We are speaking with real people who live and operate a business on Jacksonville's Northside. I feel like we need a theme song. I feel like Sly and the Family Stones should come in and say and ooh man I hit that no bad. Everybody sitting around the table looking at me like don't sing. Don't sing Mr. Letts It. Don't sing. So we have Lakita Spann co-founder of Mr. Potato Spread. How you doing Lakita? I'm great. Thank you for having me. All right. Chef Onyx, owner of the sweet and savory chef founder and creator of Relax and Unwine, Secret Elevated Dining Experiences. Hello. Hi. Thanks for having me. I need to check this out because I need to figure out how to relax and unwind. You do. We got Michael Samson, Executive Director of the Jacksonville Community Action Center. Michael, my man, how you doing? Thank you. All right. And my buddy, my dude for many decades now, Mr. Charles Griggs, President of 8th and Wittner Group. How are you, sir? I'm good. Good morning, Al. I'm glad to be here. All right. So, you know, when I came in as the interim host of First Coast Connect, my thought is that like I just really wanted to dive into the title of First Coast Connect. Like let's connect the First Coast. And so these everyday people panels are all about the neighborhoods. And so we're starting off with the north side. With that in mind, please, Lakita, tell me about Mr. Potato Spread. Yes. So Mr. Potato Spread is a vast casual restaurant and food truck. We have three locations. Two in Jacksonville, one in Orange Park and a food truck here locally. We've been in business since 2014. And we have one location on the north side in the River City Marketplace. And so what exactly is the food that Mr. Potato Spread? It's all things potatoes. We're fluent in all things potatoes. So potato based items loaded with all types of goodness from seafood to steak to cheese to veggies, whatever you like. So our number one seller is the Crab Pot, which is a spin on the Low Country Boyle. We're from Warner Race in Jacksonville, and we call Low Country Boyle's Crab Pots, therefore the name. And so that's old to our love for Duvall and the Crab Pot Potato. I have one question. Sure. Why did you not bring me some? I got you. I got you. What is that? We're going to talk about that later. Chef Onyx, please tell me all about the secret elevated dining experience. Well, it's just that it is definitely elevated as a fully immersive dining experience. So there is some form of all five senses are tapped into at the dining table. So you the last dinner was a sound bath experience. So while you were eating, you were able to experience a fully full body sound bath from our great sound bath therapist, Yogi Steve, and a plant based meal. Nice. Yeah, I specialize in vegan and plant based foods. And so these are events that happen around the city? Around the city. Yes. And you can. So what you what people do is I have a component of my business called a sharing dish.  It could be a private residence. It could be an actual business. And you can sign up with to be a part of the sharing dish.  Okay. All right. Again, I need to be on your middle. Michael Simpson, please tell me all about the Jacksonville Community Action Center, which I'll do. So the Jacksonville Community Action Committee, we were formed six years ago to really deal with systemic issues that we see here in Jacksonville from racial inequality, trying to fight for police accountability, as well as other issues.  I went to Jackson High School. And I thought about that with Mr. Griggs here, because I was wondering, is Jackson consider east side or north side? So I was kind of on that border. East side. I kind of lived on the one side of the street. So I claim the north. But, you know, we've been organizing for a couple of years, trying to fight for social change here in Jacksonville. And obviously, a lot of the systemic issues that we see the inequalities exist on the north side. So, you know, the north side is where I live.  So it's in my blood. So I'm happy to be here and share some love for my side of town. And Charles Griggs, president of Eighth and Wittner, please tell me what what what do you do? Well, now people for me with me on the radio here, they hear me on WJCT and they just say, Hey, that guy works for WJCT. No, but I do media and government relations. I work with people throughout the community, not only nonprofit organizations, but corporate folks as well, and help connect people with solutions that relate it to media, my, you know, my background is in communications and and creative and marketing. So it's been I've been in this business now for, you know, almost 40 years. And I love connecting people in and finding ways to solve problems between, you know, various fractions of the community. Yeah. And the type, the name of your company is based off of where you grew up, right? On the north side. Yeah, I grew up in Durkeville. My house was located on my grandmother's house was located on the corner of Eighth and Wittner, which was three blocks west of Eighth and Myrtle, right there near by JP Small Park. So, you know, that community is, you know, it I live with that community in my heart every day. And my grandmother was a was a pastor, she was a minister. And so we say I church in our house. So that's my foundation. It kind of keeps me grounded. And as I'm doing business with folks around the community, it reminds me every day who I'm working with, you know, the type of passion I need to have for the work that we do.  And that's what the business is based on. Yeah. Now, for the purposes of this conversation, can we outline exactly where the north side is? Before we got started, there was some debate about like where these lines are. Right. Well, we know, we would like we was talking about earlier, I know that for a long time, people traditionally out north of north of Dunn Avenue considered that to be the north side and considered anything south of Dunn Avenue to be northwest Jacksonville, you know, northwest of the river. And which is really kind of weird, because like Michael mentioned, some people consider parts of the east side, the north side, they just don't kind of, you know, that whole line is blurred because the characters of the neighborhoods are very much the same, especially, you know, where they are large concentrations of African Americans. So, you know, for me, I consider it the northwest side, even like Reigns Reebok football game that happens every year, it's a northwest classic.  But, you know, in many respects, it's, you know, we can sort of narrow it down to being the northwest side. Yeah. What do the four of you feel like the biggest challenges are on the north side right now? Access. Access to food, most importantly, access to health care, transportation, and funding. So that's something I've noticed in that community, especially for small business owners that live in the community and operate in the community is access. People don't even know they exist, a lot of them because only the people that live on the north side and the northwest side of Jacksonville, some people from out east that visit those establishments because they don't know that they're there, no one else in the city. I travel outside of the north side because I don't have, there's not enough access to good grocery stores. And so, as a chef, to shop for things that I may need for my clients, I have to leave and go to the south side or other parts of town to get fresh produce and that shouldn't be. And the everyday person that lives over there should have access to good produce. You can join the conversation at 5492937. You can tweet us at FCC on air. You can email us at firstcoastconnectedwjct.org and you can find us on Facebook. So we were talking about the challenges of the north side. What do you think, Latika? Yeah, I would definitely agree access. I think that that's definitely an issue, access to healthier food options. And, you know, although I own a restaurant and we offer some healthy, healthy food options, we also have a food truck and before opening our restaurant, we trial the food truck out just on the north side. And, you know, I think the