Welcome to Pure Dog Talk. I am your host, Laura Reeves, and I have a very special guest today. This is literally Breaking News Pure Dog Talk edition as we all watch the developments in the Ukraine and in Europe. And what many of us dog breeders automatically go to is the dog people and fear and concern for our friends in a sport that is entirely global these days. And so my thought was to reach out to Europe's answer to Pure Dog Talk, and that is Talking Dogs with Auntie. And this is Auntie Lutzi. And I am very thrilled to have Auntie join us. And we are going to talk about what's happening in Europe on the ground. You're about 1,000 miles away. Is that about right? I am very badly geographic, so don't ask me. I looked it up on Google. Yeah, don't ask me how far I am, but I'm quite far away from you, that's for sure. OK, from the Ukraine, though, from the... From Ukraine, well, it depends. Ukraine is a very big country. Yes, from the Western part of Ukraine, where it's safe still sort of. We are, I think, if I read correctly in the newspapers, the nearest place in Croatia is about 300 kilometers to the nearest place in Ukraine. Still, it's not one country where we know, when I normally go a lot, but I know a lot of people there. And obviously at this point of, you know, when the situations are like this, dog people connect very, very quickly. And then you try to, you know, to help in any possible way. So I'm really happy that you have invited me. I appreciate it. And if both you and me with our dog shows can make a difference in helping, I'm very happy to do it. Well, Auntie, I talk about here in the US, and I believe it is global, our tribe. Dog people, we stick together in an emergency. And I think that's what this is. So I wanted you to talk to my listeners here and around the world about what is happening, specifically on the ground, what you know, what you can share and anything that we can do to help. Well, you know, the thing is that in situations like this, you know, it's always very difficult to say anything because of course, this horrible emergency situation has connected a lot of people, a lot of dog people from all around the world. But then of course has made a lot of, you know, different opinions and fights and everything. So we're not talking politics. We're just talking, what can we do for dogs? Right? Yeah. I wanted to say just that when it all started, I said the same like you, I'm not interested in any politics. Politics is not something that interests me. I want to help people. If there is a way to help people, here I am. So what we have actually tried to do is that, you know, we have tried to place as much as possible information on our Facebook group, try to connect directly with the people who are still in Ukraine, try to find out what is that they need. Then of course, I'm repeating again, Ukraine is a huge country. Of course, there are still places which are, you know, not affected by the war, but there are places which are heavily affected by the war. And one of them is obviously the capital city, Kiev. You know, and there is a lot of dog people in Kiev. For your viewers who maybe don't know it, Ukraine is quite famous in Europe as a very professional organizer of dog shows. And they are supposed to have the World Dog Show, FCI World Dog Show in 2023. So, I mean, they are a country with a lot of experience and a lot of good dog people. Unfortunately, at this point, things are quite difficult because in the places which are affected by the war, at the moment, it's impossible to move. This is the biggest problem, you know. There are still a lot of dog people and there are still a lot of people in general who would like maybe, you know, to go away from the war, at least children and women, because obviously for the men, it's not allowed to leave the country. But unfortunately, when this all started, even if, you know, everybody in newspapers, media, they were talking a lot about this, but actually it happened like a surprise to everybody. You know, people who really managed to escape in the first, let's say 48 hours, they had managed. But the rest of the people are now very limited with the options which they can do.  Coordinate. Yeah, because I think that's the most important thing at the moment. We are trying to see who needs help, where they need help and what kind of help they need. What has been happening in the last, let's say 48 hours, I know a lot of dog people from the neighboring countries like Hungary, Romania, Moldova, you know, they were driving till the border with Ukraine. And the people from Ukraine were finding some kind of ways, you know, to send their own dogs. I have just read the story maybe one hour ago about 40 English cocker spaniels arriving to the border with Hungary and all these dogs were like literally in half an hour, you know, people found home for them in Poland, in Hungary, you know, to keep them until the breeder can catch them. But of course there are people who are not lucky enough, you know, to be able to... Hang on a second. Say that again, Angie, our internet wavered a minute. Okay, from where to start? The, there are people who still can't get to the border, is that correct? Yeah, yeah. So the thing is that there are unfortunately now, a lot of people who cannot come to the border or who cannot organize the transport for their dogs till the border. I have read a lot of posts today where people are begging, you know, to find any kind of transportation, if not for humans, at least for the dogs because the dog people are really, and you said it in the beginning, and I'm going to repeat it 100 million times, dog people are amazing when it comes to these kinds of situations. And in any country, in any border that people are being able to send their dogs, you know, we find people who will go there and who will catch the dogs and who will put them in the nice homes and everything, and the same for the people, you know, there are like in my group, there are hundreds and hundreds of messages from people from all around the world who say, we can take dogs, we can take people, we will help as much as we can. Unfortunately, I go back to the fact that unfortunately, now the people who are there mostly will have to stay there for some more time. And what is now, let's say emergency, is the dog food. This is what I was talking with a lot of breeders in Ukraine, I was talking with Helen, who is the vice president of the Canine Club. The dog food is a big problem. So what we are trying to see at the moment is, we will try to connect tomorrow with the Red Cross to see if there is a possibility to send some amounts of dog food with them. And then I have contacted almost all the big distributors of different pet food brands all over Europe. And there are few more who have some food still in Ukraine. At least two, I know that they have some food in Odessa and in Kiev. So we are trying to see if tomorrow there is a possibility that we collect the money, that we buy off all these food which they have there or obviously they would give us as best as possible price for it. And then the dog people could collect money. But the problem again is the transport. How do you get it from Odessa to Karkiv, say for example? I mean, that's a long way and there's people blowing things up. Yeah, the transportation at the moment is the biggest problem. But we cannot give it a try. We cannot just stay and say, okay, now it's impossible. So it's really, and I'm going to say it again, not only me personally, hundreds and hundreds of dog people all around Europe and all around the world who are trying to find every possibility to help. So at the moment, I want to say also to your viewers, what people in Ukraine need the most is the dog food. This is why we are going to try at this point to collect money to try to buy, well, if it will be possible, this food which is still in Ukraine, but then also try to connect with the Red Cross or with any people who will possibly go to, till the border and take from there because there are obviously still some men who are driving women, children and dogs till the border. So whenever we find somebody like that, when we manage to organize that somebody takes the dogs, we try to send back some dog food with them back. So I mean, it's a lot of organization. It's not easy, but it's amazing how much people want to help and I think that's great. And I think people in the US want to help, people around the world want to help. So we can send people to Talking Dogs with Angie, your Facebook page, yes? I'm sharing almost all the information that I can get. I must say there are also some groups which are specialized already now for the transport and these things, these groups are mostly in Poland because Poland has a big border with Ukraine. Obviously there are information about this page, it's also on my page. So we are trying to send the people in all possible directions where they can find the information how to help. It's a lot of people who are writing to me and say, please give us some account. We would like to send the money. I would not like to deal with that personally, but we are trying to see that there are obviously some breeders who have asked for the financial help and I have published their stories and their account numbers or PayPal accounts or whatever in my group. So people, if they want, they can do private donations to them for the top food or whatever. But then I hope that in the next few days we will manage to have some kind of account maybe organized by the Canon Club in Ukraine or something like that, where people will be able to give donations and help them to put this money on the places where it's needed and to help some of the breeders on the ground because that's what we want to do. Right, and Anteus, you mentioned the Canon Club in Ukraine. It is a very well-known group of people. Are they trying to organize something there within the Canon Club, within those people to do what you're talking about, make a central depository that people can support and work within the country? Obviously they are. I don't know how... The problem is this, in Kiev it's impossible to move at the moment. Everybody's hiding in a subway. I mean, I just can't even...  