July is going to be hotter than ever because you get up to $50 off any smartphone at Appalachian Wireless to your agreement required. Better service? Bigger savings? That's today's Appalachian Wireless, an East Kentucky network company. The City of Pikeville Police Department is teaming up with the Criminal Justice Training Department this week for diminishable skills, training classes, and workshops. The classes are held in downtown Pikeville at the Hilton Garden Inn and the workshops will take place in various locations in Pikeville. What we want to do is keep names of police officers off the memorial walls so we provide them those diminishable skills, those skills that they lose the mindset a little bit, get them back to where they're more proficient. There are roughly 20 individuals participating in the event and those in attendance come from numerous police agencies around the region. Law enforcement officials in attendance will experience hands-on training in legal updates, first aid, defensive tactics, decision making, and proper stop etiquette. Workshops will include a driving track and firing range. And what we've went to is a regional training style so it frees up agencies for having to send people long distances, have hotels and meals at an expense. We bring our staff, we partner with Pikeville's staff here to provide the training. Officials say not only is the workshop important to those in law enforcement, but also for everyone in the community. It's very important for officers to keep up their firearm skills, their driving skills, their defensive tactics skills, their first aid skills. All those skills are important not to only keep themselves, but their brothers and uniforms safe, but the community members that they serve safe. The workshop will last until Friday evening. Reporting in Pikeville, I'm Shelby Still for EKB News.


The following is a presentation of TFNN The Trader's Edge with Steve Rhodes at 1-877-927-6648 or internationally at<PHONE_NUMBER> The Trader's Edge now Steve Rhodes Hi everyone, it's not Steve Rhodes for Mastering Probability it's Basel Chapman just continuing my show from the Tiger Technicians Hour a few moments ago I wanted to do this because I just had so many questions coming in about stocks I wanted to look at the overall market in my show you can listen to the the replay where I'm looking at what's going on I think we're getting a little tight on this fabulous up move it's really it's been very impressive and it says to me you're raising the base of support however we need to see how we get into this first week of September let me just run these and let me just show you here for months now I think it's more weeks but it probably is about six weeks ago there was a trend line that I said I'm drawing this in here in the e-mini it was in the middle of a very narrow long rectangle it's a technique that I use in the travel wave methodology but I said I'm just going to keep it I'm going to put it in it'll disappear and when it comes back it's going to become very important and that was a trend line horizontal long-term trend line that it will just keep going because I've got it here as a permanent trend line at 45 30 well we weren't even close then yesterday we started to climb and we got to it then we went over and then around and here we are it became important just today in the one-minute chart alone look how many times I don't want to count the number of watts but look at this gray line and look how many times so it's very often that you can take a particular candle a particular gap a particular technical tool like a moving average or whatever it is and just identify something within it to say you know in my experience I think this is going to keep coming back as a magnet and that's exactly what it's doing right here okay we're done with that now a whole bunch of stocks let's go through this one at a time we'll live from where we left off LAC was a question LAC is a symbol um lithium america corporation had a higher 4156 back in november of 2021 made a double top and if you look at the double top this is a technique I like to use we're going to treat this as an educational show as well just in terms of what you can look at to really help you with you look at the way the first high in november at 41 in the 41s look at the MACD how strong it was look at that green nine-period moving enemy get to the pointer look at that MACD strong nine-period differential it's called and the 26-period moving average red one look at that when it went to the second high it already started turning down in fact it was on its way down but look at the double top in the on balance volume look at the way the sarcastic this little red and green group here look how it made a perfect high right yet 41 56 when we went to that next high it failed and that just said to you be careful because if you start to see this green nine-period moving average flip to pink which it did a couple of months ago it means that in monthly chart it's in a big digestive phase so you've got this trend line that I've got here in the weekly chart let me just I don't even know where it starts I'm just going to grab it right there and continue it right along there just a diagonal and it hit it exactly normally in this kind of pattern what I do is I make that red I make this green I say to my eye that's called the Chapman wave inside track propellant zone it fails if it starts to close under this red or pink line this is green and it went right into it now I can open it up and show you there's your double top look at the fantastic differential between the strong technicals back at that high in November sorry December we could December the 12th December the 3rd and look at this this is in April the 8th look how weak all these things are and within three weeks you got that nine-period four weeks you got the nine-period moving average crossing negative look at that but look it's actually held quite well if you're looking at this low right here if I was to draw in left side right side price time match there's bar symmetry I could grab that grab that to me that looks close but you're probably going to just miss it because it doesn't get there so here we go look there we go right there yeah this is it's exactly in this week well this week it's not going to touch that so so far that's a positive divergence in the weekly chart of LAC Lithium America so let's go on let's look at the daily chart daily chart is a very nice turnaround the on balance volume