So, um, without further ado, uh, we have, uh, Steven Hooper and, uh, Philip Rish-Rush-Rush-Gosh. Okay, yeah, yeah. And, uh, please give him a warm welcome. Okay. So, hello to our talk about, um, OSOIP configuration interface security. My name is, um, Stefan. I'm a security researcher at the Fraunhofer Institute for Secure Information Technology. And I'm working there as a researcher for studying and dynamic code analysis. And, um, during my spare time, I'm working on IoT stuff. And with this talk, we want to share our new knowledge or experiences. I'm also one of the founder of, um, Hacking Team. It's called Team Sick. And it's a small hacking group, um, from Fraunhofer. So, Philip. Thank you, Stefan. Hello, my name is Philip. I'm also working at the Fraunhofer SIT in the Secure Software Engineering Department. And my main focus, my main, my main re- focus research is static code analysis and IoT vulnerability detection. And I'm also a member of Team Sick. First of all, some acknowledgement to Alexander Traut, Michael Dröger and Andreas Wittmann, who supported us within this project. Um, a short announcement. We, we brought some beer as we're from Germany and it's not the first time for us. And we always brought beer. And if you have some questions or want to talk to us, you're welcome to join us after the talk. So, in recent years we had several projects, um, which we also presented here at DEF CON. You, you might check it out on our web page. And after the last year, year at DEF CON, we, we wondered how do we get here this year again? And we were thinking about a topic or a, a research subject with a wide distribution, a complex software and which is readily, readily accessible because if you find bugs and nobody can exploit it, nobody cares about it. And we came up with voice over IP phones. So, the distribution, I mean it's in every office, on every desk, in every business. So the distribution is covered. On all of these phones runs a web server for management and configuration purposes, which is complex enough to build in bugs. And so this point is also covered. And the last point is the accessibility. I think in, in your business, the network is configured well and the voice phones are in a separate network and not accessible by any, any other participants of the network. And of course it's not accessible over the internet. But if you're familiar with, with how some, some companies handle their, their network, you, you might know this state where the everything is put in one network and the guests, the, the regular users and sometimes also the people from the internet can access all of the devices. So the third point is also covered. These phones are accessible from, from a lot of people and also from a lot of attackers. So this talk is structured as follows. I will give some short background about these phones. Then give an IoT hacking one-on-one to, to show you how we find our bugs. And then I will present all the, some findings. And in the end I will conclude the talk. Starting with the background. Each of those phones runs a, or has a ARM or MIPS CPU inside and on top of it runs a Linux. There you have some, the basic internet process, some watchdogs, the SIP even for, for the actual voice communication and then finally the web server which is used to configure all of this. And this web server is now, today our tech target. The methodology. We were, when figuring out these bugs we, we first set up the web phones as regular user or admin would do. So the web server is running. Afterwards we attach a HTTP proxy and just clicking around and see if we find some bugs in the, by, by just observing the traffic. If we don't find anything more there we extract the firmware to, to perform some static analysis for, for instance some secrets or, or some, some scripts which we can easily exploit. In the end for, for developing real exploits and emulation comes in handy and other dynamic analysis tools which, which are, are good for finding the real, the, the real interesting vulnerabilities. There's one exception. When, when you're lucky you find a way of injecting dynamic analysis tools directly on the phone you, so you save the step of emulation. Here are, here is an overview about some tools we used. You can check it out later in the, when the slides are online and I won't go through them in detail here. So the first step what you wanna do after you did the, the web pen testing you wanna grab the firmware. And this firmware access is not always this easy. Um, first of all it's out of scope for us to desolder chips and induce complex and expensive hardware setups because we are software people we, if we need to do this we, we skip to another phone. So what we, did we do? First we check the website of the vendor or the manufacturer to see whether we can download the complete firmware image from there. Some, when you're lucky you're done there. Sometimes you only get a diff or some patches to the base image already running on the phone or it's encrypted and you cannot do something with the app, update package from the website. Then another way is to, to trigger the update from the phone if this function is available and if you capture the traffic you might be, might be happy or lucky and you can, can get the firmware from there. But what we did most, most of the time was getting the firmware directly from the device because it's located there and so you can, can grab it from there. We used some, some cheap hardware adapters like the jeteculator or the bus pirate to connect that directly to the chips. And this for instance can be done as, as I show you here. If you find a chip on the device you may check the data sheet of this chip and see which parts or, or pins are provided. And if you find for instance the SPI interface you can connect the bus pirate to it which looks like this on the Akuvox and then you can directly read from the chip over the interface by using several tools. Here's an example with the flash rom tool which we used to dump the firmware. After dumping the firmware you can, can analyze as you wish for instance with binwalk to extract all the data. As you see on the bottom this is not the most stable connection as every output produces, every dump produces a different output but in the end it did the job pretty well for us. Another way is the UART interface. If you find a UART connection on the, on the phone you may connect the jeteculator as you see here in the picture and then you can see what happens. Sometimes you get connect, get access to the boot loader which has a minimum command set available and if you're lucky you can dump the flash memory from there with the dump command. This command is not always available but when you're lucky you, you get the firmware from there. But if you're more lucky you get directly into a root shell and have access to all the data on the chip with this root shell. The third way is a vulnerability inside the, the web interface. For instance if you find a command injection you may start a telnet daemon which allows you a connection to the, to the phone over with telnet and as it's not intended to run sometimes there's no authentication and you get a root, root shell directly and then you can dump the, the data. As the software on, on site the web phones is limited and not made for dumping all the stuff you need sometimes some tricks to get data on the phone for instance additional tools or you need some tricks to get data off the phone after you, you found what's, what's useful or what you want to investigate further. Here's an overview about some commands we used. You can check it out in the slides later. We won't go into detail here. The last step of the hacking 101 is the emulation. Once you got the firmware you, you want to run it in a, in an emulator to find the real interesting vulnerabilities and for doing this there are multiple ways. We focused on system mode emulation which looks like this. We getting a, a quimo emulator with the ARM or MIPS architecture and putting a respion on top of it. Inside the respion we put a CH root environment with all the data from the firmware we, we need to run up the web server and afterwards we attach our dynamic analysis tools for instance a GDB server or GDB directly or S trace in order to analyze the web server. Almost all the time you need to patch the binaries you execute as they are looking for some specific hardware interfaces which are only available on the, on the phone but not on your emulator. You can do this in multiple ways like hooking or, or patching with GDB. You need to be a little bit. There are multiple ways of doing it. Now the fun part. I will go through some findings and starting with the denial of service. If you imagine these phones are located in critical infrastructures or hospitals and the denial of service can cause pretty heavy damage or can, can cause lives. So denial of service is a, is an attack you want to avoid. So the first thing we, we found is by, by NMAP scanning the METAL phone you, you can cause the denial of service for around half an hour. So the, the hardware is so cheap and so limited that NMAP scan for a few seconds is enough to cause the denial of service.  