response was little interesting. It obviously led to us opening a location within the River City Marketplace, which I thought was amazing. But what I also realized was certain parts of the north side, you know, we would get calls saying, can you deliver the food to me? I don't have a way to come in. I want to support. I just don't have a way to come and actually get the food. And so I found that that was very interesting. Michael, you've been working on these issues for a while. I agree with everything everyone said. I think economic opportunity is a big issue. My church was off Soutel, so, you know, driving to Limp Turner, going to Soutel, you kind of see certain economic blight. And as well, I think, you know, this is a historic issue in Jacksonville. There's been a overinvestment in other parts of town and a lack of investment in the north side of town, particularly when the north side of town is home to majority of African-Americans who live in the city of Jacksonville, the urban core, like, you know, even though the urban core is not definitely the north side, but a lot of folks, you know, are tied together economically to this area. So the lack of economic opportunity, you know, growing up in Jacksonville, it felt like the north side was my own town, you know, I like literally freaked out driving on Deers, Southside, Deers Creek or whatever, Deer Park. Yeah, Deer Park. I freaked out driving out there. I was like, where am I at? This is like another town. So like the access issue is what's able to connect folks from the north side to other parts of town, but also the lack of access kind of strangleholds. Our abilities are really, you know, built for ourselves and like how those institutions that we can control and I will be remiss if I didn't also mention over-policing to an extent, I think. Growing up in this city, I mean, I think other parts of town see the police more often. I think oftentimes on the north side, when we want to see the police, we don't see them, but when we don't want to see them, we see them. So I think that's an issue that we have to address, you know, and that ties to racism, that ties to policy, that has historically just been an issue here in Jacksonville, particularly affecting us on the north side. Yeah. Yeah. Before I go any further, I just want to give mad respect to that crab pot potato. That is my go-to at Mr. Potato Spirit. Thank you.  I mean, it is good. Thank you. Like, I've had it out. It was just a less Wednesday. Right. I'm sorry. So, but I need to do a fact-finding mission. Yeah. Right. Live from Mr. Potato Spirit. But we, but I think that, so access is a thing. It's an issue. But one of the reasons why access is an issue is because and we haven't really seen the type of intentional efforts at making sure that the north business areas in the northwest out of town have been, have what they need in order to thrive. In other words, you know, we've heard a lot of the Mayor Deegan talk about infrastructure and we've heard infrastructure, the word infrastructure come up a lot, a lot over past administrations. But another has been really intentional, intentional for the northwest area in order to help build, you know, companies to want to build in those areas. It is one of the reasons why we have economic challenges in north side is because these companies, when they come to town, they get pointed in various directions of where they should and when they should not go. And because of the infrastructure in the northwest area and north side of Jacksonville, it's been very difficult to encourage development south of 295. So, the more we can encourage better infrastructure, the better the chances of us seeing real opportunities for economic development in north side. And until that happens, which we understand that the Mayor is looking to do now, you know, we're going to continue to see economic challenges over there, which will continue to exacerbate access problems.  So, we don't have a business quarter, a real business quarter. No, we don't. And what's interesting about that is what, you know, we only had the food truck, our business model was centered around larger businesses, right? It made sense for us to take our food truck to locations who had 200, 300 employees. You were going to the hospitals. We were going to hospitals and we were going to Deerwood Park, like what you were talking about, you know, Gate Parkway. And so that those are the areas that our food truck frequented because it made sense for us. That was just the business model. It just made sense. And so, that was always a request. Why don't you ever come to the north side, come to the north side. And so, that was always a struggle with trying to find a business that was large enough and made sense financially for us to actually take the food truck to. Yeah, I think one of the ways to sort of measure that is to look at, and I just, you know, just kind of off the rip, how many businesses or how many office buildings or business quarters do you see that have buildings that are taller than two stories in the north side, other than the hospitals? You don't know. So those business quarters are just, you know, they would be, they're important to encouraging folks to open up shop, you know, barbers, lawyers, doctors, and so forth to participate in various communities. Well, I will say that there's, outside of the access and the infrastructure, these are things, these are facts that we know exist within the Duvall County area. But also, the propaganda that has been fed to the residents and citizens of Jacksonville about the north side. And so, I know people, I've even had an Uber driver that's never gotten off on the Edgewood or Limturner exit, have never seen that exit, and she immediately locked her door because of what she's heard about this community. There is an entire food truck village located on Limturner that those, the people who own the food stalls and the food trucks over there are not making the revenue that they should because people fear coming to the north side. And because of what has been fed to them, I live in like the core part of the north side. And it has a stigma on it that I can't for the life of me understand, and I've never experienced any of what they've said. And because crime happens everywhere in this city, not one neighborhood is exempt. I have a friend whose car was just stolen out of a gated community in Argyle Forest. And so don't make it seem as if the north side that as soon as you get off the exit, you're going to get carjacked or you're going to get robbed, or there's nothing there. It's beautiful. It's trash. It's not trash everywhere. The people who live in that area keep it clean. Yars are kept. Beautiful homes are beautiful over there, but they're not coming because of what the media is feeding the community. And we have some very nice neighborhoods in the north. Beautiful neighborhoods. People are really proud of their communities. Many of them are not gated, of course, and they just they grew up with that tradition of the yards and keeping the streets and so forth. Right. Landscaping, but to bring people to that community to highlight those the food truck village that is over there and the hard work that they put in to be able to be out out there. But at night when it gets dark, it's also dark in the food village because of access to J. A. Coming to put out power lights out there in that field, because the person who owns the lot may not be able to afford to put a power light out there. But they do have a lot for food trucks to come and park for residents to walk to. It is a walkable location for residents to come and get food. We got a tweet from Lee Brown. He says Northwest Jacks is a food desert and has been one for decades. Publix leaving Gateway was the death now. There is no other area in Jacks so depleted of services. They're just getting around to removing septic tanks. Do you all agree with that? Because right on my street, yes, my street is literally dug up and I have pipes everywhere. They have the worst road signs over there. They don't care to leave signs to say there's a dip in the road or anything. You'll tear your car up. But