And even if in my city where I was born, we had the bombing just for one day, I remember how horrible it is. But when you are in a situation like this, you cannot do anything. You are in a shelter and that's it. You cannot move. So I'm sure they are trying to organize the things, but whenever we go in one direction and we think, okay, this could be done or that could be done, it's always the transport, which is a problem. So obviously they are working and whichever information they will have or whatever they will manage to organize, it will be shared. But then there are, as I said, private breeders, private persons all around Ukraine who are themselves trying to help to other breeders. And it is working in a way that whoever has the possibility to help or a way to help gives us the information and then we try to organize it. Is it easy? But we all hope that this madness is going to stop as soon as possible and because it is just devastating to watch all this news. So, Angie, you are in Croatia. Yes, and so you said you are a child of war. I assume the war in Croatia. People in the United States and many of the Western countries don't have that experience. They just don't understand it. And so I wonder if you can help paint that picture for them, that just sheer devastation.  My country has been passing difficult years of war, but not so much in the city where I was born. This is the lucky thing for me. But of course, we have all experienced horrible news and everything. And I mean, when we had this one day of bombing in Split, I was 12 years old.  And, you know, you, at that time, we had one pet dog, you know, and we took this one pet dog to the shelter with us. But I'm thinking of myself now when I have more dogs. You know, if something like that would happen, what would I do with my dogs? How would I deal with the situations that my dogs don't have food?  That's what these people are passing just now. And I think we just need really to try to help as much as possible. And I'm repeating the same like you, like I'm absolutely not interested in any politics. Leave me away from this. I'm not part of it. I don't want to be a part of it. Let's just see how we can help with these people. Because you know it from your side. I know it from my side. You know, if at this point, you know, we would be in that kind of situation, we would really appreciate that our dog friends from all around the world are trying to help us. So I think that's the, I mean, that's even- It's all we can do. Yeah, yeah. Even if sometimes, you know, maybe some people, you cannot reach them, you know, when you cannot help actually at this point, almost anything, this kind of support, and you know, saying to them, listen in a second when it's going to be possible to help, there are 200 people standing in the line who want to help you means a lot to them. I agree. Can you talk a little bit? This is absolutely your area of expertise. Talk to us, share with people outside Europe and outside the Eastern Europe, particularly. You talk about some of the breeders in Ukraine. Talk about some of the breeds they have. Talk about, I saw one report with a woman that had 50 Labradors. I can't even imagine. So can you talk, share some of those really specific stories about people and help people feel that?  I have a very, very good friend, you know, when we have been at the European dog show in Kiev, she has been helping us with accommodation and everything, and she has been showing her dogs many times in Split at the shows that I'm organizing. You know, she has two small kids and she has great days, you know, and great days are not easy dogs, you know, not to feed, not to, you know, these dogs at this moment, they cannot go out. They cannot, you cannot do anything like what you normally do. And then, of course, you have children which are, you know, there and so, I mean, these are horrible stories from people and it's just, you know, we can try to, you know, to think what they're passing, but I don't think anybody of us can really understand, you know, because it is, the problem is that that in these kind of situations, they have no idea what the morning brings, you know, they have no idea what is going to be in the next one hour, they don't know, you know, what the life will bring and how the things will go and we can only just really pray and hope that this will end as soon as possible, nothing more than that. And at this point, you know, thanks to all the dog people from all around the world who are trying to help in any possible way, because I think that means a lot. I believe it does too. And I think that I can certainly pass on from myself and from my listeners at Pure Dog Talk all around the world as well as here in the US. Anything that we can do to help, we stand ready to help as individuals. And that is all we can do. Absolutely, absolutely.  So as I said in the next few days, first of all, we will see in which direction all this will go. People are still trying, you know, I think maybe people who in the beginning didn't want to go out of the country, maybe they are thinking that now this is a good way because nobody knows for how long this will go on. And the only thing what I can say, you know, from the other side of the border that anyone in Ukraine who wants to find a home for their own dogs or for them or for their children, as soon as they arrive to the border to any country, Poland, Moldova, Romania, Hungary, there are dog people waiting for them, you know, with open hearts, and all we can do is to pray that most of them will manage to save their lives and the lives of their children and their dogs. That is an amazing vision, and I believe absolutely true. So thank you.  You for sure know, and I mean, we know, we don't know each other personally, and we never spoke before.  But I said in the beginning, this sport, this hobby, however you want to call it, these people who love dogs, they are, whenever there are situations like this, they are always ready to help. And they don't ask any questions. There are people literally in every corner of the world, the dog people who are ready. Now in this moment, you know, to help two people they have never seen in their life only because they're sharing the same common love for the dogs. And I think that's absolutely the best part of this sport, absolutely the best part of it. It is what makes it all worthwhile. And it is absolutely real and absolutely mind-boggling to me on a daily basis how much this is a tribe of people who takes care of each other. And so I, and everyone I know stands ready to help in any way we can. And that's what we're doing here. Listeners, viewers, be sure to check out Talking Dogs with Angie, you can find it on Facebook. And she will be continuing to keep that updated. And anything that we can do to help, I think is gonna be available there. And as much as we can, let's, like you say, kind of try and consolidate so that people can really help in a specific place. And I think that this is what we are trying to do. We are trying to put on one place people who can help, people who need help to tell, because there is no need that we send to people, things that they don't need. So it's a good way to know which people need, what they need and which people are the nearest to them that could help. I hope we can all help as much as possible in the days to come. Absolutely, well, this will be shared on Pure Dog Talks Facebook page and on Pure Dog Talks website and on Pure Dog Talks podcast. So we will get the word to, as many of our 200,000 listeners as we possibly can. Yeah, thanks a lot, Laura. I mean, it really means a lot that we can try. Somebody wrote a few hours ago, it's nice when the people who have a power to send the message to other people, use their platforms to help. So this is what we are trying to do. And from my side, I'm first of all, maybe a little bit sorry that you and me, we didn't meet in a nicer circumstances. And that the World Dog Show next year would have been much better. Yeah, absolutely. But I'm sure it's going to be time also for that. And I want to thank personally to you and to everybody of your viewers and listeners who will connect and try to help the people in Ukraine in any possible way. Any possible way. Thank you very much, Angie. Thank you, Laura.


Magnetic particles can be transported against gravity if a sufficiently strong magnetic field is applied. The strength of this field depends on the particle's magnetic susceptibility and density. By varying these parameters, it is possible to separate particles according to their magnetic properties. This article was authored by Shinji Bono and Satoshi Konishi.