didn't make it this it's very rare for the stochastic to give you almost the exact bottom and look at this it's one day it was one day early it was hinting there was going to be a big turn that doesn't happen because these are lagging indicators look at this one right here you see there's the high and then it took a little while to turn down so this is a good sign and the nine the pink nine-prime moving average is close to going green but the speed and the power to go to the upside with a mag d says that you know what it's probably going to stall at that left side high of four on the 14th of august at 18.55 today's high is 18.53 it's very good action but it's got a stall emotion so i'm going to put this down here it's one that i'm going to follow what's the price 18.39 at 18.39 uh big question mark okay so that's there so what you want to see is 1785 of the moving average support levels i don't want you to even get there on any pullback 1837 was the 18 sorry 1806 was the low yesterday i don't want to see that taken out because taking our next two days you will test these and then it'll take a little time if in fact it just even doesn't pull back but it actually makes a higher high tomorrow that's going to be very positive the weekly chart says wow there's a lot of work to be done but go one step at a time so the questioner said um in it you're in it i would not add to this yet i would just keep that position you'll have plenty of time to add to this because if if the stochastic 66 actually gets to 80 percent or more by next tuesday this thing is going to go very quickly into the 19s and that's what you want to see next question um going at a time uh it was m oh i wrote that wrong mr dy i believe it is mr dy let's just check to see no it was tuesday morning monday morning let me just get that symbol again uh mnd y how wait wait how did i get so many so different oh mnd y mandy that's right mnd y very nice legs legs see in the chapwave a daily chart i drew this oval in because this could become a stork leg formation i don't want to go through that now it's called the chapwave stork leg it looks like a long leg then it's got the long oval body but it cannot at this point it cannot take out that low that'll spoil it but it could take out that high and that'll be good so monday dot com i can't remember i i looked it up and now i can't remember what exactly they do it doesn't matter what they do that monthly chart is improving a lot look it's walking the nine period moving average i like this very much it needs to hold it's 178 it needs to hold 170 74.50 all of next week if it pulls back below that that's the problem but if it just can't leave wait a minute mistake this is a leg deep you're always looking for leg deep good i'm pleased i caught that i'll be back basal champion this is not mastery probability for basal champion sitting in for steve's hour i'll be back currencies commodities and bond markets are as important as ever right now with how they're driving the volatility in equity markets across the globe which is why it's a great time to try out teddy keg stats tiger forex report teddy keg stat breaks down the forex markets every monday using his 30 plus years of experience as a trading veteran of futures forex stocks and options teddy releases his weekly tiger forex report every monday morning with coverage of all the major currency pairs including the dollar index the euro dollar pound dollar dollar swiss dollar yen as well as many more and he also has weekly coverage of the crude oil market and the 30 year t bonds as they both influence forex markets tremendously when you sign up for the tiger forex report you also gain instant access to teddy 60 minute webinar archive he just hosted forex strategies and fundamentals what is behind the tiger forex report for all the details and to start your 30 day tiger forex report subscription today visit the front page of tfnn.com tfnn educating investors you might think that if you want to be successful at trading in the stock market you're going to need a crystal ball after all it's impossible to predict the future right like any endeavor in life before you decide it's impossible get some advice from the experts you might find that it's not so impossible after all for daily market overviews that give you direction on the key indices selective stocks and commodities subscribe to the opening call newsletter at tfnn.com the opening call newsletter is written by basil Chapman creator of the trading methodology known as the Chapman wave the Chapman wave up down sequence gives you an edge in identifying price turns finding the peaks and valleys and stock prices get the opening call newsletter by basil Chapman and your inbox every day first time subscribers also get a 30 day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up tfnn.com educating investors Steve Rhodes started his trading career as a student almost 20 years ago and the student has now become the master Steve won the prestigious timer of the year award in 2018 and barely missed that mark again in 2019 finishing at number two for the year an amazing accomplishment Steve Rhodes is committed to sharing his techniques and knowledge with anyone who wants to learn and he shares his vast amount of trading knowledge every day in his mastering probability newsletter Steve's award-winning newsletter mastering probability is delivered every trading day with updates throughout the afternoon sign up for Steve's market newsletter mastering probability and you'll receive access to seven of Steve's educational webinars absolutely free at tfnn all our newsletters come with a 30 day money back guarantee so you have absolutely nothing to worry about visit tfnn.com and try mastering probability 30 days risk-free today tfnn educating investors toll free at 1-877-927-6648 internationally at<PHONE_NUMBER> my folks back basil Chapman sitting with Steve Rhodes I was lost how come how come you took the time to be able to do this because I was going to be trading at this particular time and then when I saw this move to 30 45 30 back again I said you know what I'm only going to get in trouble I had a nice move from that off the top there all that'll happen is I'll go in and out because it's a sideways trading range and what happens in a rectangle formation as you think is going to break out it just holds and comes back and as you think it's going to break down it just holds and goes up again so I'm just looking at this and saying I think a little later on