A little bit more interesting is, is this request at the Cisco phone. Can anybody guess what's the problem here? Right, it's the double quote in the GET request which leads to an assertion fail and causes the phone to reboot. This, this denies the service for around five minutes but then you can resend the, the request again and the phone is down forever. Whether this is good or bad, error handling everybody can decide on its own. As, I mean you avoid harder damage like remote code execution but yeah it's a denial of service attack. Afterwards we looked some known vulnerabilities like a CVE from 2017 which causes out of bound reads in the open SSL library which is used for the HTTPS connection for the web interface and we found four phones which were vulnerable to this and, and some cases the phone reboots and other cases just the web server crashes. But in any case you should update your, your libraries, your third party libraries to save you trouble in this, in this area. So another nice category is the bad crypto stuff. It's I think always present in every talk of us. Starting with the AcuWorks. And within, within this phone you, you can, can export all your, your configuration setting including the zip credentials and the credentials for the, for the web interface. And they claim it's encrypted as you see here it's not plain text but is it really encrypted. First thing we did is like checking whether it's basically phone coded which it isn't. So maybe it's really encrypted. So we investigated further and extracted the firmware and found the implementation for, for the decryption of these, these credentials and we, we, we found a phone AES decrypt method and we were thinking of our crypto lectures and we were able or we were curious about auditing the AES encryption from them but it turns out it's a self implemented crypto. It's a simple substitution and it's no AES at all. And so maybe we can break this, this crypto but it turns out you don't need to break the crypto. You get the key for free because it's provided in the firmware image and so it's not a secret. So coming to the classic web attacks. A classic the XSS. I mean by adding my favorite contact name into the audio codes. I get this. Just for completeness I mean we found it on several phones. Um yeah input sanitization is a thing. Keep doing it. Far more interesting is the Giga set Maxwell basic where we found two interesting vulnerabilities. First of all an information leakage by looking at the traffic. When, when asking this endpoint it, it returns two different messages. And what does it actually means? An attacker can ask the phone whether the admin is currently locked in or not. I mean that's not nice but it's not that bad right? Um I mean we just know that the admin is locked in but it's not, as it's not state of the art. We dig a little bit deeper and found the implement, implementation for, for this. Inside this snippet. Um I will explain it in detail here. Normally the admin locks in a session token is generated and stored for the, inside the database to check the further request from the admin whether he knows the session token. If an, if an attacker asks the phone something he does not know the session token so he sends an invalid token. And what the phone does right here is, is checks whether the currently locked in user is equal to user admin and whether the token uh which is provided is equal to the token stored in the database and then it tells you that the admin is locked in which is somehow weird because why would you tell somebody with an invalid token that the admin is locked in. So we dig a little bit deeper. We extracted the firmware as you might have guessed already it's a PHP, PHP implementation so you can read the implementation pretty well. And we find, found how the session or the authorization process is handled. For every request you provide a, a session token and then it, it checks whether a user ID is behind the session token. And if the session token is greater than zero you are allowed to do whatever you want to do. This is not nice but it's somehow okay. So we dig a little bit more deeper and found the following. The post parameters function is um used for, for setting all the uh several settings. And one of the settings is the admin password. So better secure this method. It, it starts as the last method um it checks whether a user ID is behind the session token you send. And it provides zero if the session token is invalid. And then it sets the, the para, all the settings you want to give. So changing the password is possible for nearly everybody. Except the, the admin needs to be locked in as this post parameters function is only, only executed when a user is locked in. And this I will show you in a demo. So on the left top you see the victim. And on the bottom you see the, the script from the attacker which just checks whether the admin is locked in with our first vulnerability. And then if it's locked in it sends the, the, the request for, for changing the, the password. Now the script is running and it sees the admin is not locked in. Now the admin locks in with this three digit password. And the script realizes that somebody locked in. And he directly changes the password. On top you will see that the admin is the real admin by, you see it right now. Interesting is also that when changing the password you don't need to know the old password. And now the admin locks out and the newly set password is 1, 2, 3, 4, 5, 6. And the attacker can, can lock in. And you see that, and the change password interface you see is the admin. So that's, was it from my side? Now Stefan will continue with the rest of the findings. Okay, thank you Philip. So at first a short introduction about past traversal who is not aware about this attack form. So imagine you have the web server and the web server can provide or the web application can provide some files or can write files by uploading. And for this file handling in a request the file name is send it to the application. Now imagine you as an attacker change the file name and for instance prepend some relative path information. If the web application does not verify this information or escaping or sanitizing it, it would be able for an attacker to escape from the default web server folder and can get access to, to different um, folder on the system. Such type of vulnerability we found on the YELLINK device so we can see here when we provide a few um, relative path information and the ETC shadow file to the file parameter. The device responds with the hashes of the, um, of the root user. This is possible because of two reasons. The first one, um, the input value is not verified and the second reason is the web service is running as, as root. As we saw the most, we'll see the most web services are running on root on our phones. But this is not enough currently we can just read. What we want to reach is now somehow get remote code execution. So we have to, to upload files. Um, one feature on the devices for uploading files is the ringtone upload. So our idea was now to, to use or override some script which is um, oh you don't see the full text. Sorry. Don't know why. Um, the, the idea is now to, to override some, some scripting file which will start at reboot and the scripting file contents then our code we want to execute. But the problem was um, the, the upload feature um, the upload or the overriding of the script file failed because the, uh, the application verifies the, the file content and says okay this is not a script file you have to upload some audio file and that's why overriding of the start script failed. But um, when we analyzed the software we saw that the um, application just verifies a few bytes of the file header. What we did is we take a few bytes of the file header, prepended it to our script file and then we were able to upload our file. Um, when the file is executed or the script is executed of course the first three lines are um, recognized as an error. But uh, the operating system still continues and our script um, will be executed. And so with this way we get um, file access and could execute arbitrary code again as root on this device. Then we were scanning or looking for some kind of back doors on the phones. We scanned the aqua box device and so okay there's a tenet port open. So um, the first question was is it running by default? Can we turn it off or why is it running? Uh, we don't know why it's running but you cannot turn it off. There's no configuration on the web interface, nothing. So this thing is running by default. The other thing is now to get somehow excess we need um, the password. Um, the firmware image of this device is not public available. We, we looked in different