Hi friends, welcome back to my channel and welcome if you are new here. It is holiday baking time. Woo, I'm so incredibly excited.  Once a week, you will get a fall baking series video. We're gonna use all the flavors of the holidays and we are going to make the most decadent desserts that are W.W. Friendly. So if you have a holiday gathering or party that you need to attend, you will have something that you can bring along with you that no one will ever know is W.W. Friendly and it'll help you stay on track. I can't wait for the 2019 holiday baking series. So let's jump right in to the first video of 2019. For the first video in the 2019 holiday baking series, I am going to be making a pumpkin cranberry bread. This recipe comes from my good friend Amanda Lewis over at RIP Fat Girl on Instagram and Amanda Lewis on YouTube. This is her recipe that she created. She said it was delicious. So I decided to put just a little bit of a spin on it and make it for my first video in 2019 holiday baking series. I can't wait to give you all the good recipes throughout this holiday season. So let me show you what is in our pumpkin cranberry bread. First, you're going to need some flour, sweetener alternative of your choice. I'm going to be doing a monk fruit sweetener, organic canned pumpkin or canned pumpkin, baking powder. I'm going to be adding a little bit of my Dax pumpkin pie seasoning to the recipe. This is a little spin on what she did. She did not use this, but this has such great flavor. And I think it's really going to bring out the pumpkin and the cranberry and give it that nice spice. So again, this is the Dax pumpkin spice. I love Dax seasonings. They have zero salt, no MSG. So they're fabulous before way in or if you watch your salt intake because the flavor is so good and so delicious. They are all natural. Like literally all that is in this seasoning is cinnamon, spices and honey. That's it. Very, very short ingredient list and it tastes amazing. The best pumpkin spice I've ever had. Dax has over 20 seasonings. So head on over and check out their website. Pick up yourself some Dax. You will not be sorry because I'm telling you best seasoning on the market and no salt makes it even better. So I'm going to add some of that. And then I'm also going to be adding in some ground cinnamon, almond extract, of course, cranberries and an egg. So let's get started on our pumpkin cranberry bread. So let's get started on this bread. So first we're going to mix our dry ingredients. I have one and a half cups of all purpose flour. I also have five tablespoons of a monk fruit sweetener. That's the sweetener alternative that I'm going to be using. We are also going to add in five tablespoons of baking powder. So quite a lot of baking powder. So let me get those five tablespoons in. Next we're going to go ahead and add in our pumpkin spice. I'm not going to measure. I just want to add this as that extra kick of spice and deliciousness. And then I'm also going to add in cinnamon like the original recipe just to kind of enhance that flavor a little bit more. And then lastly, we're going to add in some almond extract. And she had two teaspoons of almond extract. And then I'm going to, oh, that's all my almond extract. I'm going to give that a good stir. And then we are going to go ahead and mix in our cranberries, our pumpkin, and our eggs. So everything's nice and combined. We're going to go ahead and add in one half of a cup of pumpkin. I love the Trader Joe's organic pumpkin. If you guys have a Trader Joe's near you, it is the best canned pumpkin in my opinion. And it's less expensive than a lot of the store brands at your regular grocery store. So I have one half of a cup of that. I also have two eggs, so I'm going to add those. I am going to get this all mixed together before I add in my cranberries. I do just want to fold those in. So I don't want to over mix my bread and I don't want to over mix in those cranberries. As you start mixing, you'll see that you do need to add a little bit of water to help thin out your batter. So you're just going to add enough water to make it a thinner batter for a bread. So that is part of her recipe as well. You just want to make sure that you have a bread consistency of your batter and that it's not just really, really thick because we are going to put this into our bread loaf. So there we go. That looks pretty darn good. And now we're going to go ahead and fold in our cranberries. So about a half of a cup. Oh, that one doesn't look very good. There we go. About a half of a cup of fresh cranberries. And then we're ready to get this into our bread loaf. So let me pull out my loaf. We'll spray it with some non-stick cooking spray and let's get this bread ready to go into the oven. So now we're ready to get our mix into our loaf pan. So I went ahead and sprayed it with some non-stick cooking spray, grabbed out a spatula and we're just going to put our bread mix right into our loaf pan. I have my oven at 375 degrees and we are going to let this cook until we can insert a toothpick and it comes out clean. The cranberry bread is out of the oven. My house smells all things Christmas. So I'm going to let this cool for just a little bit and then I'll pop it out of the pan. We're going to cut it into 10 servings and then I'll be back to show you what that looks like and give you the smart points. So I cut our loaf into 10 equal servings. You can see the size of these slices and look at how delicious that looks. So let me get one slice plated up and I'll be back to show you the smart points. So here's one slice of the pumpkin cranberry bread. Look at how huge that slices and how delicious that looks. It is so moist, you guys, like so moist. I cannot believe how great this turned out. Way to go, Amanda on this recipe and then there's the additional nine slices. So one slice of the cranberry pumpkin bread is only three smart points and that is no matter what plan you're on. It is three smart points per slice. This huge piece for three smart points. Thank you for joining me on the 2019 kickoff video of the holiday baking series. This bread recipe was delicious. Warm it up with a little bit of, I can't believe it's not butter spray or spread and it is to die for. And three smart points for that big slice. Yes, please. You could even make these into mini loaves. There are so many variations that you could put on this bread. You could add nuts, you could make a glaze. Ah, it's endless the possibilities with this bread. So I hope you enjoyed the first video in the holiday baking series. Stay tuned every week for a new recipe coming your way. I hope you enjoy the holidays as much as I do and this just helps you make it a little bit more WWE friendly and helps you stay on plan just a little bit more. If you're new to my channel, welcome. Make sure you subscribe, hit the bell, that way you're notified when I upload. Thumbs up this video if you love holiday baking and of course comment down below and let me know how excited are you for this new series and leave the candy cane emoji so I know that you stayed till the very end. Thank you guys so much. Happy holidays and I'll see you next week.


and what a perfect day to offer the day and every day and the entire year to Jesus to learn how to forgive, how to release grievances, how to release resentments, basically how to release all judgment because when we really boil down the teachings of Jesus of forgiveness it's basically judge not and we know that when you judge you just are placing that judgment on your own self and you're you're basically feeling the the upset of attempting judgment. God didn't create us to judge so when we judge we're trying to do something that's very unnatural there's no judgment in heaven and in this world there's lots of judgments obviously and yet the Holy Spirit and Jesus can use that in terms of guidance to unwind your mind from this bad habit of ego judgments and wake up to the reality of spirit of love and joy of happiness true freedom you know that's good so here we are on day one and we're going to devote this year to miracles and to training our minds to forgive you know Jesus asked us to forgive you know even the Lord's Prayer forgive us our debts as we forgive our debtors let's let's let go of all the grievances and judgments this year and today is the first day of 2024 so it's a good way to start also we have an app available now it's it's actually an app website so it's called acimnow.app so you can go there and you can start off like I am doing today with lesson number one nothing I see means anything you can actually go through it and you can do the lesson yourself by reading it you can listen to me read the lesson on acimnow.app you can go and just dive into it and also on the app there is an oracle and the oracle when you click on the oracle button it will it will take you into various text or videos depending on which oracle you want to go into and basically it will help you expand your awareness of the teachings of Jesus if you looking for a video the oracle will take you into some videos that will help explain the teachings of Jesus and how to apply them in many many many different circumstances and situations sometimes we have the willingness in our heart to forgive but we need some context or sometimes we need a boost of motivation to help us forgive to help us release the judgment or the grievance that we're holding so this app is going to be very good for that it will be coming out eventually in the iOS apple iOS format and the google android formats where you'll be able to get them in you know in the app store or in google play and you'll be able to put them on your phone or on your tablet and and carry them around with you and use them without internet right now we have it available as a website acimnow.app on the website on the internet basically you can can use it to the max we do have a new feature that we're just adding for this year that you'll really like it's a chat bubble it's it's kind of kind of called a david ai chat that's available to answer your questions whatever your questions about a course of miracles or the teachings of Jesus may be you can just click on the chat bubble and ask your questions and receive answers directly so i know that's something a lot of you have been wanting is more access and more engagement so you can start the new year and go through the the day and on to the chat bubble and and start getting your answers to questions that you may have that's kind of a common way that people seem to learn they just practice teachings practice principles there are questions that arise there are curiosities that arise this is very much like with little children you know they have curiosities when you answer one question for them they often have more questions