and maybe the next hour we'll start to see a pretty good pull but I'm watching this closely because when we start to break below 45 45 30 for a 10 minute bar and break 45 25 I think that could be done for much of the day with a lot of profit taken being taken for the last couple of days okay let's get back to our story so I want to go back so you want mining where was I oh first of all I didn't finish that now I can't remember what it was oh MNM Mandy MND why yeah so Mandy Monday.com it's in leg D I like what's going on I believe you do own this and it was an investor's business daddy I just think it's stuck in a range and what I would use every time it pulls back under a 160 it's a 178 right now but if you have patience if you aren't along right now you have to wait for this long to play out but when it pulls back if it pulls back below 173 and if it closes under this 173 it says that the rectangle is going to go even long sorry the oval pattern in the weekly chart is going to go even longer so just be real careful more importantly this is in play in the monthly chart but I think it's not going to be easy I think we've had the best move to the upside this in fact looks very much like a one to one that's completed so and the texture goes all good I'm just saying now risk reward is just a little bit tougher if you ask me what you're getting right now I'd say I think the risk is I would start if you're looking to get in a position starting a little bit here and then having a six or five or six point next entry as your plan based on this oval pattern that's something I'm going to say hold off let's look at it again maybe Monday all right oh let's look at Monday.com in fact let's look at Monday.com let's just see is this starting to pull back am I going to regret this that I didn't keep yeah this is going to leave there's your 45 30 I don't think this is going to hold okay let's go back to our story here this question came in Newmont mining actually it was the statement about Newmont mining and I believe that Mexico so let me just clean over here if I don't spill the water on my computer Newmont mining basil since the mining strike started this past June in Mexico versus Newmont the gold miners are hamstrung if Newmont it gets hung out out to dry and they the biggest the little miners are stuck you know you might be right because I looked at some of these miners for instance one that we often buy not often but over the years this is what we go to just for a quick trade there's NG Nova Gold I didn't quite like the way it stalled yesterday without breaking out sharply and this is just a $4.20 stock down a little bit today so I'm being very selective yes we've started a silver stock more because it's a stock that I think is telling me more of a story on the shorter term I don't yet know about the intermediate term and I did expect that it would pull back which is pulling back from my entry yesterday just a little bit but that's I'm being I'm being cautious because I do believe that the dollar and if you look at the Dx1 I did this in my show look that's very nice up 52 ticks at 1369 just real quickly I just want to show you using just these two moving averages look here's the dollar if these averages the nine went over the 14 to go green this is nice and it did a beautiful v-shaped pattern with the left side this is the price the gray is just a closing price and this is a 9 and 14 period moving averages look how nicely it went and retested the high I think I think the dollar is holding in well just for the moment it's doing okay so that means that you've got to consider that it does have a chance to uh exacerbate any weakness in the market which I think we're real close to we'll remain short to down from the exact high August the first using some of the technical tools and we still short as SMH's just off the high so those are key positions on the short side oh great what I'm what I'm talking about is you you you you this is the um this is a uranium energy fuels uh uranium company I'd say the one I prefer is the one that we actually own which is UEC and that is having a pullback which we expected after a fabulous nice great percentage move up it's training down 12 since I still think this is the better out of the two so the question remains yes and the answer remains the same did I just hear a bell ring did I hear a bell ring like it was a peak F top let me just check right here we've got Garo Garo Newport Beach California Garo how are you how are you sir I haven't spoken with you for a long time mr sar himself right yes sir it's few years absolutely right um I never forget you professor never ever forget you I don't forget you very knowledgeable yeah yes sir yes sir all right enough enough with the compliments Garo what are we looking at no no no it's not a compliment that is true that when I say okay I'm I mean it I'm I just mean it yes sir um what I'm looking for is for sq sam queen um on my daily chart it I use the short parabolic all the time and he does miracles to me and you've just got a biasing third day that the uh the three dots are at the bottom and the the candle is above the five they seem to be moving average I wanted I wanted your blessing and see that if it's positive you'll see that easy to this is a way this is the the beginning of up trend of this stock or still there is a pullback yes sir so Garo I have kept I used to have them years ago decades ago they say are and then I had them off and then I used to hear you and you call me and I I kept them on one of my charts I always keep it and I keep it because I believe if you have a technique and then someone mentions a different technique that is additive to your work I like to include it so I do I I have to also admit that I kind of forget to look at it most of the time but I have it on my chart and at my peak G and you know all the companies that change their names they deserve to get hammered and clubbed which they did square becomes blocked I mean block I understand it makes sense but square was a great point of sale software my managing receipts Facebook goes to oh man you know Google goes alpha but I mean what is going on here so they change their name well it serves them right they were they went from 289 back in August of 2021 down to 51 in October of 2022 well got it so okay so if you look at the monthly chart it's made an H I don't know you remember you remember I talk about the dreaded H pattern where you come down sharply try to already fail and retest the left