if you go somewhere else with this construction and they're doing the septic tank rollout, it's not like that. It is very hard to drive in the areas and it looks a mess, but that is happening in the food desert. When Publix, he's right. When Publix left, it was in my personal opinion a bad decision when Dixie moved in because when Dixie is no longer providing healthy options or good produce for the residents in that community. If you look at Gateway, I mean the economic, when I was growing up, Gateway was where you bought school clothes. Mr. Kicks. You bought your church clothes there. I was fresh for three days. I recycled everything. I had everything there. Even you look at Lim Turner and Dunn. That economic mark, when I was growing up, it was popping. You had a Jason Kenney there. There was a Wal-Mart restaurant there. Yes. You've seen that kind of deteriorate over the past few decades. I think you cannot disconnect the perception of criminalization of the North side. Obviously, it's criminalized because as African-Americans, we live there. We have a culture in this country we have to deal with. But also that ties to economic development or lack thereof. If you think one part of town is a bunch of crime, it's not safe to be there, then you're more likely to invest those dollars to build up a town center when you could have had a town center on the North side off of Dunn Avenue or other areas. I think we have a new administration that I think understands the plight of a lot of folks and is seeking to address that. But we've had decades of this type of mentality. I was just going to say that I agree with that. But also I've been in Jacksonville since I was a little kid. The North side has always struggled to get the resources that other parts of town seem to get pretty easily. It doesn't matter who is the mayor. It seems that I'm probably going to get some tweets and texts about this. But the truth of the matter is that every city in America has been shaped by racism. Every city. And any listener that does not believe that challenged me. I will prove it to you that every city has been formed by racism. And when you think about Jacksonville specifically, I think about consolidation.  And then you look at what has happened on the Northwest side of Jacksonville and see just the sheer inattention. I don't even know if that's a word, but I just created it. When I served on the Charter Revision Commission, one of the subcommittees we worked on, the Urban Core Development Authority piece, where we were looking at addressing what used to be the original city of Jacksonville, the boundaries there. And we thought that we would get some intentionality to address specific issues in the Urban Core, where we set up really a resource, a dedicated resource for the Urban Core, much like you see with DIA and the Downtown Investment Authority, to address a lot of these issues. Not only infrastructure, but economic empowerment, food, deserts, incentives and things like that. And the concept was it was managed and run by people from the community. And because the community has to decide what's best for it. Yep. We're going to go to the phones. We got Eugene on the North side. Eugene, how you doing this morning? Hey, good morning. I'm a current resident of the North side. I'm proud of it. For a quick time, one, just to give you some history on the River City Marketplace. Hey, Eugene, we're losing you a little bit. Your signal's coming in and out. Can you repeat what you just said? You said you're giving some history on the River City Marketplace. Not River, the River City Marketplace was drunk up by some black businessmen and it was never able to get through. So you could do some fact-checking on that, if you like. And one of the issues and concerns I have with a lot of people that live North side of town, they get up Saturday morning, Sunday morning and what have you. They go, they spend most of their money and revenue at the St. The Town Center, the Avenue Mall, the Orange Park. And then when they come back home, their community is struggling because a lot of our part of the resources are just going out of the neighborhood. The money is not circulating in the neighborhood as it should. So you need to address. I take your point, Eugene, but I think it's very much a chicken and egg situation because the money is going out of the neighborhood, but if there's no resources in the neighborhood and you need something, then you got to go to the south side to get it, right? So it's like, how do you fix that when the root problem, I think, at the root is that there's a lack of investment there. So, therefore, like the residents have to go out to other places. Case in point, we have a lot of young African American males, they get up Saturday morning in some cases and then get on the city bus and we're at the Orange Park Mall having a mall. No one's going to reach you right now, but they could go to Hibbitt Sports or we have a foot locker in the gateway mall they call it Town Center. So I'm saying a lot of these resources are available, but for some reason people at home, they're sold the hype that, okay, when you go over here, it's going to be nicer. They keep the mall 72 degrees versus the mall that the Gateway Town Center is going to be 78 degrees. So, you're basically hitting on a theme that has been in the black community for, you know, ever since desegregation, when you're talking about, you know, once we desegregated, a lot of people decided that if a white store sold it, it had to be better. Very true. I mean, thank you. Thank you for your call, Eugene. And hopefully it could be addressed. Okay, thank you. Thank you, man. Are you about to say something, Michael? I think it was also a lot of black economic headquarters were destroyed. I mean, when they built the highway and villa and all that jazz, I mean, there's actually federal dollars that cities can apply for to deal with the what the highway system destroyed in terms of black economics and reason why not to. We're going to take another call. We got David from Pranavidra. David, how you doing this morning? I'm doing well. Thanks for asking. I really appreciate the conversation this morning and the opinions being offered. I'm living where I do, where my wife and I live, but we feel very far removed, obviously, from the situations that you're addressing this morning. But I'm wondering if people like us can do to help advocate for and just to not just have so many words, but have action being taken up there to help transform the lives of the people that live in the area up there, especially the children. I was in education for many, many years, worked with children from all ethnic groups and inner cities in other states. And so I can relate to what's being said. I'll stop there. But what can the average person and Jacksonville do with anything other than I just vote? And I think hopefully we have a mirror now that will show more interest. David, thank you so much. Yeah, I would say and thank you for that, David. It's that get to know the culture. There are so many resources, so many people out here who have amazing businesses.  Tell your friends. I mean, because people from the north side, they drive a long way to go someplace else to find, you know, what they're looking for.  