some of you who are parents who have children know that this is the way that it seems to go there's a lot of curiosity that gets stirred up with questions and answers so that's good so not only will the the chat bot answer questions for you but it would also recommend videos so it's a good way to tap in to many many different applications of the forgiveness and basically that's helpful because we need to transfer our training it's good we can forgive one particular situation one particular circumstance one particular setting maybe or institution or maybe you just are upset at society in general or the government in general or political leaders or whatever you know whatever enemies military leaders and rulers whatever you proceed you're dealing with or just the circumstances that you're dealing with in your day-to-day life are part of the surroundings that you are dealing with on a day-to-day basis this is really meant to be extremely practical so not only will your questions be answered by the clicking on the chat bubble the chat bot bubble but you can go and you can engage with it and it will recommend videos and then of course if you are curious about what's spoken about in those videos all the different transfer of training situations that we have as we really attempt to live the teachings of Jesus fully you know to to really go into the beatitudes of blessed are the pure of heart for they shall seek God if you're really wanting to use 2024 to go toward being blessed and pure of heart and and seeing no error that's the that's the highest teaching of Jesus is seeing no error in other words when you reach a state of mind where you are aware of the divine innocence of all and and I mean that you are in touch with the spirit you have tapped into the interpretation of the Holy Spirit for all situations you have joined with Jesus in your heart so fully so perfectly we'll say that that you don't see the error you don't see the error remember when Jesus spoke to the woman at the well and then there was a time also where he the Pharisees and scribes had brought a woman who they said we have caught her in the act of adultery and and Jesus just put something in the dirt with a stick and then he said he who is among you without sin cast the first stone and then all the men dropped their their stones and all of a sudden uh he turned and the woman herself said lord what do you have to say to me and he said go your way and sin no more really go your way and sin no more is be in touch with God be in touch with love eternal love be in touch with divine innocence be in touch with the original essence of of God's love and God's creation of pure spirit and understand that that pure spirit is who I am and who you are and who everyone is the beyond the body beyond the seeming differences is the the joy and the glory of of God's love and that's what we're here to do that's a great way to start the first day of 2024 just giving yourself over to okay here I am lord uh I offer you my heart I offer you my mind make a joyful noise come forth from me make my heart rest in also in your peace uh make my mind be still so that I may be still and know you as the lord thy god and may I may I know my identity as you truly created me that's really our prayer as we go into this so let's start off with lesson number one nothing I see means anything nothing I see in this room on this street from this window in this place means anything now look slowly around you and practice applying the idea very specifically to whatever you see this table does not mean anything this chair does not mean anything this hand does not mean anything this foot does not mean anything this pen does not mean anything then look farther away from your immediate area and apply the idea to a wider range that door does not mean anything that body does not mean anything that lamp does not mean anything. That sign does not mean anything. That shadow does not mean anything. Notice that these statements are not arranged in any order and make no allowance for the differences in the kinds of things to which they are applied. That is the purpose of the exercise. The statement is merely applied to anything you see. As you practice applying the idea for the day, use it totally indiscriminately. Do not attempt to apply it to everything you see for these exercises should not become ritualistic. Only be sure that nothing you see is specifically excluded. One thing is like another, as far as the application of the idea is concerned. Each of the first three lessons should not be done more than twice a day, preferably morning and evening. Nor should they be attempted for more than a minute or so unless that entails a sense of hurry. A comfortable sense of leisure is essential. So how beautiful that we have this tool for healing our minds, for tuning in with God. The reaction sometimes when people do lesson number one is like, oh my gosh, this is absurd. Nothing I see means anything. Actually, you are admitting there that the world of perception, the world of fragmented perception of war and disease, of pain and pleasure, of attack and defense, of victim-victimizer. You are admitting that that is absurd. That's a good thing when you start to look upon the world and admit that fragmented perception, the way that you perceive the world based on past learning is absurd. Let's even use the word ridiculous, okay? But you can't really be consistently happy until you tune into the internal guidance of the spirit that basically is guiding you to unwind from all false perceptions and open up to the joy and glee of heaven. And that's sweet. That's just super sweet. So what we're saying is this is the first day of practice to really live your life intrinsically. Live your life intuitively. Live a guided life. Live an inspired life. Live a joyful life that comes from inner listening and inner guidance. We don't have to react and respond to the images as if they're real. We can actually live a guided life instead. And the reason we don't want to react and respond to the images is because these images are the past and let's admit that our investment in the past has not brought us joy. And we want joy. We want to experience that joy. So, wow, 2024 we live in a modern era of technology and we have everything working for us. God is working in us through us, by us, near us, under us, over us, to the left, to the right, behind, forward. God is just pouring through sublimely to help us. And here we are in this age of technology where we have an iWatch and we have an iPhone.  Here's our ACM Now app. And then where we go, we go. Oh, looks like we needed to turn it this way. Now, now, let's see. That's it. So, we start off with a daily lesson.   And then we have the tribe of Christ. If you want to take some online courses, if you want to interact with other people that are doing these deep teachings of Jesus in a practical way, we have the tribe of Christ.  And there's a Jesus the Gospel of Love free simpler course. You can see the overview. You can replay it. You know, you've got options. But that's so simple as just putting it on your desktop and then clicking on your tribe of Christ here, your hub or your ACIM now about that. And then there you go. And you're in. And then you go through it. And I assure you all the support that you need, all the support, all the resources that you need, everything that you will seem to need in this glorious awakening is, is there. It's back to us now. It's at your fingertip. You know, want to read a lesson, want to listen to a lesson? Okay. You know, have some questions about it? Okay. Oh, like some parts of it. You want to highlight it and save the highlights there. It's right there on your phone. You can just check back. Maybe you find a particular quote or teaching from Jesus that's very inspiring. You want to just remember that all through the day. You just save it. Oh, go into your app. Oh, yeah, that's right. What was that again? That was a good one. So you go through it. You go through it.  There's lots and lots and lots of online ways to connect. And the platform we're using is Thinkific. And we're, we have the tribe of Christ. And we have, we have a Spanish tribe of Christ, Tribo de Cristo. We have a Portuguese tribe of Christ. There's a lot of people that are, that are interacting with each other and working through the lessons from the Course in Miracles, their insights. They are joining forces to be like, might say, mind training partners in this spiritual awakening. That's good. That's a sense of community. That's a sense of connectedness. That's a sense of collaboration. That's an answer to prayer. If you feel like this is a lonely, solitary journey, we, we all share the same mind. But if it feels very, very lonely, if you, if you feel like your individual journey is extremely lonely, then the Spirit has ways to connect, connect the dots and bring, bring the people together in an interactive way, a collaborative way that really works out beautifully. So it's just beautiful that we have this opportunity. And I just feel like the first day of the year for many people, they do either consciously or unconsciously. They have the New Year's resolutions. They start off thinking, okay, I want my life to be improved. I want my, my state of mind to be improved.  I want to feel joy more consistently. And, and this is a beautiful way of doing it. And be playful with it. Be spontaneous with it. You know, the Course in Miracles workbook lessons, Jesus only gives two instructions, you know, don't do more than one workbook lesson a day. And as best you can, try not to make any exceptions as you're practicing the workbook lesson a day. That's pretty simple. Two instructions and one simple lesson a day. You know, it's like, there's got to be a part of you in your heart that's like saying, I can do this. I can handle that in the seemingly complex world where you have to keep meeting needs over and over every day, a whole list of needs. It's nice to have a simple way out. It's nice to have a simple escape hatch where you can go inside to God and you can begin to identify and focus your mind like a laser beam on the kingdom of heaven within instead of all the shifting, changing images because there's not really a constancy in the, in the world of separation, but, but the constancy of purpose, only a constant purpose, Jesus tells us can endow events with stable meaning. So we want a stable perception because we want to be stably peace of minded. We want, we want stability in our heart, in our heart of hearts. That's what we want. And we're here to join together. So thank you. God bless you. Enjoy the day. Enjoy your mind training practice. Join with me in getting your phone out and opening up your app and, and jumping in. That's the way to do it. Okay. Lots of love.