forums or on the, on the website. It's a Linux image but it's not um, public available. But as Philipp already explained we get some image dump via SPA. And when we extracted the file system here you can see these are the password hashes. And when you're a bit aware of password hashes you will realize this is a DS script protection and the problem of DS script is the maximum password length is eight. I have an old GPU on my um, office computer around four or five years and it took me 30 days to crack it. So you can imagine if you have a new or more modern device you can crack this in a few days. And when you know the root password or the admin password you can log into this device by design. Common injections. Another type of vulnerability. We found this type of vulnerability on seven or eight different phones. Um, at first a short explanation how it's working. Um, few, few of the, um, or the most phones providing their web interface some, some diagnostic tools where we can for instance um, ping or enter an IP address and then the phone will ping the IP address in the network. This should verify that the device is, is connected and working. So we enter the IP address. The IP address is forwarded to the web application and the web application constructs a command and this command then is forwarded to the libc system function and the function is executing our command. So here you see our ping. So what will now happen if you for instance append additional commands with a semi column and there is no sanitation. You can see um, the input is forwarded again to our application. Combined to one command and executed. So here you will see at first we will do zero pings because the minus C zero says zero pings. Then with the semi colon the command is finished. Then we execute a LS and the rest is commented out um, and so not executed anymore. So this is the idea of common injection. We found a lot of this type of vulnerability on the devices. We will just explain one here uh, of our findings. So we had an audio codex device and there we can um, can execute the telnet daemon again via common injection and then try to get some access via telnet. The problem here is you can see you need a basic authentication. So when you don't know as an attacker the credentials this can be a problem and later we will show a few information from our study and the most devices you can try the old admin admin and it works. But this is not um, the intention of the attack. We also tried somehow to bypass the authorization but um, we failed. So we searched another way to get somehow access to the device. And what we saw is um, there is also a change password, change password feature on the phone. Here you see the, the request and what you see is um, yeah, you see nothing. The first thing is there's no authorization header here. So this means everybody can trigger this request to change the password. But then you can argue okay, the attacker still has to know the old password. But same story, you see we have a parameter uh, an admin, admin, this is our user. Then we have the new password and we have to verify the new password. This means that you don't have to know the old password. So now as an attacker you can change the password of every user and we also have a common injection where we have to know the password. So when we combine this, you can say everybody can change a password and you can trigger remote code. We will show this in a short demo. So here, you will now see the original admin. He's logging in. To verify his, the original admin password you see here. It's from the um, authorization request. It's base 64 encoded and you see the original admin password is super pass. So now we log out. Here you see now our attacker script. And the attacker script will at first change this password super pass to pass. And in the second step, it will execute our common injection with the new set password. We'll show that the new password pass looks base 64 encoded in this way. And you see this is matching on our request. Yeah. It's not finished yet. Give me a second. So now we try to trigger our exploit, um, uh, on the device. But at first, um, to where we have to verify it, you see there's no tenet running. So there's no tenet service. So then we execute the exploit. So password changing. The ping. Log in. Admin. Password is pass. And again, we get a root shell because the service is running again as root. Okay. Thank you.   We found on different devices, buff overflows. Um, in our abstract, we announced some arm based. But um, we also have MIPS devices. And MIPS is a bit, uh, is more rare. So we decided to explain the MIPS attack. Here you see one of the buff overflows. I have to mention this is not a pre alt overflow. You have to know or you have to be at least, um, user. But then you can use the buffer overflow to, um, escalate your privileges and get root. Um, by the way, this, um, bug or vulnerability is not fixed. Um, here you see to change again the password. There is a set security password command. And the internal code you see on the one side we have a target buffer with 32 bytes. And our input is forwarded as a parameter and used in a copy to common string function. You can imagine sounds like already like some string copy. And when we look into this implementation of the common string function you see this is a simple while loop just writing each character into our buffer. And the loop only stops on a bracket or on the null value. So it's, it's a buffer overflow. You find it in each, um, don't know college textbook. And, um, here you see a excerpt of the GDB of the debugging. You see we can control two registers. The most important is the return address. So we can control the program counter, jump to our code. And I will explain a bit more now how we get the final exploit. So one challenge when you try to exploit such a device is how do you bypass mitigations like NX, ALS, and so on. This was very easy. There is no mitigation. Then we were a bit lazy and at first decided, okay, we don't want to write, uh, MIPS shell code by hand because I'm not a MIPS guy. It would be too hard. So we auto-generated our shell code. The next step is we have to find, uh, the, the stack address on, on ARM exploitation. You simply make or use the branch to stack pointer gadget or on x86 you make a jump to ESP. Best of my knowledge that there is not such a, uh, gadget in, in MIPS. So we have to build it, uh, or simulate by, uh, other gadgets and we found two useful gadgets. The first one, simply use an ad operation to write the stack pointer to, to address ANO. Then we jump to our second gadget. This moves the ANO to T9 and then we can jump to T9 where our address of the stack pointer plus 32 byte offset. So, so, um, with this two gadgets we simply find our stack. Whereas shell code will be. We also have somehow to handle the bad characters. This means, um, when our shell code contains this type of correct characters it will not be written completely to the stack. So we have to somehow encode or obfuscate them. So for this we use, um, simply XOR encryption or encoding. Um, we took this idea from a good paper. It's from Jung Yang from Vintage Point. He wrote a very good white paper about MIPS exploitation. So if you're working in this field it's worth to read it. And with all this we can now design our final exploit. You see the payload structure. We have a few bytes padding. Our two gadgets, the decoder and then our shell code. But there's another challenge, especially on MIPS and sometimes on ARM. So here you can see this would be our stack layout. You see the decoder and our instructions. Here you see to, to add operations which should be just an example for our shell code. So now our decoder will modify the, the code in memory. But on the most MIPS CPU you have different types of, of caching. The one side you have the data cache and you have the instruction cache. And when you modify the, um, code in the memory the data cache is modified but the instruction cache not. And when you try to execute the code the instruction cache is executed but not the data cache. So our modification is not triggered and our shell code failed. So we get back and tried to, to fix the problem. There are two recommendations. On the one side there's a clear cache function but we did not find any gadgets in, on our device. Another option is, um, to use the sleep function to, to trigger a cache flush. We also tried this but after a few days we still failed. I don't know the reason but then we decided okay, back, um, two routes and we decided simply to write our shell code by hand and try to avoid null bytes or other bad characters. I want to give a few hints or, or what you can do to, um, avoid this. Here for instance you see, uh, instruction, uh, load immediate instruction to write a constant value to a register and some MIPS instruction have by designed, uh, a null byte included. So you can simply split it up, use some negative