We've talked about a lot of the issues around the north side. But give it some love. Tell me, tell me the things you love about the north side. Like what makes you I actually I won't steal your thunder because I was about to say what you said earlier. I love the nature of the north side. The north side is absolutely beautiful. And just and I don't think people realize how beautiful it is. We have trails. It's not that well where I live at it doesn't take that long to get access to getting to the beach if you go up extra drive, you know, there if people would just get out and see Trout River running through Rebault River and all of the beauty. There's even a hidden trail out by the airport that people don't even know about. I'm not going to exactly tell you where it is. You have to do your own research on that because I'm low key trying to like keep it a secret. There are trails just everywhere and it's just like I am surrounded by nature living off of Palmdale. We are in the Lake Forest area. It is a beautiful sight. If not, I've even seen although I shouldn't have seen it, but we've seen coyotes in the area. We've had a bear walking down Mon Creek. There are just things that happen on the north side that you're just amazed at and just how people are the people. It's it's literally the people that make the north side beautiful. Yeah, I think I'd add to that and say there's very much a happy, joyous for the most part. There's this culture right on the north side that I love. I remember a friend of mine, we were just kind of walking and she really hadn't been on the north side before. We were just kind of taking a walk and everybody that walked past us, you know, there were groups of people that were walking where we were as well and everybody spoke and she said, Why do you know them? And I said, No, I know. That's just what we do. We speak. She goes, Well, no, I've never experienced anything like this before. Why is everybody speaking to everybody? And I said, This is just what we do on the north side. And so having a business on the north side, you know, there's just something so beautiful about people coming in and saying, Thank you for opening up on the north side, right? We're so happy that people are opening businesses on the north side and just that that happiness that welcome right, wanting to welcome us to the north side. There's this family familiar kind of feel that because I'm born and raised always lived on the north side from from Sherwood to Pondale to Lake Forest for 27 years. And now I still live on the north side off of Main Street near Pecan Park. So yeah, I think I think the people like they all have said, I mean, I work out of pro plaza, which is I see everything, you know, see all economic backgrounds. And even the poorest folks you'll meet, they have a sense of optimism, smile, you know what I mean? I think other parts of town may not be like that. I'm pretty biased about the north side. And I think the people just make up the north side. I think the type of individual you meet on the north side is someone who's seen it all, but has a certain type of enthusiasm to work and do better. And I think that exists out of town. I absolutely still get goosebumps every time I drive by JP Small Park. I love that stadium. So much history there. So many things. I mean, Hank Aaron played there. The Jackson and Red Cavs played there. And even today, you know, Stanton plays there and EW plays there. That stadium has so much history. And it just it just really sort of speaks to the character of the community. All right. So, Lakita Spann co-founder of Mr. Potato Spread. Next time I see you going to bring me a potato. Absolutely. I want the one that Charles is talking about. I got you. I'm going to see him around town. He's going to be like, you ain't heard it. I got you. Chef Onyx, owner of Sweet and Savory Chef, founder and creator of Relax and Unwine, Secret Elevated Dining Experiences. She's going to have me on her guest list for the next one, correct? I sure am. Bam, bam. My man, Michael Sampson, Executive Director of Jacksonville Community Action Center. Thank you, sir. Thank you. And my brother from another mother, Charles Greggs, President of Athe and Wittner Group. Thank you all so much for coming in with us. Thank you.


From DailyDoseOfWeirdNews.com, I'm Darren Marlar and this is your Daily Dose of Weird News. Some universities are offering students chocolate, therapy dogs and video games as ways to cope with their finals. The future of our country is in big trouble. Lenard, the nation's largest home-builder, is going to include Amazon's Alexa built-in to all of their homes. It'll be almost the same as trying to communicate with a family member who's ignoring you. It'll be like talking to the wall. According to a recent study, fast food actually contains more calories than we thought. Which means we're getting more for our money. Score! According to a study, antioxidants in cocoa might help your heart by keeping your blood vessels relaxed, thus easing blood pressure and helping circulation. The study shows that cocoa's antioxidants called flavonoids coax the body into making more nitric oxide, which relaxes the blood vessels way holed up here. I thought Flava Noid was that rapper who wears a clock around his neck. You're saying that he's good for my blood pressure? I don't know. I don't listen to rap. Hey, we've all been mad at the cable guy, but a woman in New Jersey took that anger to a whole new level when she left her cable guy stranded in the air. The dispute took place at an intersection in Ridgewood between a woman and an optimum cable employee. It's unclear what the dispute was about, but police say the 59-year-old woman turned off the worker's truck while he was still up in the lift, leaving him stuck in midair. The woman was charged with harassment, false imprisonment, disorderly conduct and criminal trespassing. Although I don't see why she's in trouble for this. She did tell the guy she'd be back to service him sometime between noon and 5 p.m. Can singing control pain? Doctors at Royal North Shore Hospital in Sydney have been prescribing three half-hour singing sessions a week for three weeks as part of a pain management program. Ironically, to induce the initial pain, they played songs from Celine Dion. Redmond O'Neill, the son of Farrah Fawcett and Ryan O'Neill, was arrested Tuesday around 2.30 a.m. in Los Angeles on suspicion of robbing a convenience store. Man, remember the days when celebrity children would just take after their parents and become alcoholics? And those were the days, weren't they? While welcoming back the three men released from jail in North Korea at Andrews Air Force Base early Thursday morning, President Trump bragged that the event probably broke the all-time TV rating for three o'clock in the morning. Yeah, there were 250 people watching nationwide instead of the usual 150. Oh, yeah, it may be a couple of insomniac cats and dogs. Being in an unhappy marriage may be hard on the body as well as the heart. Study shows couples that often argue take longer to heal from simple wounds than those in less hostile relationships. Well, yeah, because you don't have anybody there to kiss your boo-boo better. It's a fairly odd world record, and it's been standing for over 30 years. But after all this time, 25-year-old Boston University track and cross-country runner Zach Prescott has set a new high mark for juggling, as the fastest time for running the mile while juggling three lacrosse balls. Prescott ran the mile in 4 minutes and 43.2 seconds, barely beating the old record set three decades ago by American runner Kurt Swinson. Guinness World Records will now verify if Prescott's time can officially become the new record. And if the record is confirmed, it could mean his life will... well, absolutely nothing will change for him because nobody is looking for this on a job application. Malaysia just elected a 92-year-old leader. They wanted somebody who didn't know how to operate Twitter. A Thai airline has fined a passenger $94 because, get this, their name was too long to fit on a boarding pass. Yeah, first airlines charge for baggage, then they charge for extra baggage. They begin charging for kids to fly. They charge now if you want another soda during your flight. How ridiculously greedy can an airline get when they begin charging more based on the number of letters in a passenger's name? A man in China was detained after he inserted feces and motor oil into several ATM machines. He actually thought doing this would make money come out.  