Hello and welcome to the course probability methods in civil engineering. This course is basically based on some newer concept in civil engineering and as you know that civil engineering is one of the core engineering discipline and in civil engineering there are several specializations. For instance, structural engineering, water resources engineering, geotechnical engineering, environmental engineering, transportation engineering and the list goes on. But when I deal with any real life problem in any of the specialized area we always come across with some sort of uncertainty. So, the focus of this particular course is mainly target towards the dealing with this uncertainty through some probability methods. So, in this course some basic concept as well as some advanced tool and probability methods will be demonstrated. At the end of each topic or module there are some real life problems will be demonstrated to benefit the audience of this course. In general the course is designed in such a way that it will be benefited to wide range of the students as well as community. The advanced methods and the real life problem demonstration will be helpful to the postgraduate students and the practitioners. However, at the same time the basic concepts and the applications will be helpful to the undergraduate students as well. I welcome you all to this course.


You guys are at DEF CON, I didn't know if you know that. Uh, Saturday morning. Uh, we've got a fantastic talk. Uh, this guy has presented with us before. Uh, he's coming back to, uh, talk to you about, uh, it's a remote hacking remote car starters. Yep. Perfect. Uh, so without further ado, I will let Jmax get to it. Uh, let's give him a big round of applause. Thank you. How's everyone's DEF CON going? Really? Let's try that again. How's everyone's DEF CON going? Okay. So my name's Jmax. I'm a software engineer by trade, hacker by passion. Um, I pretty much like anything to do with locks. And, um, throughout this talk you're going to hear lots of opinions. Those opinions are my own. They're not my current employer, past employers, or future employers' opinions. Louder? Okay. All the opinions are my own. Summary of the last statement. Um, if you like what you see, or you don't like what you see, hit me up on Twitter. Um, handles at Jmax. Um, I'll try to get back to you. So a little bit on the backstory here. As you probably figured out, this talks about cars. Um, but it's not about cars themselves. It's about aftermarket, uh, remote starters and alarm systems. And I think it's important to provide a little backstory here because we may look at these devices and think they're, um, some of a luxury item who would really want that. Um, so I want to tell you how I got into looking at these. So I live, it's cold. Um, some would say really cold. And my girlfriend has a condition called Ramon Syndrome. And what that is is the blood vessels in her extremities will constrict, uh, if she gets cold. And that can cut off blood flow to her hands for example. And if you go without blood flow in your hands for a while you can end up with something very similar to frostbite. Um, and it's about November of last year. And I haven't figured out what I'm going to get her for Christmas yet. And she comes home from the airport, uh, one week after traveling for work. Um, and she gets home and she's very upset because her car never warmed up on the way home. At that point I say okay, I figured out I know what I'm going to get her. I'm going to get a remote car starter. And so I start looking around at all the various options out there for remote starters and there's a lot of them. And I notice that quite a few of them won't give you the consumer information. They won't give you access to how to install it. They won't give you access to the tool chains you need, um, to program the unit. Um, and that's kind of a problem for me. It's my car. It's my remote starter. I should have access to those tools. So I look around a bit more and I find a company out of Canada, Fortin, who makes a remote starter and they provide, uh, documentation fairly willingly. Not only for how to install the, um, the unit in various cars, but also the tools you need to program the unit. And so I'm like that's perfect. Um, that's what I'm going to get. And I start looking around for remotes. So with remote starters, while you could use the factory remote, your range would then be limited to the factory remote. And you can get aftermarket remotes with these units and they'll have advertised ranges anywhere from like half a mile to a mile and a half. Um, but from the reviews it's apparent that those are advertised ranges and in the real world you see much less than that. And the problem is, as I said, she travels for work a lot.  There's a lot of concrete. So I'm thinking about like, you know, what would be great is if she could just pull out her phone, open app on the phone and hit start. Um, and so I look around, uh, Fortin's list of third party vendors who integrate with their system. And I find this one called my car. And what it is, is a little cellular unit with a GPS in it that you can put in the car and you hook up to the remote starter. And then this provides the capability of being able to pull up your car, uh, in an app on your phone as a picture of what your car should look like based on its make and model. You can start the car, unlock the car, um, do anything you could do with a keyfob. I'm like, that's perfect. When the plane lands you'll be able to start a car by the time she gets to it, it should be warm. So at this point, let's talk a little bit about how remote starters work. In order to understand remote starters, we first have to understand how cars start. Traditionally, cars start off using a keyed switch. It's just a keyed switch. There's nothing fancy there. And when you put your key in the ignition, you are completing a circuit when you turn it. So when you turn it to the accessory position, you're completing a circuit that will power up the interior of your car. When you turn it to the crank position, you're powering up the starter motor. And this was true up until around the mid 90s. Around that time, vehicle mobilizers started to become fairly popular on the U.S. market. And in a mobilizer, well, it may sound fancy it's just an electronic lock. So you have the mechanical lock that is the key. And then you have an electronic lock, um, that is a transponder and something to read that. Um, and if you don't unlock the electronic lock, your car won't start. So in the slide here, on the, uh, left side, there's a key with a over molding. And there's, on the right side, there's a key with, it's just a metal insert. The one on the right will just actuate the mechanical components. Whereas the one on the left can actually unlock that electronic lock that allows your car to start. So why do I mention this? Well, remote starters today have to bypass the immobilizer. It's necessary for the remote starter to work if you want it to work in a modern car. And so if we look at how you could hook one of these systems up to your car, um, here's an example from Forden's documentation showing how the unit I got, the evil one, gets hooked up. So on the lower left side, there's a couple lines that are labeled IMO. And those have to do with dealing with the vehicle immobilizer. And then if you go to the very top on the right side, there's a couple lines labeled can high and low. And those are connections to the vehicle's CAN bus. The reason remote starters connect to the CAN bus is to reduce installation cost. Because it's fewer, it's fewer connections, your installer has to make. So if they can read data off the CAN bus or they can send commands over the CAN bus, they're motivated to do that. Because again, it reduces installation times. On the, uh, left side of the screen at the very top, there's a bunch of GPIO. These are just related to controlling or reading information about the car. So for example, uh, when you hit the lock button, maybe you want the lights to flash and the horned honk, um, that can be controlled through these GPIO. And then at the bottom on that side, that big clunky connector is the high current interface. And what that does is bypass the mechanical side. So as I said, when you turn your key, you are completing a circuit. Um, that big chunky con- connector there allows those circuits to be completed with simple relays inside of the remote start unit. So here's just a couple pictures from, um, installing the remote starter. Uh, basically it just consists of pulling off the steering wheel column, making a couple electrical connections in the, um, foot well. Um, it's really not that complicated. It looks fairly daunting, but it's not that hard to do. The remotes themselves get hooked up over what Fording calls data link. Um, it's a proprietary protocol. Um, really it's just five volt UR running at 9600 BOD. Um, and it just connects via a bus. So these two remotes here that I'm showing, we'd be connected to the same UR connection. So sometime after installing the unit, it, I start thinking, you know, I, I wonder how this affects the security of that vehicle. Obviously it has to bypass the immobilizer, but, uh, how secure is this? Um, not only the cellular side, but the remote start side. So I start looking online to see if maybe Fording publishes the protocol for their data link. Um, so I can start looking at it from that side. And I go to the forums and people have actually asked for the protocol and consistently they're told, no, we don't give out that information. One of the more entertaining responses I saw with it was this one where they say, the Evo