value, inverting and so on and play around and then you will get also your final result and this is null byte free. For setting zero values, classic tricks, some x, some xor function, xor two registers and in your target register you get your null and this instruction is also null byte free. It's sometimes, uh, especially when you need strings or other characters it can get a bit complicated but there we also used the xoring. This means we took our string value, um, xord it already with a constant value, put this as, as our baseline and then we can, um, xord it again during runtime and then during the runtime we have again our string and so we can bypass the decoding thing and the, um, shadow cache problem. After that we put everything in an assembler. In this case it was a good online assembler. We got our big ending assembly and can put this in our exploit script. Here we'll show a short demo. So in the lower window you will see our reverse shell listening. In the upper window this will execute our attack script. You see okay, our target device is online. Here you see the script. It's written in bash. Here you can see in the upper side our padding, our two gadgets and then, um, our handcrafted reverse shell. We will put this code, um, also online. So I think in the video it's hard to see but we also have written some advisory containing the code. You see again our exploit is executed. We are on the device. You see it in the lower window. We have access to the pass video and so on. We are again root because we already know all web services are running as root. Okay. Here you see a small overview of the devices we analyzed. Um, we had a lot of findings. The most critical findings we also announced CVEs for the minor findings. Uh, we did not. So this is so a few just for completeness. Below you find a link where we all uploaded all advisories we sent to the manufacturer. They also contain our exploit scripts and everything. So if you're interested you can read it. Here is again the overview of the vulnerability and the devices. As we can see, we found a lot of common injections, path traversal, a few buff overflows. Sometimes also a few classic, um, web based attacks. Um, when you look at short session ID we had one web server which is generating a session ID with the length of three characters. So we can say this session is very short. We also were curious, um, how, how much devices or phones are out there but you will not get any, any numbers from the manufacturer. And as, as Philip already explained normally this devices should not be reachable from outside. It's more a problem from, from an attacker from the inside. But we still made a short short scan and here you see the top four, um, devices and you see nearly over 10,000 devices were still reachable or this web interface reachable. We also made a few, um, sample tests if they use default credentials and we found also devices with default credentials. So, uh, you should take care about this problem because this can be an entry point to your company network when someone abuses or, or attacks the, the published or, or leak device.  I think the most are aware of this. You don't use default credentials. Keep the firmware update. Uh, you don't need a telnet server on a, on a, on a web phone. Even if you have a web server try to isolate it. Um, there are a few phones where we can also disable it. When you don't need it, disable it. And also we already mentioned network protection. Try to isolate your, your web network. Also for developers there are features called R, R, SLR, NX. Activate the compiler flex. Um, no hard coded keys. And also when you implement updates what we saw is there's just a manual update mechanism. So implement some auto update. It would be helpful. So this is now the end of the technical part. So at the end of more, more summary. Um, and I think the most already asked you, um, or wondered why we have such, um, back to the future images in it. The last part of the documentation we will make a short, um, time travel to a few, um, historical IT moments. You will see why. So when we go back to 92 or 91, everybody knows Linux was, uh, released. And from the concept we have a multi-user system. We have process isolation. So it was a good idea and a good baseline. So 96 then someone realized, okay, there are some bad C functions. We have a problem. We must do something. So different mitigations were introduced. NX protection, SLR. Now we also have control flow, integrity, relog and so on. So you can say from this time you have a good, um, desktop PC, PC. I think of course it's not bulletproof. You still can exploit it. But it, it was harder to attack. Then when we now will go to the year 2007, we get new, um, generation of devices. Everybody knows there are smartphones now. And what we see when the devices were released, again, everything was running as route with one user. Okay, we realized this is not such a good idea. What have we done? 2007, we introduced again mitigation techniques. So we missed our chance to, to produce, uh, new designs or protection mechanisms. Now we arrived today or the last two, three years. We are now in the time where IoT is in the focus. And when you listen or, uh, saw our vulnerabilities or read in the news, where are we? The state of 92. So in our opinion, something went wrong. And so you have to think when you use your web phone on the desk, in some cases, you're using technology which is on the security state from 28 years before now. Of course, we made responsible disclosure, we informed all vendors about our findings. We gave them 90 days or more to fix the bug. But sometimes also responsible disclosure can be a hard term journey. Um, here you see a few, uh, reaction. I have to mention, of course, most cooperated and also tried to fix the problem. But the first reaction sometimes were, why are you as investigating our poor phones? What should you say? Yeah, because we can. Um, sometimes they just argue, yeah, the device is not supported anymore. This is not our problem. Uh, I would say, yeah, it's your problem because your customers still, still use it. And sometimes you just have to, to argue. For instance, um, explain that you will publish all your findings on DEF CON and a thousand of people will listen and suddenly everything goes a bit faster. Um, I already mentioned that the bug overflow was not fixed. We had two vendors which did not react to our announcement. One was, um, HTAC. The other was Acubox. Um, we tried to contact them via email, via support, via Twitter, via Facebook, via LinkedIn. Um, the only thing we did not was going to China. But, um, if someone is here from the company, he can, can contact us. Um, we'll give him more details. Um, at the end, um, we had different, uh, we had 32 types of different phones. All in all we found 40 vulnerabilities. The most critical, we registered CVs so you can, can look it up. We realized during the pro, um, during the project, there's a lot of old technology out there. But on the other side, um, especially when you look at the newer models or at the premium flagship, Piper, whatever, super phones, you see there's a change. There are newer phones that are running, for instance, with Android, which can be good because you have, um, process isolation, sandbox, as Elinux, um, by design, which makes it, uh, more secure. But on the other side, you have now the feature to install apps. So when you install on your, on your desk phone some apps, you, you can, um, how can I say, you can bring in new, uh, attack or vulnerabilities, um, in the, um, installed, um, apps. And the question is now, do you really need a web browser or, um, WhatsApp on your web phone? So I think this is the end of our journey. Um, so as Philipp already announced, if you have some questions or want to talk to us, come to the front, grab some beer. If you have no question, just thirsty, also grab a beer. We brought them from, from Germany. It's good, uh, Munich beer. And so I can only say thank you for your attention. Here you see our contact address.


M-zines have emerged as potential antimicrobial materials. Here, the authors report on the creation of a Skoky junction to increase the charge separation between M-zines and semiconductor to increase photodynamic creation of reactive oxygen species under near-infrared irradiation for antibacterial purposes. This article was authored by Jin Fang Li, Zhao Yang Li, Xiao Mei Liu, and others.


Blood glucose monitoring is considered the gold standard for diabetes diagnostics and self-monitoring. Human serums such as saliva, sweat, breath, urine and tears contain traces of glucose and are easily accessible. Nanotechnology based sensors are optimal for testing the amount of glucose in serums other than blood thanks to their enhanced sensitivity and selectivity ranges, in addition to their size and compatibility with electronic circuitry. This article was authored by Prashant Makram, Don Owens, and Juana Saros.