side low or the monthly weekly charts have done that so we're on with Garo 1048 recipes up 9 squares up 30 cents we'll talk about it because I don't think it looks that great I'll be back in a moment old report as a precious metal gold is still king it continues to hold the most effective safe haven and hedging properties across the global major trading hubs of the london OTC market the u.s. futures market and the shanghai gold exchange the gold report tom o'brien publishes his weekly gold report every monday morning for subscribers consisting of coverage of the XAU hui gdx the dollar bonds the south african rand as well as 25 different mining equities with specific buy sell recommendations the gold report new subscribers get a 30-day money back guarantee so you have nothing to risk subscribe to tom o'brien's gold report newsletter now at tfnn.com sharpening your skills as an investor is like getting better at playing a musical instrument you have to practice sure but you also need excellent instruction from experts at tfnn you'll get advice and guidance from the authority and technical market analysis and it's not just dry tedious text either tfnn airs live financial content streamed live on tfnn.com and tfnn's youtube channel with tiger tv live every market day from 8 30 a.m. to 4 p.m. eastern for free each host is an experienced trader and gives their take on the market while taking calls and questions live from around the world from the moment the market opens until the closing bell sounds tiger tv has eight different shows with expert hosts to help you make the right moves with your money watch online at tfnn.com or on tfnn's youtube channel and become the investor you were born to be tfnn educating investors tfnn has just launched their new trading room the tiger's den hosted at discord tfnn has been educating traders for more than 20 years with live programming hosted by a variety of professional traders during market hours and now they are expanding their reach with the tiger's den available to all tigers and tigers for just one dollar for the year there's no cash or added costs when you join our community of traders in the tiger's den you can look over the shoulders of tom o bryan and the other tfnn hosts while they analyze charts during their live tiger tv programs and join an interactive trading community with hundreds of members exchanging ideas interact with other tigers and tigers as they share trading ideas news analysis and discuss the market action all trading day even at night and on the weekends the tiger's den at discord is accessible on mobile or tablets as well so it's always at your reach to sign up today and become a part of this educational community of traders just visit the front page of tfnn.com don't forget you can listen to tfnn live on your mobile device 24 hours per day go to tfnn.com then hit watch tiger tv that's tfnn.com then hit watch tiger tv hi guys we're under gary hi gary we're back thank you sir yes sir so gary you know there are times where you and i don't have to tell you this because you've done this hundreds and hundreds of times using the sar the parabolic so what we're looking at here is that yes you did get your dots there was a little doji candle there was a low on square um i should call it block that's its name block ink formally known as square 34.73 was a low on the 18th of august retested a little higher 50 54.97 on the 25th but if you look i don't know if it can you see my charts yes sir yes okay so you see this daily chart you see the way the mag d this is the mag d i'm circling right here has turned positive look at the stochastic it's gone from zero practically gosh this was the worst you can get it was down at one percent i mean one percent for the stochastic that is really weak it has only one way to go after that and that's up and now it's at 28 but look the price really hasn't gone incrementally higher um and the on balance volume is kind of weak so i'm just going to suggest to you that it might not be that it isn't a buy because it's not going immediately up into the 60 62 area it might be a process so this i'm going to put if you're watching me closely what i like to do in this particular instance i go to the left side candle of note this is a little reversal candle right there and i draw in a rectangle and it says to me that we've got one arch formation right here that's the dreaded H with a successful test on the right side now we've got a second arch if this arch closes two bars out of three above the high that was made on the 22nd of august which was 58 round number high today's high is 5850 it's trading at 5809 right now so if it closes two days above that it says good now you've got a little bit of upside momentum and it can take you to the next left side high and that's the high that we looked at over here of 5895 with the next one being 60.36 the the candle of the 15th of august but you see the way it's basically sideways now i don't have to tell you because you'll know that a lot of the time when you get the sar turning around it's a pretty speedy process to tell you whether or not it's going to be successful or not usually by the third dot especially the fourth dot you're kind of pretty much away from the first dot and in this particular instance it's not really doing that it's kind of stalling so i'm going to say to you for for the type of technique if i'm correct in my memory of what you like to do is that you like to get it and very quickly you know whether you're right or wrong and then you can handle the trade and usually you will get out as soon as you satisfy there's enough percentage or whatever it is points to the upside or downside am i correct yes sir yes sir absolutely yeah i i don't see that here i think it's kind of stuck and if this market starts to pull back which i think it's in the process of just about to do the first a couple of days of september i think that square well at least i should call it block will come down so i don't think this fits my parameters that i would be looking at to use the sar the way you do the way i'm looking at it here it's using it's usurping upside energy without the commensurate rally hope that makes sense so so for you if by the end of the day it goes under 5790 i don't think it's going to be successful unless tomorrow is just a brand new big surge to the upside in the market and i don't think they're going to do that before the long weekend hope that helps you my number is very close minus 5724 if it goes