Just because you eat cash and have it turn into poop does not mean you can deposit poop in the bank and have it turn into cash. Lots of people talk to their dogs, but some people take it to a whole new level. An American Animal Hospital Association poll shows that 33% of dog owners admit that they talk to their dogs on the phone or leave messages on an answering machine while away. You know what, we used to do that for our cat, but she doesn't even listen to us when we're at home, so what's the point? South Carolina High School is planning to find people who cheer too loudly at graduation $1,030. You might as well bring the air horn and get your money's worth then. If you need another reason to avoid the tattoos, well, a 23-year-old from Britain almost became the victim of a botched-up surgery because of a minimalist tattoo that led to a mix-up. When surgeons were going to perform a procedure on his shoulder, they mistook the tiny play-button tattoo for the actual mark indicating where they had to operate. So they almost operated in the wrong place. This is exactly why God invented the Sharpie. So you can write on your body, operate here, and in news you just can't make up, rapper Dr. Dre has lost a trademark battle with gynecologist Dr. Dre. True story. This episode is brought to you by the Chuck Swindoll Study Bible. If you like to study your Bible but are looking to get more out of it throughout the month of May 2018, you can register to win a Chuck Swindoll Study Bible as well as commentaries on both Romans and John. It's like having a personal Bible study with one of America's favorite pastors. Keep it for yourself or give it to a friend or family member to allow them to dig deeper into the Word of God themselves. Register to win right now by clicking the Contests tab at DailyDoseOfWeirdNews.com. For Daily Dose of Weird News, I'm Darren Marlar and I'll see you next time, Weirdos!


analysis platform, which is built in conjugation to Wireshark. A little bit introduction. My name is Nishant Sharma. I work for Pentester Academy. Before being a security researcher, I was a developer. I was developing Wi-Fi access points for enterprises as well as the Wi-Fi security systems. I have a master's degree in Infosec and for last couple of years I have been presenting my research at Black Hat USA, Black Hat Asia, Demolabs, HITB and all the other venues. Here are my team members. Let me introduce them. Hello everyone. My name is Ashish. I work for Pentester Academy as a senior security researcher. Before joining Pentester Academy, I work for law enforcement agencies as a cybercrime investigator and I've been in this industry from last eight years. My work has been presented in Black Hat USA, Black Hat Asia, Defconn USA and this time in Defconn China to present Wireshark. Hello Defconn. My name is Jeswin. I'm currently working as a security researcher at Pentester Academy and my work has been presented at Black Hat Asia, USA and Defconn Demolabs and here I am to present Wireshark. So those of you who do not know about Pentester Academy, it's an online portal which is completely dedicated to security related courses. As it is online and it is subscription based, you can subscribe to it and you can access 40 plus of our courses which are completely focused on security. We also run attackdefense.com which is an online browser based cyber range. Once you sign up for this you can actually get access to thousand plus of labs which are spreaded over 65 categories. The reason for mentioning the attack defense here is because we even have a community section which is free for all. You guys can go and check those challenges out. You can play those for free. So now coming to the topic at hand, we are going to discuss Wireshark but before diving to the main tool, we are first going to cover the basics of Wireshark. Then we will see how to recover or reconstruct the Wipe call. After that we will take a look on the current state of open source tools that are out there that you can use and we will conclude the talk by introducing Wipeshark that is our contribution to the community and the field. When we talk about Wipe Telephony, this is the thing that is going to eventually replace PSTN completely. PSTN is your classic phones. You know you have your dedicated lines connected to exchanges. You pick up the phone, you dial the number. What it does in the back end is it reserves a circuit for you and after the call is complete, only then the circuit is destroyed. Because you are reserving this circuit, it is not that efficient. Another reason why this is not the best solution is because when you are doing all of this you have to do analog to digital conversion two times. So because you are Wipe, run on IP and so it can use packet switching. So that's the reason why most of the enterprises and now even telecom providers are moving toward your Wipe. We are not going to talk about proprietary protocols but only the open source standards that are in making and they are on the way to take over the industry as well. So we are going to talk about SIP in general. These are three protocols that you will learn about when we talk about the signaling protocols of Wipe. So Wipe has two major parts. One is the signaling and the other one is the media carrier. Signaling defines when the phone will ring, when you will disconnect the call, all of that control operation is done by signaling protocol. The actual voice or the video when you are making the call is then handled by the media carrier that is RTP in this case. So we are only going to focus on the first one here that is sorry that is the SIP and the other protocols are proprietary so we are not going to talk about them. SIP or the session initiation protocol is the signaling one. It's a text-based protocol and it supports your audio calls as well as video calls. So as I already mentioned when we say it supports these calls, it is only being used for the controlling. It cannot carry your data or media. It can carry your SMSs because they are text-based data right? So it can work there. It is important to mention that SIP by default is not secure. It does not provide any kind of transport layer security. So if you want to secure your SIP communication, you have to use TLS with it. So just like you do for HTTP right? You have to use SIP over your TLS. This is the model in which your VoIP telephony work especially in SIP case. When you join the network or when you join the system your phone will actually register to one of the servers, the VoIP servers and that is done by using the subscribe message. So after that is done if you want to place a call you will be pushing a message to the server and then that message will be forwarded to the target party. So that is how you will place a call. When any other party want to call you, you are going to get a notify message because you have subscribed to the service. This is a simple flow chart of a call between two parties. The first party when they initiate the call at an invite packet, SIP invite packet is sent. After the other party picks up it gets the acknowledge. After that your media transfer takes place and a buy packet is sent by the party who disconnects the call. So now these are the user agent servers which we can use any servers which you may like. In our case we have used Asterix because it's open source it has a very good documentation and that's the most popular one. So and to place a call we need a soft phone or a hardware phone right. So there are some commercial soft phones available and they do have a free version of that. We have used Microsoft to capture all the traffic right. So and we have used Asterix now. So what is Asterix now? Asterix now is the Asterix server which will handle all the backend stuff, signaling and calling etc. The free PBX will allow us to manage and control the Asterix server using the graphical interface right. To demonstrate different configurations we have taken the VoIP traffic capture in this simple setup. So this setup involves a scenario where there are two clients and a server and all of the VoIP traffic is going through the server. Now when it comes to VoIP setup to enforce security we can achieve that in different ways. For example in one case we can have SIP packets encrypted. In another case we can have RTP packet encrypted. So these are the four possible scenarios when it comes when we encounter VoIP traffic analysis. So the first one is SIP and RTP where both SIP as well as RTP packets are unencrypted. The second case is SIP over TLS and RTP and as the name suggests SIP packets are sent over TLS and RTP packets are