Did they uh when you went to the point package are you on you on a vlog right now when you want to uh The camera right now. Anyway, when you went Yeah Absolutely not did any of the other four drivers waiting to get their items their orders have a red bag in their hand. Absolutely not So he only told me to get bring my bag out. I don't know what's going on with the point package I was with your little suspect now It's diddy cano back today with another door dance video huge shout out to everybody too And if you are subscribed make sure you smash that subscribe button give me a thumbs up and do not skip those ads Say it's april 2nd and we already been getting to this bag We already got order number one and we got it done order number one is mariano's 22 items 3.2 miles for 17 40 shorty I hope you guys enjoyed the video Also This is week two If you want to win the merch all you have to do is email me at roams house of views at gmail.com Send me a picture showing you subscribe to the channel and you will enter a chance to win So you can get it in I hope you guys enjoyed the video make sure you spend that subscribe button Make sure you give me a thumbs up and do not skip those ads happy saturday. Let's get to this bag. Let's go Order two three and four. We are here running up this door order number two is always sparked up 6.2 miles sam's cuff for 1712, you know, we go for fail order number three baby Denny's for these pennies six items point eight miles for 675 stay alive. Let's drive and order number four We're about to run up this door walmart two orders 24 items 3.8 miles for 12 dollars. We are hot. Let's go We are here at denny's to get these pennies, baby. Hopefully got us together so we can get this cheddar Hello, I have a pick up for david g We're working on your shakes here in a little bit. Okay. All right. Thank you Here we go here. All right. Thank you you guys have a great day You Yes, ma'am We are here to save big money. I'm a nark literally like in the same parking lot, baby We better get this money like it ain't funny Hello I have a delivery for david g Thank you. There you go. Thank you. You have a great day Guys, no, I have no idea how state video is going to go. I don't know We do have to show a house at 8 45 and I have to get my taxes done at 11 o'clock So I don't know what's going to happen. Either way go. We ain't capping. We ain't rapping. We about to snap it I hope you guys enjoyed the video make she smash subscribe But make she give me a thumbs up and do not skip those ads. We about to continue to get to this bag. Let's go Order number one. Let's get it done. Actually, it's cool. So these are duplexes Look like a door right in the door right here. They got some priscilla here. We about to look them up and see I must they wrong for them joints Guess what? I need to knock Step back hit them with the photo. You already know to smack with the photo Let's go Guess what that first order guess how much they paid us four funky dollars They out of pocket like a pistol in a robbery. Let's go. We are here to jump on order number two What did you do dark working in me, baby? It's hot That bubbly sparkling water they can drink good Bam bam, thank you, man step back hit him with that photo Let's go All right, thank you. Have a great day Let's go Order five to six. We in the mix or number five is all the way sparked up to order 7.2 miles for 17 74 we about to get this though. You already know order number six is starbucks 3.1 miles for seven dollars. We are Hello, I have a pickup for ashley k All right, thank you. Have a great one This starbucks is we about to get these books like we from a walkie baby Drop it like it's hot said do not ring the door. We'll take the photo We're gonna That we're here to drop off order number one. We about to get it done baby Had to walk a little distance, but it's all good. We got the bag so we can get to this bag, baby And look the great thing about this is you can't see the address from the street So they put it like put a poster thing in there. So we know exactly where to go pretty smart Somebody was thinking on their toes. That's a great thing Get this green, baby How's your day going today comment below and let me know how your day going how your day is going today And if you are here running us this bag Or you at home mad or sad That phone that where that phone that back hitting with that photo y'all already know about we can't keep on getting this Doing that we are here to drop off order number two what it do says put on the step This is that for what we're gonna do Take it home. Thank you. You're welcome. You have a great day That's a take a photo already fast All right, you have a good one. Let's order number seven. We get muddy weighing stresses Thank god for his blessings all the way sparked up one order 5.7 mile sam's club for 1185 stay alive. Let's drive Just like that we are here to drop this all the way sparked up order I was on park on the street and just come straight through the grass but guess what's gonna happen I might have stepped in some dookies.  No, no real Let's go order number eight. We already get to this cake all the way sparked up In-store pickup 10 orders 13.1 miles for 29 61. We ain't stressed. We about to get it done. Let's go We are here, baby time to get busy Hey, how you doing miss Renee? I'm doing great. I can't complain. Um, would you mind calling someone for the in-store pickups? Thank you So there's nobody at the in-store pickup and I also talked to miss Renee and she Walky talking to them. So now I got to walk back here. This is what I used to go through all the time They've been pretty good lately, but the day I need them to actually get it right. They don't get it right So I gotta go back here and talk to them. Tell them come on with it so we can get busy. Let's go What's going on? Um, can someone come for an in-store pickup? You all right? The in-store pickup in the front All right, thank you So guys I have a confession to make I'm out of pocket. I was going to say this I'm trying to act like it was Walmart far away. It was really my fault that there was no one up there to give me the orders Because I didn't push confirm arrivals. So they didn't know that I was even up there So that's what happened with that But instead of 10 orders is only actually nine orders because one of the two orders is going to the same house So that's gonna save us a trip. It is now 10.09. We only go out to the end of time We gotta hurry up and shine because I don't get these taxes done. I gotta be there at 11 o'clock So we gotta get busy and I hope you guys are with me. I hope you guys are having a great day Let's get to this cake. Let's go Jump off order number one. Let's get it done. It says knock the doorbell does not work. Stay back hitting with the photo smack first I'm rushing guys. Let's go. We are here to jump off order number two. What do you do? Here to jump off order number three get with me, baby. I'm gonna ring the doorbell This is the one we have to drop off two orders at so They don't let us see them get to keep on going and growing I'm dumb up Order number nine. We only go out to the end of time. You're gonna see a shot, baby The point pancake house two items 4.3 miles for 775 instead. We got 975. I'm gonna do something right now That's what I'm about to do I'm about to call my business partner and ask her that dude to her that she needs to uh, carry their bag And we're gonna find out Don't think I'll play that because I didn't Hello Did they uh, when you went to the point package or you want to you want to walk right now when you want The camera right now. But anyway, when you went to ask me to bring my red bag inside. Yeah Absolutely not. Did any of the other four drivers waiting to get their items? Their orders have a red bag in their hand. Absolutely not. So he only told me to get bring my bag out I don't know what's going on with the point package. I was with your little suspect now I already thought, you know, I want to go back there anyway, but now that you're trying to single me out I don't really like all that so I'm definitely not going back there But it was four other people in there. She said so it's a total of five people There was there when she was there including her and they did not tell her to bring the bag in So I don't know what's going on. But the point cake pancake house You better be lucky that my mom ain't involved in this because you know, she called corporate on She called the whole corporate office and all that that's what she do stuff like that You know leave bad reviews and everything. Me the way go. We're gonna continue to get to this Dole, let's go order number 10. We're trying to get it in one more eight items 4.9 miles for 12 dollars. We're hollow Next orders to get in order, baby These apartments are kind of confusing. I think I kind of figured it out though.  