is not meant to be used as a hobbyist toy. It's meant to be used as a tool by professionals. So, I'm a professional of sorts. I said about building my own car on my workbench. So I got a second unit, put together a breadboard that represented a car, some switches to represent the ignition, momentary buttons to represent the brake pedals and bunch of LEDs to represent various states. Um, I get everything wired up and I hook up a FTDI device to start monitoring the data link. And I'm capturing data and at first it looks something like this. I mean, okay, it's not really apparent what's going on here, but if you squint your eyes just right, you can tell there's definitely some structure here. Um, paying a bit more attention, I noticed that whenever I press a button on my remote, the message that is sent by the antenna to the remote start unit always starts with 0C and ends with 0D. So if we just split what we're receiving based on 0C being the start and 0D being the end, we end up with something more like this. At this point it's clear there's some structure here and we can figure out what's going on. So putting in a bit more time and being a bit more diligent about keeping track of what button I pressed and what message I saw, eventually I'm able to put together a spreadsheet where I, um, figure out what each of the commands and each of the messages look like. And so here's just a simple breakdown of what a typical command looks like over the data link protocol. When you press a button on your remote, the antenna sends the remote start unit a command that looks like this. So you have a start sentinel, that's at 0C, you have two bytes that represents the direction or at least I think that's what it represents. Um, that's somewhat interesting because UART is already directional, there's already a transmitter received line. Um, so that's why I've labeled it garbage, just treated it as a constant. Um, following that we have a single byte that represents the command the user would like to run. So this could be unlock, it could be lock, it could be start, stop, panic, anything that you can do from the remote, um, will have a command associated with it. Following that we have a payload. Um, in the case of messages coming from an antenna to the remote start unit, this payload is almost always going to be an address or ID that identifies the remote or antenna that the message came from. If the remote start unit doesn't recognize an ID, it will ignore the command. And to get a remote start unit to recognize the ID, there's a multi-step procedure that involves putting the key in the ignition, turning it on or to the accessory position, and then hitting the break pedal some number of times, pressing some buttons or modes. Um, it's a procedure, doesn't really matter, but it learns the ID at that point. And then if we look at the end of the message, it ends with a checksum and that end sentinel that we, um, identified earlier. So now that we understand how the protocol works, what can we do with it? So, to show this I have a couple videos. Uh, do we have sound? Let's try this again. Is that not fine? Guys, anything? It's playing. Presentation view, it's got. Let's do this. Okay. Let's try this again. Still no sound. It's plugged in. Okay, I guess we're just going to be talking through this then. Um, so what I was showing you there is the, we'll scrub back. Okay, so that white box there is a development board I have that's running, that is a particle development board that's running firmware I wrote that understands the Fortin protocol and allows me to interact with the, um, the Fortin remote start unit. So, what I'm showing here is I send an unlock command to the car. Um, well, you should have seen the command in the previous one, the unlock command doesn't work because the remote started doesn't yet know about that antenna. So as I mentioned, it's just you are. And one of the things with remote start units is they often support what's called two-way communication. So they're able to tell the remote about the state of the car. For example, if the car started or stopped. And to do this, it actually set the remote starter sends a message back to the antenna. And when they do this, they include the address of the antenna they would like to send the message to. Now the problem here is because that's going over the U.R. connection and it's a flat bus, anyone on that bus can see the address being sent. So in my firmware, I have the capability to clone an address. So if we turn on the clone mode, at this point I'd really like sound. Um, so the, at this point we need to generate a message. To generate a message, um, we can just simply open the car's door. So by opening the car's door, uh, the car sends the remote starter a message, or sends the antenna a message saying that the door has been opened. At this point in the video, the alarm is going off. You'll just have to take my word for it, but it is. Um, and we've also managed to clone the antenna because it's attempted to communicate, or clone the ID because they attempted to communicate with the antenna. Now when we send unlock, the alarm shuts off and the car unlocks. Okay, let's try this again. I won't want, it's going, we don't hear anything. Okay, so where's my mouse? Okay, I'll let you see the- So what we have here is a super impresa that has a 4 in 1 remote starting alarm system installed and plugged into the antenna data link bus. I have my particle. And if we send an unlock command from the particle, um, you'll send the command, but nothing will happen. What we can do then is we can just clone an existing antenna. So if we, um, tell the firmware that, hey, we want to clone, um, an existing antenna, now we just need to generate a message that is going to call the remote start unit to reach out to one of the antennas and try to tell it something. So in this case, that's as simple as opening the door. Now the alarm may be going off, but we've managed to clone the address. Now we can just send an unlock command and we've unlocked the car and disabled the alarm. So at this point, we've managed to send a command to the remote start system, get to honor it all without the key. So now let's try starting the car. Okay, now let's say we want to actually start the car. Normally, um, if we just type start and we try to run the start command, it won't work. And the reason is this car is a manual transmission. And remote start systems, um, will normally have a special procedure when it comes to manual transmissions. In this case, it's, you have to, uh, with the key and the ignition, um, hit the remote start button while the car is running.  And this is to keep the car from ever remote starting while it's in drive because that's dangerous. However, it's not really a security feature. And to prove that, it's as simple as, if we take a look at one of these remote start units, um, what makes it, um, work in the manual transmission mode is this loop of wire here. If you cut this loop of wire, it switches to the automatic, uh, transmission mode. And that case doesn't require any special setup. So we just saw the start didn't do anything. So what I'm going to do is I'm going to return to the dash. I'm going to cut this connection, um, to make that easy for this demo. I just install a switch on this loop. Okay, the connection's been cut. Now, if we rerun the start command, this time, the car starts right up. So at this point, we have a car that we can start. Um, we can add the remote to it. We can start it without a key. Um, but if you have a remote start unit, you know that that's not everything you need to do. There's normally a key takeover procedure. You normally, well, you shouldn't be able to drive away on a car that's remote start. But let's say we want to drive away on a car that was remote started. How would we do that? One of these times I could feel something. So to disable the wheel lock, um, I've put a normal key in the ignition. This does not have the transponder in it. So it cannot actually be used to start the car. However, we have it in the ignition, and we actually only have it in the accessory position. And that is enough to disable the, the wheel lock on the superroom presa. Um, you don't have to go all the way to ignition to get the wheel lock to cut off. Um, and now, okay, sorry, not my computer. Don't know what's going on there. Okay. I want this video. Let's try this again. There we go. So now that we have the car started without a key, let's say we want to drive off. This is where it gets a little bit tricky because these remote start systems will have some form of key takeover. And what that means is we can, the owner can put the key in the ignition, turn it to the ignition setting, and then transfer over to that. Um, but if we don't have the key, the moment we press the brake pedal to drive off, the car will shut down. Now, if we want to get around that, it's fairly simple. We just have to figure out how the car is telling the remote starter, um, that the brake is being pressed. In this case, that's happening over CAN bus and plugged into one of these ports back here is the CAN bus connection. And if we just unplug that while the car is remote started, um, you'll no longer care if the brake is being pressed. Now, because that's under the dash, what I'm going to do here is I'm going to, um, start and unlock the car so I can get out and get that disabled. I'll show you that in a second. Okay. Now we're under the dash here and I have my remote starter, um, right down here. And there's a little white connector here. And that's the connection to the CAN bus. If I unplug that, you'll see that the car is still running and we still do not have a key in the ignition.  