unencrypted. In the third case we have SIP packets unencrypted and SRTP is used instead of RTP and in fourth case we have SIP packet sent over TLS and SRTP is used instead of RTP. So we'll take a look at the first case which is SIP and RTP. So now SIP SDP packets contain all of the information which is required to set up the RTP stream and if encryption is enabled the encryption key will also be present in the SDP packet. RTP packets provide the statistics and control information of the RTP session and RTP packets carry the media. So now Wireshark has a really beautiful feature which allow us to analyze the flow sequence of VoIP call. So this is how the flow sequence of a VoIP call between two client will look like. So starting from the invite packet start how the call was initiated till the end of the call. Wireshark also has an option to play the VoIP calls. So we can easily play using RTP player of Wireshark. So as he explained if you are using SIP plus RTP that's the simplest form that you can use. There is no encryption if you have the packet capture your Wireshark out of the box can actually reconstruct the call. You can play the call so you know life is good. But what if some part of the call is encrypted. So in the second scenario when you use SIP plus SRTP your RTP packets are now encrypted. So you can still see the SIP packets as you can see here. You can also observe the key that is being used by SRTP to encrypt the traffic. So we are talking about the media traffic here. So whatever you are saying whatever the video is going all of that is encrypted but you are able to see the key. But the problem is in this case now your Wireshark cannot decrypted. It can see the key but it cannot decrypt it. And if you look for RTP traffic instead of getting the RTP traffic you are going to see the SIP traffic. Now the issue is when you will try to reconstruct the call you will get something like this. So this is how an encrypted protocol will look like because you know the data is randomized. You should not be able to make any sense of waveform from it and you know this is doing it pretty well. We cannot tell what kind of waveform it is. What are other configurations? In other configurations you can protect your SIP by using the TLS and you can leave the RTP out. So in that case you won't be able to see SIP packets because they are over TLS. You will be able to see TLS traffic a lot. Now in this case even when RTP is not encrypted you are not going to see it. Why? Because your Wireshark actually relies on SIP packets to figure out which UDP packets are actually the RTP packets. So because now it cannot see the SIP packets it cannot tell the difference between the normal UDP packet or your RTP packet. But in this case if you observe the traffic you will find out that from one port there is a lot of UDP packets and if you follow the stream you should be able to make sense out of it. Once that is done you can use decode as function of Wireshark and by setting decode as to RTP you can still recover the call. There you go right? So this is the proper waveform and if you play it it will play. You will be able to see listen whatever was you know whatever was passed. Last is the super case of all right. You have your encrypted SIP and then you have your encrypted SRTP. So in this case because you know you are your Wireshark will not be able to see the SIP or the RTP it's a little hard. But the possibilities when you are using TLS in this case is either going to be one of two. Either your TLS handshake is going to use your Diffie-Hellman exchange or it is going to use your RSA-based handshake that is the private and public key thing right. So if it is using DHE, DHE is pretty secure you know if you have collected a passive traffic sample you cannot find out the key from it because DHE protects you against eavesdropping. But if you can do active MITM attacks you can actually target this too. But we are not covering the active side we are only talking about the passive side here. This diagram actually explains how DHE works. I'm not going to go into details but it is here so that you guys can refer to it later. Similarly you have your RSA based public and private key pairs which are used. So our observations when we were doing all of these experiments were that if DHE is used there is nothing you can do because we are only seeing the passive traffic right. We don't want to do the active attacks. When RSA is being used if you have the private key of the server that is being used for VoIP transaction you can actually go ahead and de-grip all of this and Wireshark has a functionality for this. But before that you have to understand which of the method is being used. So for that if you check your TLS handshake you should be able to see something like this or you can see here right. It will tell you if it is using the Diffie helmet. Similarly in case of RSA you will be able to see RSA handshake. So once that is done once you use your Wireshark to decrypted this traffic you can go ahead and decode SITP as well but if your SITP is not decrypted it will again look like this. So this is how it will look like in case of RSA. This is the field from where you will be able to tell if the RSA is being used or the DHE. Before performing any action we should be able to anticipate if it is going to succeed or not right otherwise there is no reason of you know doing blind experiments. So if DHE is there there is nothing we can do. So now coming to the SSL part if you guys have already decrypted SSL traffic you already know about it from the edit preference option if you look for the protocols if you go to SSL protocols it actually gives you an option to put a private key there if you do that it will decrypt the traffic for you and once the SIP is decrypted you can see the SITP key and by using other tools you can try to decrypt it. Now the issue is there are two tools here and I'll let my colleague explain it. SRTP decrypt one. SRTP decrypt is a tool to decrypt SRTP stream so this is the github repository and now let's take a look at how we can install SRTP decrypt. SRTP decrypt requires certain libraries to be pre-installed on the system and once we have installed these libraries we can clone the repository and use the make to compile it. Now this is a big limitation of SRTP decrypt that it do require a Linux system with built tools installed to use make. Once we are done with the compilation we'll have a ready to run SRTP decrypt binary. However this binary is not smart enough to figure the encryption key on its own so we do require to pass the encryption key as a parameter to the tool. We can find the encryption key in the crypto parameter of the SDP packet. We also have to make a note of the UDP ports which were used by the SRTP stream. So let's take a look at how we can use the tool. So since we already have the key and the input file we can directly feed it to the binary and it will generate an output in form of hex dump. This is how the hex dump would look like. We can then use wire shock to import the hex dump and recover the RTP packets. So we do have to specify the UDP port information here as well. So once the import has been completed what you'll notice here is the timestamp as well as the IP address both source and destination have been modified. This is because SRTP decrypt do not preserve the metadata and in SRTP decrypt the generated hex dump did not have any set packets. As a result wire shock is unable to figure out that a UDP packet is actually an RTP packet. So we'll have to manually decode UDP packet as RTP packet. Once we have decoded the UDP packets as RTP packets we can then perform stream analysis on it. And if we'll try to play the decrypted call what you'll notice here is the waveform is not visible. This is again because the metadata was not preserved by SRTP decrypt. However if you'll click on the play button you still be able to hear the voice. So as you saw the issue with this tool is first you have to need a Linux system. You have the Linux system now you have to install the build tools you have to compile it and after that only you can run it. And after going through