We are just like that. We're here to drop out the next order to get in order, baby This joint I think I I gotta be careful. That might that might be uh, ride it through Oh, that's my first wrong button, baby Might be right it through hitting the photo smack Knock on the door Let's go another one, baby. We're getting busy. I hope you guys are with me. We got a nice little set up here I like that. Look like it's hot hitting on the photo smack door down I don't know if that worked Let's go Second to last it's time to have a blast. Don't bark at me, darling I'm just trying to adjust this so I can keep on moving and go hit him with that photo smack Let's go And we're here to draw up the last one. Let's get it done. I don't know what's in this joint, but it's just extra heavy It seems like it's the last one so Step back hitting with the photo up a journey. I don't know. So Guess what we made it We made it. Look what time it is, baby. Wow It's 10 53 get with me, baby The office is probably three minutes from here. So we're gonna make the 11 o'clock I ain't gonna lie with speed. I was speeding and look I slid past the police We I thought it was over with for me, baby All right, he's gonna take me up top But I hope you guys enjoyed the video make sure you smack that subscribe button Make sure you give me a thumbs up and do not skip those ads After I'm done with this taxes, we gonna continue to get to this bag. Let's go And just like that, we are here to do our last one. Let's get it done, baby Mariana knows in jewel osco 47 items two orders 6.6 miles for 55 66. Let's get rid as you guys see It is snow everywhere. I wouldn't have got that taxes done. I'm talking about k-mart is snowing. Let's go Last one, let's get it done. I know I said the last order was the last one Let's get it done But when we did the instagram order when we did jewel osco There were some items that they did not have so you know that when you um When you do the instacart orders and they don't have items it takes away from your total So we're gonna do this last one so we can make sure we over there 200 plus a day and we keeping these haters away Wendy's we're here to get these pennies 2.4 miles for $7. We're holla Just like that. We are here to drop off this one. Is we trying to get these pennies way big And just like that it is the end of the video. I hope you guys enjoyed the content. Guess what? Wow It's still only 136 we got in the mix, baby. We made 206 25 stand live. Let's drive If I wanted to get that seven down the order that we would have been at 189 25 So sometimes you gotta go over and beyond this to make sure that you're gonna get that 200 plus a day And we keeping these hands away But I'm going to tell you guys this if you're looking to earn a chance to win some of the free merch All you have this is week two now All you have to do is email me at rome's house reviews at gmail.com Send me a picture. Show that you're subscribed to the channel and you will earn your chance to win to get it in Huge shout out to my god, Brian s. He's the first winner of week number one Now be on week number two what to do also I'm going to talk to you guys a little bit man. It's a little bit. Let me calm down a little bit Let me relax. You know what I'm saying?  But look, I know for it all for a thrill I'm going to give you guys some free game. This is probably the best game. I want to give you on the channel I do have to pay uncle sam Now with me. I never think about the now. I think about the future So in the future if I want to purchase the property that means that they're going to ask you for your w2 statements You know and your text returns and that means that you are going to be making some money And if you're showing that you're losing money in the texas, then they're not going to loan you any money They're going to say hi.  So that's why we gotta get the 200 plus a day and keep these haters away. So That's just a little jib. I'm dropping in the video But I hope you guys enjoyed the video make sure you lock it tomorrow because it's going back down when you're playing around 2022 is back season. So give us some reasons. I'll see you guys on the next one We go with we go up if we floor you already know in the dk and i'm on my way


The seven scientific steps that have transformed the world. Ask a question. Okay, that's one. So number two is research. Believe it or not, a lot of people forget number two. Three is form of hypothesis. Four is launch and experiment. What's five? Observe. Six, analyze the observation. So as you're observing, you're getting data. What's seven? Peer review. That's why if you don't have a mastermind like this, you always fail because that last one, who knows scientists that don't do peer review? What are they considered? Quacks. Like zero people take you. If you like publish or study and there's no peer review, you literally get laughed out of the world. So here's what most entrepreneurs do. Form of hypothesis. Conclude. Fail. I'm telling you that is six, seven, eight. The nine, 10 figure one is this one. Even eight figure people make this mistake.


A judge in Mexico has ordered work to stop on a stretch of the Maya train project. Flagship The judge's decision was based on a lack of environmental permits for the project. The train aims to connect archaeological sites, jungles, and beaches of the Mexican Caribbean. It is a flagship project of President Obrador's government. In this example, flagship describes the best or most important thing owned or produced by an organization. As a Navy term, the flagship is used by commanders leading military operations.


I hope you guys tune in. Sorry we've been rogue for the last couple days. We have lost a very small, important detail in our life, electricity. That's true, that's very true. So what we've had to do, because they're doing rolling blackouts, so they're doing it on purpose, saving energy, because it's been down to like 12 and 11 and two and three, apparently one, probably minus. I guess they're doing it so that, what do you mean? They're doing it to, I'm just telling Bill he can get up on the couch. They're doing it to conserve energy because it's more than the city can handle apparently. Apparently Dallas wasn't ready for below freezing. Yeah, below teens. It hasn't gotten this cold in years. Since 2011. I was gonna say, it hasn't gotten and passed the teens in a long time. So we're gonna use a little bit of the phone so you guys can realize we do the test so you don't have to. Dun-dun-dun-dun. No, but I saw this video on Facebook and it was in one of those gadget groups so I can't credit anybody. And I'm sorry that I can't credit anybody. But what it is, it's basically a holster for your heat gun to be out of the way. And he was building it. Like it was something gonna be amazing. Like he was like wood and measuring. And I was like, he was cutting this pipe, this PVC pipe and I was like, what's he making? What's he gonna, I thought he was gonna like mold something. And they started putting it together. And I was like, I wanna make one of those. So I made one today and I thought why not make one for you guys? And I've already started making it so that I can cut out some of that stuff. But basically what you do, you need something that's pretty sturdy. Don't try to use a, what do you call it? From your paper towels or whatever. Paper towel roll. This is from my heat transfer paper. I would like it to be a little thicker though. This tube. Ultimately you could do PVC.  If you can cut it, cut it down, have your hardware store. If you can, if you have a table saw, it will cut it. I just used my X-Acto blade because it was, it was like 24 inch wide tube. So, and cut it down to the size. Basically did this and then I thought, well, I don't want it to go to here because I don't know if that's just gonna make it like sag out or whatever. So I put my heat gun inside and measured from here to over here and then just cut a little notch so that that goes in there and it's nice and snug. And this is not touching anything, your metal. So that should be fine. That's why I would suggest PVC pipe because PVC pipe will catch on fire like this, probably what it is. But it's not touching, it will never touch. It's never touch. Gotta be careful when you put it in it.  