And that's because it doesn't know the brake pedal is being pressed. So at this point, we can get in the car, we can put the car in drive, and we can proceed to drive off in the car. All without a key. Okay, so there's an important note to make there. Um, and that was that click you heard at the end. That was actually the wheel lock of the car itself engaging. So the wheel lock is entirely mechanical. So we can't defeat that electronically here. Um, you would have to use something mechanical to get around that. So breaking the cylinder or something else. Something I really wasn't interested in doing in her car. So all the firmware for what I demoed is available out on GitHub. It'll be made public after this talk. You just go to github.com forward slash jmax open remote start. Um, you'll find the fur- the firmware I was using along with the schematic, um, for my little dot board there. But now let's get on what you're really here for. Which is what happens when we add the internet to this system. Cause that should make it better, right? Um, as I mentioned, the unit I got is the my car unit. But my car is sold under many different names. And the unit I got was branded link R L T by omega. But this isn't the only brand name it's sold under. It's sold under my car, um, my car vision, car link, link R. Um, but also Kia. It seems for a while Kia dealerships in Canada were installing this system. Or at least that's what the my car Kia app seemed to imply based on subscription. Interestingly, that application is no longer available in the app store. I also want to note that while I'm just looking at my car and Ford in here, um, that doesn't necessarily mean other systems are better. At the same time I was doing this research, Cyber Gibbons and Pentest partners were looking at other systems with similar capabilities. Um, and they found very similar issues with those systems as well. Which brings me to the real question. The thing I want everyone to be thinking about, which is how does this happen? How does a product with the issues I'm about to show you make it to market, um, without anyone saying anything? And if anyone here has an interested looking at remote car starters, there's a couple things I want to point out. Um, first as I mentioned earlier, if a remote start system is misinstalled in a manual transmission vehicle, it's possible that the car can start while in gear. Um, this means the car can actually begin moving and the engine can actually start up. Um, and now you have a car that's moving without anyone behind the wheel. Um, so that's obviously dangerous. Um, but there's actually a more subtle and I think, uh, bigger risk. And that's, if someone parks a car with a remote start system in an attached garage and it's remote started, um, accidentally or without their knowledge, carbon monoxide can enter the home. And that can create a very dangerous situation. So if you do have a remote start system, you should definitely have carbon monoxide detectors. Um, but also if you are looking at a remote car start system, just like with locks, never start a car you don't own and that you don't know where it is. Um, because the consequences could be dire. So looking at the my car unit, it's this little black box with this eight pin header. Two of those pins are actually for a debug interface. Um, connecting to this debug interface, it's obvious the unit is running Linux. A fact which, as far as I can tell, the manufacturer does not disclose. Um, if you want to drop into the Linux shell, uh, the password is actually OELinux123. Um, so if you do get one of these, there you go. Um, but without logging in, you can use something they called the AT engine. And this lets you run AT style commands on the command line so you can do things like change the IP address the unit is talking to. And if we look at the diagram at the bottom where it says IP, this is actually the server that the my car unit talks to to communicate updates. Um, and just underneath that there's an L port, that's the port that this is listening on to receive commands. By using the AT engine and changing the IP this was talking to, changing it from one that my car controlled to one I controlled, I was able to determine that this device is talking via unencrypted UDP. Um, I didn't do much looking into that, but I thought that was fairly, um, significant and interesting. So here's some more information on this if you want to pick one of these up. Um, couple things to note, uh, voltage kind of matters on that UART and well son the documentation seemed to imply it could be tolerant of much higher voltages. And the next story I'll tell you shows that, eh, you gotta be a little bit more careful. So as I said, where I live, it gets cold. And about, about a month after I gave the system to my girlfriend, my curiosity got the better of me. When I installed the system, I had a nagging suspicion that is opening her up to some security risks. But I said, you know, don't look at ignorance as bliss, just don't think about it, just don't think about it, and I was able to do that for about a month. And after a month, I pulled the cellular unit out of her car, put it on my bench and started playing with it. And the forecast for the next week was cold, negative 30 Fahrenheit. Um, and you know, I was able to connect to the shell, get working, and the cellular reception in my home lab is not that great. Um, so at some point I decided I want to work on it with a different computer. And the FTDI device I'm using doesn't have a particularly long cord, so I go find a different one, plug it in my computer, plug it into the remote start unit, power everything up, and all the magic smoke leaves the unit. And she's flying out tomorrow. Um, so at that point there's a lesson learned there. Um, if you want to do any type of hardware hacking and you can't afford to lose the unit, always have a spare. Um, but if you ask, ask my girlfriend, the moral of the story may be, if you're significant another is a hacker, don't let them play with your Christmas presents. So now let's look at the software. Um, no chance of magic smoke here I hope. Uh, the, I, I fire a man in the middle proxy, I disable SSL, validation on my phone and begin sniffing what traffic is being sent by the application to the back end. And during the registration process I noticed it takes my email address, sends it to a web service to check to see if that email address is tied to an existing account. And it's using basic authentication, which is interesting because I haven't created an account yet. So I don't really know what to do with that and kinda just file, file it away in, in a notepad and move on. I create my account, I log in and one of the first things you do, the application does when you log in is it calls a web service to check who the current user is. So I just call that web service with the credentials that I saw earlier that were used to check to see if my email address exists. And the response that I get back is my car admin. Now at this point I really don't think this is the admin because this has to be a low privileged account with a really important sounding title. After all we all know people like this. So I create another request to start my car using this account. I hit send and I get back 200 ok. And about three seconds later my car starts right up. So it turns out the my car admin account was an admin account. Hardcoded into the mobile application. But it doesn't stop there. In the previous response you may have seen this thing called API key. Again from monitoring traffic with man in the middle proxy. I know that you can use these API keys in place of a username and password. If you use the fixed username API and one of these API keys you can authenticate as that user. So I copy and paste this, this string into the password field on postman. Set my username to API and I hit send and it doesn't work. I don't get back a response. And I don't really know what's going on. I'm a little confused. I stare at it for probably a good five minutes and then it dawns on me. I forgot to strip the quotes and the comma from API key. And looking at the response there's a sequel error. At this point it's apparent that you could just could have just used basic sequel injection to bypass the entire login process and become the admin or any user you wanted. Like this is not at all complicated. So let's have some fun with sequel injection. I don't think anyone's ever started a car with sequel injection before. So let's try that. So I craft a sequel injection that targets my user account, skips the whole password thing. We'll just use sequel injection for that. Hit send. I get back my, my status 200 okay. But this time I was smart enough to record a video. Now it's a little, the video is a little dark because I didn't realize I was going to be doing this talk at that time so. So this works the correct side. Just start via sequel injection. Sorry one of these times I'll get this right. Okay where is the window? And it looks like the command was sent. So this is in my office looking outside. You can see the reflection my computer screen there. And there the car was starting. Okay so there we go. We've started a car with sequel injection. But it really doesn't stop there. They didn't just have sequel injection in the login. They had sequel injection everywhere. Whether it be the URL path query string parameters bodies. It seemed like everywhere you looked there was sequel injection. And looking at the error messages from the from looking at the sequel error messages we can see that what we're entering as a, as a password is being compared directly against a