below 5724 again it's going to go down back to 5550 yeah because let me bring that i have one minute more just to give you just a hint that what i'm doing according to what can i do i have the permission or should i hang up go ahead sure go ahead yeah if you draw two lines one is 200 e ma and one is 12 e ma yeah if you if that 12 e ma crosses the 200 e ma at that point where you go long that trend changes on 29th of august august right at where it was 56 dollars and 87 cents where that 12 minute crossed that 200 e ma from that point now this is the third day that is going up now if that rolls down and comes and hits that 200 e ma which is 57 dollars and 24 cents from there on if it was below that 200 day then the short starts so this is something that according to that 212 212 e ma and 12 e ma i just decide which way to go which way to get out so i've got exactly the same thing in the future yeah so garrom i'm using i got the 200 period moving average here e ma and i've got my usual nine and 14 and the nine cross positive on the 10 10 minute chart at 330 on the 28th and the and and the price crossed the 200 period moving on the 29th at 10 to 10 eastern time so yeah i can see exactly what you're looking at but you can see that it's starting to stall a little bit it's not breaking down it's just not going much higher yes yes mine is 15 minutes sir i go with i don't trust the 10 minute 10 minutes always it's a tricky five and 10 forget it but 15 is you buy a little bit you buy high and you sell higher on 15 minute if you go 12 minute and 200 minute it is it was on 29 your yours was on 28 you see yours was lead it lead it that 15 yes mine was a lager yeah so i i i like exactly what you're doing i understand it i think you're correct so let's let's just watch this one you've got everything in place you know what has to happen it really square has to at this point intraday i don't think it's going to do it but what you really would like to see is that the 5850 high is taken out at about 215 this afternoon that's eastern time if that happens there could be a little bit of a surge to the upside that's what you want to see hope that helps you absolutely you know may on a daily chart on a daily chart if the five-day simple move average crosses the 21-day simple which is at the junction of 59 dollars and 52 cents this is today's price tomorrow will change right from that moment that five-day simple crosses 21 from day on the long goes on and on and on and on okay good i like your thinking and good luck with the trade let's see what happens thank you so much for a wonderful to hear from you again garo you too the thank you sir after you have a nice week long weekend thank you too bye bye thank you very much folks we'll be back a basil chap and sitting with Steve wrote our we'll look at tesla neck number back she coincidentally about three or four people have asked me to look at tesla and apple i'll do that as soon as we return you might think that if you want to be successful at trading in the stock market you're going to need a crystal ball after all it's impossible to predict the future right like any endeavor in life before you decide it's impossible get some advice from the experts you might find that it's not so impossible after all for daily market overviews that give you direction on the key indices selective stocks and commodities subscribe to the opening call newsletter at tfnn.com the opening call newsletter is written by basil chapman creator of the trading methodology known as the chapman wave the chapman wave up down sequence gives you an edge in identifying price turns finding the peaks and valleys and stock prices get the opening call newsletter by basil chapman in your inbox every day first time subscribers also get a 30 day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up tfnn.com educating investors everything in the universe is governed by the fibonacci sequence this mathematical principle is responsible for everything from the most aesthetically pleasing artwork to patterns in the stock market to stay on top of stock patterns you can take advantage of sign up for the fibonacci 24 7 newsletter at tfnn.com when you subscribe you'll get a weekly report from veteran day trader larry pesavento on stocks you need to pay attention to and you can trust larry's analysis after all he's got 45 years experience as a day trader larry will also provide daily charts videos and data on the key markets that he's tracking expect notifications from larry on market movement you need to act on at any time first time subscribers also get a 30 day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up subscribe to the fibonacci 24 7 newsletter today tfnn.com educating investors are china a shares hot or not if you trade china a shares now may be time to take a closer look trade chau or chad directions daily csi 300 china a share bull and bear etfs china a shares in either direction visit direction investments.com today an investor should consider the investment objectives risks charges and expenses of the direction shares carefully before investing the prospectus and summary prospectus contain this and other information about direction shares to obtain a prospectus or summary prospectus please contact direction shares at<PHONE_NUMBER> the prospectus or summary prospectus should be read carefully before investing an investment in the funds is subject to risk including the possible loss of principal the funds are designed to be utilized only by sophisticated investors such as traders and active investors distributor four side fund services LLC this program is brought to you by vista gold traded on the nyse american and tsx under the symbol vgz yes it's faster in trading possibility this is not steve roves battle champion i'm sitting in here my show is the tiger technicians hour 8 10 o'clock to 11 but i wanted to do this because i just had so many questions about stocks that i i just thought i'd take the time so i i didn't finish on newmont mining gold miner um 86.37 was the high back in april 2022 and plungers down so i have a technique first of all the with garrow uh we were speaking with a moment ago the parabolic sar uh parabolic sar is a technical indicator developed by j wilds wilds to determine the direction that an asset is moving i wonder if in 20 years time or 30 years time or 40 years time i'll be talking about the some of my chaplain wave techniques that i've used forever anyway we'll see the indicators also referred to as a stop and