And since we don't have electricity, I just used my torch, my handy dandy torch. But first what I did is line this up so I know exactly how much this is sitting on here. And then I took my Sharpie, put the point, right at the point, try to keep that in place so you're not moving that around. Line up where that's gonna go. And I don't know, so I thought it would mark on here but it does not. So what I did the first time, let's just use a couple of these small ones. So what I did the first time was just melt some heat. That's what that guy was called, a heat glue. Try not to breathe that stuff in, don't do that. You can wear PPE mask if you like. Just so that you can get a little glue on there and place your tube in place so that it's nice and sturdy, steady. And that's another good thing with using Cardboard 2 is you can kind of flatten it because that is, the heat gun is a little bit smaller than the tube in this tube here. So. Hey y'all, hey guys. Yeah, we are still without power and apparently it's supposed to snow again tonight.  Hey guys. What I did earlier for the one that I have underneath the table now, I just heat up a very long part of it. Try to do it equally so it, all heats up. It just doesn't start melting on you all over. So it looks like it's about ready to do.  And hopefully. We're gonna say you can just drag it out. Don't wanna catch your card fire. Yeah, that will melt into your Cardboard. We'll hit it with a heat gun after we have electricity. Yeah, so it kind of melts down into your. Was not expecting this at all. Thank you for being so helpful. Oh, it's our pleasure. That's what we do. So you don't have to. So you don't have to. So then we can do the other side. I would suggest girl glue. I don't know how long this is gonna stay. Oh, then we don't have power. You want another stick? We do not have power, which is why we're using a torch to melt hot glue. I was trying to get you guys a decent video today instead of a true color video. Does that battery work? For what? Like does it have juice? Oh, we have a heat gun. Yeah, do you want me to get that? I'm already halfway done with this. I forgot we have a cordless heat gun. Best art education channel on YouTube. Oh, thank you. Big congrats to both of you. I will thank you. We appreciate the congratulations on being engaged. It's true. It's true. It's so true. So it doesn't have to be pretty. Nobody's gonna see it, but you... You have a regular hot glue gun and electricity. This would be a lot quicker and easier. Yeah, and we actually do. The one that turns the heat, the glue into lava. But in case you don't have those things. Yeah. That's what you can do. Trying to melt that down in there. When is the wedding? We have not set a date yet. Hello, Tim. Hey, guys. I made it crooked. It doesn't matter. The one we have... That'll be all right. So, if you want, I'm gonna try to do is through this into here and then that up into your table. Put one into the other side. So I'll spray, pre-put this screw in here. And then when I put under there, just zap it up. I'll probably put some more gorilla glue here to hold it. So I know that I'll have to hold this as well, so. So yeah, if you want to paint it, you can spray paint it black or red or blue or purple or whatever, whatever you like. You could have side-by-side dual heat guns. Look at that. You can put it on both sides. See if you can help quick draw McGraw.  It's true. Guess I won't complain about 64 degrees. Yeah. Oh my God, that would be amazing right now. It's warmer in our fridge than it is in our place. Put it that way. Bowie doesn't mind it. Do you bo bo bean? Do you ma baby? No. We're keeping warm in onesies and piles of blankets. I can show you guys our Pokemon coasters. Oh yeah. We just did some, what I want to do with these is a lot of people take pictures of their Pokemon cards and then they all they, you know, it's kind of boring. They put them in a white light box, take a picture. I understand you definitely need to, I definitely need to have a lot of light on them. But why not make something like this? Put it in your light box and take a picture of it that way. Cause a lot of light boxes have cameras down. Some of them are up, but I thought it would be nice to just people can use these or you can use them as coasters, whatever you want to do. I actually made one. Where's that? They put a Pokemon card in there and resin'd over it. Make a nice little coaster or something to take a nice picture. Cause a lot of these, a lot of the cards that are worth money are halos and this is exactly what they look like in the background. Holographic, rainbow. So, and it just, I don't know, just puts a little pep in your step, I believe. Good pepping. So, good thing Jeff got his winter clothes on. Oh, I have thermals underneath this that I wore in Brecker Ridge. I haven't put my snowboard pants on yet though. I have. You guys want to see the outside? Don't mind our essentials in the window. It's not bad. Well, it's melting now, but we still have power and it's supposed to start snowing again tonight. I don't know what else it's gonna do. Yeah, no power, does free zone. Look at this. It's what it's like throughout the whole building. Creepy. I would tell you what temperature it is in here right now, but there's no one home. Also, apologies, I can't ship orders. But have you guys seen our shop? I have boxes of pigments coming in this week. I hope I have power enough to put them in the system. So we've been surviving off of peanut butter and jelly sandwiches, sorry, Nutella and- Hey, I put, what did I put? Nutella and jelly. And grape jelly is strawberry jelly and it was delicious. Excuse our spray paint area, it is a spray paint area. Yeah, it'll never change. Thank you. Where are you guys watching from? Hey, Bethany. Also, Jeff's gonna tag some of these boxes if you are interested in Pokey things. I'm gonna do a Poke Malone. Poke Malone, it'll be okay. I want four days of that power from an ice storm. I'll do a Poke Malone. What I'm doing here is you can see the mat. Oh yeah, yeah, yeah, on this line right here. So I wrote mat underneath it. And then I'm gonna try to draw on it. But I'm gonna put mat spray and then I'm gonna do mat liquid and then I'm gonna do gack and something else that I wanted to try to, so that if I can draw on this without it running or bleeding or, you know.  Ooh, that's gonna be a great box set. It'll be so cute, yeah, it'll be awesome. Camloops BC, you're probably colder than we are. Yeah. However, do you have power? Right, you guys are used to it. So you still have power. My boo boo. Yeah, it was like what, 10 below the record when the wind was blowing, but we had power and it's in a fireplace and snow clothes. I would love a fireplace. I don't wanna have to wear snow clothes inside. It's no fun. It is no fun. So is that everything we wanted to show? Nope, we can show them. Oh, pokey. We're gonna do half skull, half Pikachu. I've already sanded it down with some Scotch Sprite and I'm gonna spray it all white. I might spray it all black and then draw the skull on and do it white so that it looks a little more, I would give it a little more depth, I think.  It's gonna be the skull and then just black where you can't see them. Skeletchoo, I love it. Skeletchoo. We're gonna use that, TG. Thank goodness you have lots of windows. Well, it's good when the sun's out but it's not really out so it's not warming anything but it does do a great job of letting all the cold air in. Yeah, these windows are 125 year old windows so. Yeah, they're old. They replaced the actual glass I think at one point but it's still crappy glass. Like they had to put, if you could see those strips right there, the metal strips, they're like little fuzzy things that go. It's hard to explain but it's supposed to stop the cold air. It's not. But you can still feel the cold air coming in because they're just old windows. We've been walking around with like goose bumpy skin. How gross. It's my general look. Right, Susan. So anyways, you guys, we just wanted to see what y'all are up to. Say hello, Hawaii. We miss you. And we haven't forgotten about you guys. We just haven't been able to do anything because of the rolling power outages. We've had power for like, let's say five of the last 32 hours. Like it comes on just enough to warm your place but our heater for some reason isn't blowing hot air. Yeah. I don't understand why. So our place got up to 58 degrees. That was the high it's been inside the last couple days. We are okay though. We're making it work, aren't we, boo boo? Aren't we? Aren't we? Aren't we? Aren't we? We're staying busy, pre-recording. Jeff's doing a lot for TikTok right now. If you guys are on there. Yes, we need all the followers we can get. I wanna try to get. I just want at least 1,000 followers so that we can go live on it. Right now we're just making videos which is a blast. I'm meeting and getting more artist followers. That's awesome. We just need a lot more. We're up to like 330 I think, 332, which is awesome because like two or three days ago we only had like 114. There's like this thing going around called 10K Artist. So if you're on TikTok, give us a follow. Go check out some of my videos. Our TikTok, what is our TikTok? Artists tell death. It's true. Yeah, most of DFW lost power or is in a rolling power situation. So what's happening with this? Are you gonna mount it while we're live or? No, because I'm gonna put it over there and it's too messy. Sure. All right you guys, we'll come up with another can do on a phone project for tomorrow. We're not gonna be doing them at 6 p.m. because we don't have any like trusticle. Well today is Tuesday, so two o'clock Tuesdays. I don't know what time it is because none of our, none of our vats are working. But the boys say hello. Hi Stephanie. Oh my baby male.  