column named password in the database. So what this means is they have plain text passwords and sequel injection. As they say not good very bad. Okay so that's enough of that sequel injection stuff. Let's see what else we can do. So as I showed before here's how you remote start a car. Um you just post a command to this commands API saying your command type of engine start. And you get back in integer ID representing the command ID. You can then pull a service with uh you can then pull a service to get the status of that command. And it looks something like this. And so you know I get the thinking and I increment and decrement my command ID and I notice I get responses back. It seems to be pulling any command ID. Try a couple more values and sure enough it's pulling back any command ID in the sys or any command that's ever been sent in the system. Now there's not really anything sensitive here. So it's not really that big of a deal but I get to thinking maybe there's um a direct object reference that I could use to start my car. So I take the start command from a legitimate user for my user account and try to call it via my second user account that shouldn't have access. And I get back an error message saying 401 unauthorized account out of hierarchy. So maybe it won't work. However if you look at that API there's actually duplicate information. The user's email address and their account ID are roughly corollary. Both specify a user. And if you design APIs or rather if you hack APIs duplicate information is a source of bugs. In this case a developer could implement this in these four different ways. So if we look at cases 2 and case 3 both highlighted in red those will result in direct object reference. Both of those don't properly check to see if we're authorized to run the command. So what we can do so we try case 2 it didn't work what about case 3? To try case 3 we simply have to change the account ID in the URL. Previously we're using the victim's account ID. Let's just use the attacker's account ID. So I set the account ID to be the attacker's account ID rather than the victims. Keep the device ID as the victim's device and send the command. And sure enough 200 okay. I get back my command status and a couple seconds later my car starts right up. So what does this mean? So via three different vectors we're able to basically do anything a legitimate user can do. But let's call out what that is. We can locate any vehicle in the service. We can identify uh the type of vehicle that is. Make a model. We can unlock the car. We can start the car. Um we can edit the car. We can do anything. And 3 there's 3 different ways of doing this. So obviously my car tried to fix some of this. Um in the case of the uh hard coded passwords it seems they just put a reverse proxy out in front of the application to hide the credentials they were using. Well you see there's a problem with this. Reverse proxies aren't magic and they don't fix everything. And in this case they kept the SQL injection in the backing service. And so while I no longer have the password I still have had no off that I still with no authentication could do SQL injection via the check user. So that was interesting and at that point I decided okay let's see what else is here. Let's see if they left more. And the device registration still seemed to have SQL injection. And both of these things still seem to be still seem to be vulnerable up until about 36 to 24 hours ago. So um yeah. So googling around you may have noticed all the URLs here are m2msuite.com. And so I decided I'd hit google and search for m2msuite. And it came up with this um site. This must be some type of back end interface for the my car system. And so obviously the only thing one should do when they see this is throw a couple single quotes in there and see what happens. And of course what happens is you get SQL injection. And this is months after the initial disclosure that they had a problem with SQL injection. Um so if you have SQL injection you should really fix it as soon as possible. Um but none of this is what I consider to be the most offensive bit of this all. And that's actually has to do with location. So my car has a GPS unit it can track the location of car and in their application they will gladly show you your car's current location. And that's the only way this gets used in the application. Now if we look at their API's it's not just your car's current location. They seem to be storing a heck of a lot of information. Uh much more than what is needed to keep track of your car's current location. In the case of my account over the span of 13 days they have a little under 2000 data points about my vehicle's location. None of this was disclosed in their privacy policy. But it gets worse than that. Maybe you could argue this was a development mistake. Maybe this is a side effect of the way the service is implemented. There's another API where they analyze your data. And instead of just having a list of places you've been they identify top locations your vehicle has been. Frequent places you visit. Again to my knowledge this is not disclosed in the privacy policy. I can't find anything there that would um indicate they were going to do this. So maybe this isn't that surprising though. Because after a bunch of searching I believe I found the parent company of my car. And their company called Procon Analytics. And so I went to their site and went to the frequently asked question page and and looked at the question how do you secure data? And to this they said unlike public cloud environments that battle for priority Procon Analytics uses virtual private cloud that supports only our customers and applications. With no interference from other users this dedicated highly secure environment ensures higher availability faster delivery of service. When you partner with Procon Analytics you can be assured your data is secure and protected. I really don't even know what to say to that. But if we head over to their Facebook page they say more. There they simply say protecting vehicle data is vital. And to that I have to say I agree. So back to the question that that I said at the beginning of this talk. How does this happen? And maybe more importantly as an industry how do we stop this from happening again? And so that's my talk and at this point I'll take any questions you have. Okay so the question is did they fix everything? At this point I believe everything I reported is fixed on the my car side with the exception of the privacy stuff I mentioned at the end. Last I checked that was all still the case. I don't know. I don't have any vectors that I know of that generate SQL error messages though I haven't looked too hard. Could you come closer so I can hear you? Sure. So when I said I could edit the car the question about was when you said you could add the car could you edit parameters in like the ECU? What I specifically referring to there was editing the car in the my car service. So they keep a digital representation of your car and so that could have been edited via the direct object reference, SQL injection or any of the other vectors discussed. So the question was about do you know if a push button start system will allow you to unlock the steering wheel to get around the steering wheel lock. So my car has a push button and there is no steering wheel lock. So I suspect that if you installed one of these in a push button car you definitely couldn't rely on a steering wheel lock. Cool. Thank you.


Hello, this is Laptop Media, and today, we will show you how to open the Lenovo Ideapad Slim 516 and what's inside of it. To access this notebook's internals, you need to undo a total of 9 Torx head screws. Then, pry the bottom panel, starting from the back. Please remember, it would be of great help to us if you just hit the like button and subscribe to our channel. That would motivate us to make even more and better videos for you. Our configuration is equipped with a 75.4Wh battery pack. It lasts for 14 hours of web browsing, or 11 hours of video playback. To take it out, unplug the battery connector, and undo the 5 Phillips head screws that keep the unit in place. Here, the memory is soldered to the motherboard. You can either get 8GB of single channel or 16GB of dual channel RAM. Storage wise, there is 1 M.2 PCIe x4 slot, which works with Gen3 SSDs. As for cooling, you get 2 heat pipes, 1 heat sink, and 1 fan. In addition, the VRMs are cooled by a heat spreader. If you'd like to see more disassembly videos of the latest notebooks, we would highly appreciate if you hit the like button and subscribe to the channel.


What's to stop Biden from ignoring the debt ceiling and continuing to pay America's bills? Nothing. He's constitutionally obligated to do so. And there's at least one precedent for the executive branch doing whatever it takes to avoid default. Guess who said it? During a 1985 budget dispute, Reagan's Treasury Secretary borrowed from the Social Security Trust Fund to keep the nation's bills paid. The U.S. Comptroller General later found this to be illegal but said it was not unreasonable given the circumstances. Will Biden have to resort to such measures? Well, we'll see. The lesson here is there is not a specific date when the Treasury runs dry, just ever more extreme bookkeeping measures to keep paying our bills. If MAGA Republicans don't like this and want to force the U.S. into default, wrecking the economy and putting millions of Americans out of work, let them take Biden to court. Let them demand publicly that he should not honor the full faith and credit of the United States. This is a Republican manufactured crisis. Let them own it.