reverse system sar which is abbreviated as sar it aims to identify potential reversals in the price movement of traded assets so look here's your dots you see the little dot i want i can let me just see on the chart yeah you can see it so right over here at this peak d in the chaplain wave we've got a pullback starting right in the chaplain methodology at a peak d the fourth highest peak that's where other things can happen a buy signal upgraded to buy modes should take you to at least four higher peaks you know devils dev also has my notation the chaplain's notations so this is the fourth highest peak and there it is in the daily there it is in the weekly this went to a d and then an e and then an f at 86.37 in april look at that beautiful symmetry in time going to the high in april of 2022 well new old mining came down and you can see there's the uh as they are i've got it i always have it on this chart just to sit there half the time i don't see it just the same as a half would you ever see this 50 period moving average because i only use it periodically and then look what happened right there this chaff g the very next bar i mean this is a fantastic tool but you really as darrow does you've got to know how to use it because when it doesn't work it can cost you because you're looking for something that actually isn't there look it turned around gapped and then full the gap but look at the pink nine period moving average it hasn't turned positive and it's struggling to turn positive so i think new modern mining is is a clue to me to say not all the stocks in the golden silver area are going to really work in fact this is this is a questionable moment because that dollar is still strong if there is that direct relationship but i'm just looking at the chart the wiki charts are horrible yes you dreaded h pattern this is a pattern that i call uh where it's a straight line down and then it tries to have a balance and at a peak a or b it fails we're seeing that all day today in the look how many dreaded in a lowercase h sharp move down arch formation fails in a peak a or b and then takes out the left side low it did that there it did that there it did that there and he has a bigger one i don't think it's going to i'm not sure if it's going to do that yeah because the 30 38 to 30 38 20 to 37 say 60 should be good support but it's not showing strength so that's why i'm looking at it so that was new modern mining just be careful and i agree with you about the strike and all the other things that are going on but sometimes when things really go catch all catch a light when they're on fire and for you go you can see everything gets dismissed all the negatives are dismissed and tomorrow in my in my tiger traditions hour i'll be doing this a lot of talking about this chart here which is my dark news chapter we've dark news cloud cover using the dow daily chart because that has been under pressure and now we'll see where the look is still pink just about to agree but it hasn't turned green all right so okay so that was now we're going to test them oh wrong chart i indeed thank god yesterday i was going to do my just about do my show but all of a sudden i couldn't get any i evidently the chart was showing but you couldn't hear me and why was that because i don't know if you can see it but in the microphone i'm busy connecting and unconnecting and restarting doing all sorts of things but i pull the plug out from the microphone without realizing so easy i call them with different people technical people elma engineer we're all working on it all i had to do was go put it back in again so tesla now i've got the right chart nice move up from the low look there's the s a r look it went the day after the high of two nine nine between nine you had that smash to the downside look there's the s a r you see those red dots look at the green dots you can barely see them i like to keep them faint because i don't use them all the time but look out confirmed a buy signal to buy mode because the sarcastics now at 87 87 percent the magnate is good not great but good on balance volume is turned positive so it says there's internal sorry there's residual strength in the in the tesla chart the monthly chart did the one-to-one it's done all the Fibonacci's done everything six one eight turned around came down he'll hold the three three three eight two level i always just keep these there until it looks to me like it's getting messy so far this is messy but very easy to see this is the monthly chart and the weekly chart the nine is still positive over the 14 magnate just negative looks like a dolphin it's my dolphin pattern and it's going to make it an m shape pattern by a little bit of a balance that's why i'm saying go one step at a time here because there are certain things like i mentioned in my show we missed an entry today in hack this is the etf prime security cyber security etf look at this this is fabulous action not just the monthly chart but the weekly chart new leg e i'm calling this a bill though i really i should do this because it didn't take out the left oh dead took out the left side low so i have no choice yep this is a brand new leg bean no matter whatever it could fail so it's acting well we missed it and it gapped up and it's up and away so it's just saying to me finally you've got the cyber security stock so you can have a rotation here with some of the others that were lagging we were talking about triple m earlier on look triple m nice move up not great but look hey has disney done the same thing that disney is really struggling but it's trying to form some kind of a base is the dreaded h lowercase h goes to a lowercase m right there so there'll be some stocks in the next phase up that suddenly come alive all right now so that was apple uh that was tesla so tesla's acting well uh key support is that it's a 259 and a half key support is a 249 a close in the next week below 249 starts a potential dreaded h pattern if it's at a peak b if it goes to a c it might it might still have further upside action this is acting independent look neo uh this is electric car company or electric automobile it's just struggling rivn so yeah look at the rivian stuck at the 200 period moving average what was the other one uh i had the other day i wrote it down now i can't find it in the auto electric auto company oh fisker f s k r however that was an interesting chart pattern is it f s k r k r yeah a mistake f s k f s k yeah f s k oh no that's fisker no that's k