Hi, is this something I can do in my new workshop? Absolutely you can. Yeah. I'm just gonna put some hot glue on here or stick it to the bottom like this one is. And then just put the screw in there and give it a little bit more support. It doesn't work now because I... No boo-boos. No, I know. It's okay. It's okay. But yeah, I just wanted to get that screw started so it would be easier to zip it up in there. Okay Moose, that's enough. So yeah, that's it. That's good. All right you guys, we're gonna get back to it but I hope you guys have an awesome and creative day. Stay warm. If you're in a snowy area, just don't be outside. Don't be outside. There was a hundred plus car pile up here in Dallas. No exaggeration. It was ugly. I'm sure a lot of people saw it on Facebook. When's it supposed to warm up in Texas? Thursday. April. Thursday or Friday, it's supposed to be in the 60s. Blows my mind. Actually Friday is supposed to be 63. Don't let your resin freeze. That's a good point. People out there, most resin can only withstand freezing temperatures three times before it's trash. So. Yes. Don't let your resin freeze. Thank you, LRB. I feel like you're just like that. That accident was on national news, right? All right you guys, we'll see y'all tomorrow. We kind of went another. You never know what someone's going through. And remember, we do the tests. So you don't have. They're gonna get like, dizzy. But they'll be fine. They know that when you do that part of it, to be prepared for earthquake warning.  We love you guys. Bye. I said bye. We said bye. We said bye. We said bye.


The shrink system preparing to swim our vehicles so two days ago we swam our vehicles in a boat basin got them all out there and then afterwards we went and conducted some maneuver training and some of the trainers on Kent Peloton that led into this morning where we did some resupplies with battalion and then kicked out a long road march which resulted in brawls here where we now have the ESB building the bridge we're about to cross it after that we're gonna go conduct an air fuel and seizure while we're also working with our adjacent companies and our higher battalion probably the three biggest things one being maintenance second being rehearsals and three being those individual actions because when it comes down to it it's basically it comes down to the Marines doing their job whether they're calm guys the crewmen or gunners gal and the rehearsals just to make sure that everybody's on the same page and everybody knows what's going on and maintenance is just one of the biggest things that we can really be utilized as that long-range asset to provide reconnaissance and security so it's good to get extra guys and work with adjacent units and other units around Kent Peloton and just build that camaraderie between units


Hello everybody Andrea here with dental tutoring so let's talk about how should you study if you've taken the exam the board exam several times you have not passed you have one last chance to pass. How do I suggest you study it's very different than if you're taking the board exam for the first time and I'll tell you why. The biggest mistake that students make even after they've taken the board exam once and don't pass the biggest mistake that they make is only studying what they feel they didn't know. So if they took the exam they had troubles with pharmacology special needs and maybe oral pathology questions. They will spend months or a month only studying that but that's it. If they took the board exam again and all of that other material they would have since forgotten or at least not remembered as they should enough to pass. So the best advice I can give you guys is if you have one more chance to take the board exam is study everything again as if it's the first time. Okay. I still want you to do it slightly different so what I suggest you do is actually do mock exam practice questions first. So don't just open up the textbook read everything. Don't open up your course materials if you're in my board exam prep Academy course and just read everything. Don't just read materials. I want you to do mock exam practice questions first on topics. If you want to study anatomy today. Take a mock exam practice test on anatomy and see how you do. If you do poorly then I want you to go back and study anatomy that day probably for the next three days because anatomy isn't going to take you just one day to study for a couple hours to study everything. Study for anatomy as if you're taking an exam in school just anatomy and do not take the board exam again next month you need time to study and you need time to prepare. So does that make sense you guys. Now mock exam practice questions you can make those on your own have another study buddy do it for you you know and then compare notes. If you have mock exam practice tests the the the other person can do five and then you kind of switch them that is really really helpful. If you need help. If you sign up for my board exam prep Academy course I have mock exam practice questions in there for you, more than one on every single topic you need to know for the board exam. Plus, you will also have full access to tutoring sessions as a group where I go through more mock exam practice questions with you for one full hour, where I go through questions and the answer for you and how to pick the best answer and always practice critical thinking so that is truly the best way to pass is going through a little bit of this a little bit of that. Studying on your own is difficult, especially if you have failed the board exam before because you are more stressed than ever. Of course you are because if you only have one more attempt to pass you're going to be even more stressed. That stress is making it difficult for you to focus, knowing what to study and when to study so let me help you I will leave the link for you guys on the bottom. For the board exam prep Academy course I have one for dental hygienists and dental assistants, you have full access until you pass the exam. So no rush within reason if it takes you four years email me will talk about it, but you have no rush and I'm here to help you pass. If you have trouble, guess what you can ask me and I can help you it just means I will hop on and do another tutoring session on anatomy, and then we can go through it that way so you truly understand everything. So that's the best way mock exam practice questions first. So let's say you take a mock exam practice test on oral pathology and you do a great job. I'm not saying do not study oral pathology, because I actually want you to study oral pathology again, but it will likely take you maybe three hours to study, not four hours for three or sorry, four days for three hours a day. It's just going to take you a couple hours to read through everything and then you feel good about it. Whereas anatomy that you didn't do a good job on let's say that might take you four days to study that two hours every day. But then you will understand anatomy and those questions that they're going to ask you on the board exam you will pass. There's a method to my madness everybody if you need help let me know. I did the link for you guys for the board exam prep Academy. Enrollment is now open now is the time to sign up you get full access to all materials right away, plus our previous recorded mock exam sessions so if you don't want to read through things or take mock exams, you can listen to me teach you so that's kind of fun right I hope so so you get full access to everything right away. Good luck you guys let me know if you need anything and talk to you very soon.