this whole tedious process in the end again the metadata was not preserved and if you are into forensics and everything you know right IP addresses and timestamp is the most important thing so we cannot lose them. Another tool that we have is the lib SRTP. It was created by Cisco it is available it is open source just like the other tool it also needs you to use Linux. Once you have your Linux you can clone it and then you can do the configuring make it and after that it is ready to use. Now just like the tool that we discussed about the SRTP decrypt this tool also does not know how to decrypt it automatically so you have to feed it the key and this one is even complex than the other one because in this one you have to first filter out the stream that you want to decrypt. So whenever you are placing a wipe call whenever you are calling someone there are always two streams on one RTP stream whatever you are saying that data will go or that audio will go. On the other stream the other party whatever he is saying that audio will come. So in this case you have to first identify which stream you want to decrypt you have to then find the corresponding key copy that and pass that to your the tool. So this is the filtering part you filter it you export that stream as a pcap and now you can run it and by after doing that it will give you output in this format that is actually text so you have to again make it into a pcap format and for that we are using text to pcap tool so it is converting the timestamp that is in front of the packets that's all it is doing so when you use both of these in conjugation after that you are able to see the SRTP decrypted form and once that is there you have to then again decode it as your RTP and once you do that you can then see the waveform this right but also in this case you were not able to preserve the IP addresses or the timestamps so that's a big no-no and you already you have already seen the process right it was ideas and the idea of making this tool the wipe shark right it came when we were working on creating a new course for our company that was based on wipe security so we were actually using these tools and that's when we realized that there should be something which is easier than these which can be used by other people on platform of their choice right no one should be forced to use a platform which they don't like for some reason then there are other artifacts which are important when we talk about the security in wipe like your DTMF the messages and the then one more function that you need is the exporting call function which is then used to analyze the call in other softwares right so if you guys don't know about the DTMF so whenever you call your credit card company or whenever you interact with any kind of IVR system it asks you to press one two three on your dial pad right so that is DTMF so whenever you are pressing to something like this is going through the route if you're using boy if you're using your PSTN then obviously that's different similarly if you send SMSS or wipe your ship a protocol is is going to carry those and this is how it will look so now if you want to export the calls and if you want to do forensics on that you need to convert it into the waveform so my colleague will explain how to do that so now we want to convert the RTP stream to wave format so there is one online service which we can use and convert the RTP stream to wave we just need to upload our PK file and submit it for the process then it will convert the RTP stream to the wave and we can download it on a local system then we can play it using any media player such as VLC or Audacity right so if you are more concerned about our privacy right so we don't want to upload the PK up online so we there is a script on written in bash right and it uses t-shark and shock and that's the GitHub link it does the same job and that's the tool help option so we need to make sure that before we run the script we need to install t-shark and shocks on our system then we can run the script by passing as a first argument the pcap and in the second argument we can you know mention the output file name and if you can notice in the snapshot there's a two file generated right so that's our wave file and if you notice in the directory of the script so before and after running the script before we can't there is only two files right because we haven't run the script so after we run the script it there is a three file has been generated and we can actually play it using any media player as I just said and we can actually hear the call so enough of problems now let's talk about the solution that's the interesting part and that is our contribution to this field and that's where we bring in our tool that is wipe shark as you guys can guess easily that the wipe part came from wipe and the shark part is taken from wire shark because the tool is created in form of the plugins of wire shark now there's a reason and I'm going to explain it why instead of creating a separate tool why we chose to go with this route wipe shark can decrypt your wipe calls whenever possible so by that I mean whenever it will be able to see the decryption keys or the encryption keys in your SIP packets it will automatically decrypt it it can run on live traffic it has gpl license just like your wire shark so now the next question is do we really need it we talked about a lot of problems and some of them were the tools that we already have they are cumbersome to use not everyone can use them you have to install them then you have to go through the TDS process and then you can get the decrypted stream right another thing was these were restricted to Linux systems you have to use Linux because the TDS was so long the process was so tedious it is more likely for the users to make mistake because you have to select the right key then you have to select the right stream in some cases and after doing that they were not maintaining or retaining your metadata that is your IP addresses and the timestamp right another problem with those as you already saw is that the input that those tools take that is not live traffic that is a captured peak app that is passed to them after manual processing right so our wipe shark can do all of this and that's why we think it can actually help people who are doing boy panelist is up why why shark plugins because we all love wire sharks whoever is there in network analysis field he has seen it he has used it and he knows the kind of power wash up has right so we decided if we create other other tool just like the other tools you have to again install it and then it will become platform dependent and then we have to also take your because we are dealing in packets here right so packets can be in the magnitude of thousands and even you know hundreds of thousands so why not to use why shark specialty they have created work shark only for this purpose another reason is we want this tool to be extensible so instead of going for see or any other compiled language which was Lua Lua is a very user friendly language it's more of a scripting language with power of C so if you join any scripting language that you think like your python or something it has the power of C and it has the flexibility of python and even in case of python if you want to run it you need to you know and interpret it in this case if you are using it in wire shark plugins you just need to paste the plugins in the plugins directory in Lua itself you need not to compile it you need not to do anything it will run out of the box and because your wire shark is always independent so are our plugins it will run on Windows Mac you know Linux you name it on any platform on which you can run your wire shark our system will run wire shark plugins are basically of two types one is the listener one other one is a disector one we are using both in our toolkit and this is how the typical dissection takes place in wire shark you pass it packet it has a chain of disectors so if you have used wire shark you know what I'm talking about because when you get the packet you have these layered layers there right you have Ethernet layers then