k k capital yeah isn't this interesting k k r capital corporation nice move in the dating and the weekly charts uh what is fisker an xpov yes x p e v yeah so tesla is still the boss it's the king um i'll be back thousand three there's steve rhodes our i'm doing a brazil chapter and i'll be back if you're looking for potential trading setups in the stock market then rocket equities and options report is a newsletter you should try tomio brian delivers options and equity trades when the markets present them using a combination of fundamentals and technicals sign up for rocket equities and options report today with a 30-day money back guarantee so you have nothing to risk for all the details and to start your subscription today visit the front page of tfnn.com tfnn educating investors you might think that if you want to be successful at trading in the stock market you're going to need a crystal ball after all it's impossible to predict the future right like any endeavor in life before you decide it's impossible get some advice from the experts you might find that it's not so impossible after all for daily market overviews that give you direction on the key indices selective stocks and commodities subscribe to the opening call newsletter at tfnn.com the opening call newsletter is written by basal chapman creator of the trading methodology known as the chapman wave the chapman wave up down sequence gives you an edge in identifying price turns finding the peaks and valleys in stock prices get the opening call newsletter by basal chapman in your inbox every day first time subscribers also get a 30-day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up tfnn.com educating investors everything in the universe is governed by the fibonacci sequence this mathematical principle is responsible for everything from the most aesthetically pleasing artwork to patterns in the stock market to stay on top of stock patterns you can take advantage of sign up for the fibonacci 24 7 newsletter at tfnn.com when you subscribe you'll get a weekly report from veteran day trader larry pesavento on stocks you need to pay attention to and you can trust larry's analysis after all he's got 45 years experience as a day trader larry will also provide daily charts videos and data on the key markets that he's tracking expect notifications from larry on market movement you need to act on at any time first time subscribers also get a 30-day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up subscribe to the fibonacci 24 7 newsletter today tfnn.com educating investors tfnn has launched the tiger's den hosted at discord tfnn has been educating traders for more than 20 years with live programming hosted by a variety of professional traders during market hours the tiger's den available to all tigers and tiger's for just one dollar for the year there's no catch or added costs when you join our community of traders sign up today and become a part of this educational community of traders just visit the front page of tfnn.com well and we're looking at don't forget my show is the tiger tradition i'll send to 11 and my service is the opening call the newsletter well we're looking at here and i did a webinar just the other day on the also many of these tech is already a technically oriented focus and on the weekends i always do about an hour webinar looking at what's happened what's what what to look forward to and our positions that we have doing a deeper analysis so always think of magnet lines every time you're looking at something think about where does it keep wanting to go to where is the point i call it the magnet line 45 30 was a line that i identified weeks and weeks ago we didn't even we went we plummeted from there and we went down all of a sudden yesterday it became focused and look at the zigzag we've got he has the one minute charge the e-mini look at this where are we now we were just going to get 45 30 now we're 45 45 31 in the e-mini just keep in mind really helps because as i said i wanted to do steve show because i knew that if i was doing some trading here i would i could have been trapped because of the zigzag sideways in a very narrow trading range and i said hey just step aside you had nice move earlier on now you just have to take it easy so now as we're wrapping up the show and that is anet arista networks it's funny how many network things i've been getting in the low price stocks and all that are showing very nice strength this is at an all-time high i believe trading at 194 up seven now if you're a long zip i'm just going to say to you stay long this looks fabulous i would do this because it's at an all-time high stocks they make all-time highs tend to remain then keep coming back to that level as a new time high participant over a period of weeks until they really get smashed because of a horrible earnings report so far this is good check when the earnings are maybe this is the earnings right here in august and the spiked up hasn't come back stay with the trade if you want just for money management purposes take a little bit off here you've got a really nice gain if you're looking to buy it's real tough you could i would look at an option and maybe i'll do that in my show tomorrow make a note in my tiger technicians out at 10 o'clock a net and i'll look at maybe for an option and out of play maybe you can look it off totally even and you don't have to do and let it run buying at a high so with that said have a wonderful rest of the day great programming today of course steve is steve is ours so i'm in the show but you'll have uh larry visaventure and tom brine um hey have a great day i'll see you tomorrow tiger technicians out at 10 o'clock see you later


I'm here today we are officially launching, your first year of study will be absolutely free. Absolutely free. the opportunity to take up. One year for us isn't enough. We have a plan to make it 3 years free but it costs a bit of money so we're having to roll that out over time but you will be the first that you won't be the last.


You know, I think I've experienced more here in college than I could have ever experienced anywhere else. I took the initiative to be involved on campus, so networking and building my resume, I feel like it's priceless. Having connections with people across campus, it's just nice to know people because they can help you, they can guide you through it. And if they don't know, they know someone who knows. I made a really good choice of coming to St. Cloud. Thank you.


