk-up attack is to offer upgrade options on the locks themselves Uh, so there's a unique key for each ATM Now, of course, if you want to take this into your own hands, just drill a hole and throw a padlock on it Um, if a trusted environment was set up that only allowed signed executables to be run that would prevent the original attack And although it wouldn't have prevented the actual attack vector of the remote attack It would have added a barrier to executing executing rogue executables Now, unfortunately in windows c5 and implementing the trust environment isn't as straightforward as it should be Code has to be introduced into the build and I think the option to implement secure environment should be a lot easier But what you can do right now to prevent the remote attack is to disable rms on the device There's a high chance that you're not actually using the the features So disable it that can be done from the operator menu And finally it's time to give these devices a rehaul There hasn't been a secure development in methodology in from the get-go Those who need to play catch up have the code ordered have penetration tests and implement best practices from here on out Um, so there's been a noticeable surge in the community of researching proprietary devices like atms And the simple fact is that the companies who manufacture devices aren't microsoft, right? They haven't had 10 years of continual attacks against them So their software that like the software that microsoft got forced into a secure development They've gotten where they are today We're talking about devices that were developed without secure principles in mind I think it's important to dig in research these devices find vulnerabilities find solutions And ultimately ensure a more secure future. So cheers