the IP layer then the TCP and then the above layer like HTTP or FTP for that matter so that is what exactly happening there so first whenever the packet is captured it is passed to wire shark the first plugin or the first part to get this packet is the outermost player so in this case it will be the Ethernet so Ethernet header will be processed there and the payload will be passed down to the second one second one in the chain so in this case you are chained plugins wall so our wire shark is also plugged in the chain like this it takes after once your UDP and TCP parser is done so from TCP and UDP parser phase it figures out if the packet is SIP RTP SIP or SDP it will pass it to the wire shark chain and then wire shark will do something which looks very complex here I'm not going to explain all of this we have a detailed research paper which will be available on the github repo you can go through it if you're interested in knowing the internal workings you can refer to this if you have any questions we will be reachable on mail also similarly this is the decryption routines for SIP traffic description and decryption and this is how you install wipe shark you just go to our github repo you copy it and just paste it in the plugins folder and to find the plugins folder just open your wire shark go to the help section from there you have to go to the about wire shark and folders so you will find personal plugins folder there just open that folder put our stuff there and it will work out of the box yeah you have to restart the wire shark not the whole system so once that is done suppose this is your SITP traffic right so now we have installed wipe shark this is your SITP traffic just go to edit preferences so if you guys have already decrypted Wi-Fi traffic or SSL traffic you know what I'm talking about you go to edit from edit you have preferences option from there in protocol section you have to look for wipe shark so that is the new entry that we have created once you install the plugin once you copy the plugins into the folder and once you tick the box there so there was this little box here this one right just tick it it is not ticked by default because you know if you don't want to decrypt it we also don't want to once you do that you click ok and there you go that's all you have to do to decrypt the RTP traffic and after that you can actually create waveform from it now coming to the other problem that we had we want to export the call in a popular format audio format right so that you can use your audacity or other tools on it so for that we have provided this option here from the tools menu if you go to the wipe section you will see the export wipe wave option and you can export it from there it will ask you if you want to define a custom location or the file prefix if you don't then it will use the default one and then it will export all the streams that are there in the pcap so we have also appended IP addresses of source and destination so that you can keep track of streams of your interest also when we were doing all of this one more thing that we wanted to be out there was something which can provide you summary of your wipe traffic so suppose you are capturing this traffic on a network router or switch right so now you're dealing with hundreds or thousands of calls so you want to know which people are placing the calls which numbers are there all of that is needed right so what we did we also created some more plugins which will do all of that for you so this one is the DTMF so anyone if he was using RTP which was the unencrypted version if he has passed anything on DTMF it will be logged and our plugin will show it in a pop-up right similarly you have your extensions so these extensions are actually the numbers so this one here the extension is the number if a username is associated with it that will also be shown with the IP address and also with the user agent user agent is the software that you are using to place the call now this information can help attackers in all of other ways also right so similarly we can see how many RTP packets were transferred which can help us to to quantify if it is an audio call or video call or how long it was right so all of the information that was needed from the security perspective that's the only thing that we have covered we haven't gone for the basic set then again when you connect to the server the SIP server you have to register to the server and just to make sure that no one can use your extension there is this password that you have to pass so if you want to brute force some users password just copy this string this one is hashcat compatible so you can just copy it and run hashcat on it and if the password is weak it will break we can also see the servers or the proxies that are being used for wipe the messages the SIP SMS which are which were passed and the last part of the toolkit is to detect attacks so suppose someone is running some attacks on your setup and you have the traffic capture you want to know if some of the wipe attacks are being launched first one is the brute forcing if someone is trying to brute force your password our plugin can actually detect that by checking the number of tries in a given threshold of time similarly invite flooding can be detected so invite flooding is like calling someone again and again so whenever you place a call an invite message is sent from the caller to the callee now think about it you send the same message like thousand times what will happen his phone will ring he will pick the phone up he will put the phone down the phone will again ring so it's kind of DOS or irritation attack right so it can detect that it can detect the message flooding if you are spamming someone on the wipe and it can also see if someone is trying to do active MITM on your calls on the local network it can also detect if any unauthenticated user is there so now we will see a little bit demo of how to decrypt the SITP protocol and how to export the calls using our tool can we have the demo please yeah so there we go first one is to decrypt the SITP traffic you have this capture here which has SIP plus SITP traffic so if you search for SIP you should be able to see the packets but when you search for RTP you will be able to see the SITP traffic that is the encrypted one so what we are trying to do here is we are trying to reconstruct the RTP stream to listen to the audio and this is how it will look because it is encrypted right so now what we can do in this case is from edit just go to the preferences part from there in the protocols we have to look for wipe shark so once they are just tick the small box and click okay now depending on the number of packets Vaishark will take its time and it will give you the RTP packets so now with a click of this button you have actually decrypted SITP and if you try to reconstruct the stream you should be able to see the waveform in its proper form and you can play it so that's the first part and that's the major contribution that we think we have done all a further is like the bonus then the second part of this demo is in which we are exporting the wave files for each stream so that is also very easy you just need to go to the tools option from there go to wipe all the tools all the plugins you can find there this is again asking you if you want to change the file prefix or if you want to change the location once that is done it will export all the streams to this location with the prefix provided so that was our demo all of these plugins will be there our research paper will be there on our GitHub repository that is this one it is already it's not up yet it will be up after the talk we have a tool visiting cards you can take those if you want and if you have any questions I will be taking those now any questions related to SIP RTP SITP anything is welcome so even if you think of something after the talk here is my email ID you can drop me a mail I will revert to the mail I'll be happy to help you with you know whatever question you have so that concludes our talk thank you for coming to our talk and thank you deafcon for giving us this opportunity thanks