Wednesday, everyone, we'll start class in the new one minute of questions, two questions of all day, two questions. Zero questions, alright you guys just shut it. Is there a slight hand? So I'm going to raise my hand and ask a question. We don't have to do the class. Okay, it's on you. Okay, so we've been looking at folks making near all of you talking. The acoustics here are really good. Okay, so we've been talking about this week, we've been talking about attacks on local applications and attacks on Linux binaries and some of these attacks will generalize to any type of application, but we were really focused on local attacks. The next attack that we're going to talk about is we call it top two attacks, which stand for time of check to time of use attacks. So these are actually one of my favorite types of attacks. The idea is the program is making a check and saying let's say what are the permissions on this file and then later on in that program's code it then does something to that file. So let's say that it first checks, hey is this file owned by root? Let's say. And then if it is it'll open the file up for editing. So if it's using strings to specify these files, right? It says check the file permissions on this file with this name, this file path, and then later it checks, hey open up this file name with file path. What happens there? So that's gonna be easier. And this is a very generalizable problem and the idea essentially is just what we've been looking at. So there's the time that you're checking the security properties of something and you have some assumption A then in T2 you're using that entity and you're assuming that your check was still valid. So in this case you're opening up the file based on the file name and you are assuming that the property is still valid there. And there is a time of attack that we can create that's in between T1 and T2 to invalidate that assumption. A lot of different ways you can think about these things. This is low. Do you still see this? I don't know why. It sometimes weirdly does this with a quick time recording. So there's many different ways that this can manifest itself with vulnerability. There could be data race conditions when you have multiple processes who all have access to some shared data. So if you don't have any kind of locking mechanism or any place there where only one processor can check the data and then use it, then you could run into this top two vulnerability. And so the way this actually happens in Linux applications is there is, so similar to we have that is root check, there's this access system call that attempts to estimate hey would be real user of this program be able to access this file. Where real user is the user who started the program, not the effective user ID which is the second ID user. And as we saw, the open call takes in a string. So both of them taking strings. So it's something like this. If access filing WKZ was zero, then open the filing as write only. And then write to that file descriptor. So what's the key problem? How do you fix this? Who's not able to open it? So it uses our effective user ID. So it's using the second ID permissions. The program is executing as root. So it says yeah, root can open this file. Validate again after opening? Yeah, how though? Yes, using file descriptor. So this is the key here, right? Because we have these strings which point to a file, but they don't specify an exact file. So when open returns, we know that that file descriptor we have will be the same file the entire lifetime that that file is open. So we can write to that file and we know nobody's going to switch out that file and make us try to write to a different file. This file exists and the operating system itself holds onto that file for us. It says okay, here I'm keeping this file open for two, which you specified with the path on a string for the file name. And I will make sure that any time you write to that using this file descriptor it will go to this file and until you read for that it will go to this file descriptor. So the key problem here is that this access and the open command taken file names, right? And the core problem is that anything can happen to the file system in between those two steps. So it's not always the case that the same file will be checked in both cases. So the way to keep yourself safe is to use versions of system calls that only use file descriptors instead of file half names. So that would be one thing we just talked about, right? Try to perform file descriptor bindings first. So like we said, you may also be able to use some functionality to lock the file. So you can lock the file first, then do your checks, and then open the file. And through that whole time you know that the processor is going to access that file. You can also do this problem with the old make temp system calls we talked about there's a new secure version because that would actually create the file first and then give you the file name and you would have to open that file to read and write to that temporary file. So in the meantime somebody could change the location of that temporary file and be able to execute to write to anywhere else. Questions? I'll talk to you again. So you said there could be a time lapse between checking and producing, right? Yes. And so what if you just use the semaphore, let's say, to lock onto the file? Yes, in that case, as long as so the key is there's always going to be a difference between the time checking and the time using. Why don't you put a slip in the middle and you just lock onto the file? So the basic idea is you not only there's always going to be a time in between those two operations, right? Unless the operating system guarantees you that these will execute at the same time. So there's always going to be a time delta. The question is can anybody tamper with the file system or anything else in that time period? So in this case if you lock the file and the operating system guarantees that nobody else can access that file then absolutely, it doesn't matter how long your delta is, nobody else can do anything to that file in between those points of time. Same thing with opening a file. When you open a file and you get a file of the scripter, that file is held open for your process the whole time nobody else can touch that file. So could this time like be limited to a certain window so that if you're inactive? It would depend on what semaphore is the locking mechanism you're using. But if you want to be secure you wouldn't want that, right? Because then somebody would just have to find a way to get you to sleep long enough to where you lose that privilege. So you need to guarantee for that entire time delta nobody else can touch that file. Or we're talking files but this applies to anywhere. Can you make a check after checking whether the file is available or not? Check that for a particular time it's not open and it should check it again. In that case though why do you do the first check? You should just do the second check, right? Because now you're already saying the first check is useless. In that case we are saving that time if our delta has degraded multiple processes and we are saving that time. Yeah I'd rather be secure than efficient. You're still performing double checks every time, right? So in the case that you're not being attacked you're always doing double checks, right? I would say the better way is to just err on the side of safety if it's safety versus like performance benefit. I would always err on the side of safety. This gets back into a little bit about how applications read and write to files. So one of the three file descriptors on the unit's applications is the first one. What is the first one? What are we starting with? Zero is for new scientists. What's file descriptor zero? Standard input. What's file descriptor one? Standard output. Standard output and file descriptor two. Standard error. So then what happens when you open up a file and how the descriptor does it return when you call open on a file? A number greater than two, usually three is the first one and the next one will be four and the one after that will be five. So there's no guarantee that the operating system has to do it this way. That's why you get essentially this opaque integer that doesn't mean anything to the application but it's how the operating system maps this number to an open file descriptor. So by default you always have three file descriptors open and after that we'll start usually three, four, five, six. And so lots of standard IDE applications need to have open files to perform some tasks. This is exactly what the change shell program does. It opens EDC password and it actually will write to EDC password in order to write and change that file. In the effort of not repeating functionality, you may need to fork out and call to external an external process. You may want to grep something, you may want to do whatever you want to do. Just like some people did with the natural web server getting GZED to work because they called out to GZED to actually do that functionality. But the same thing with the natural web server when you've got a command. You have to run fork a process essentially to run that command. The question is what happens, so what does happen? So we talked about what is forking a process, what does that do? Yeah, fork creates an identical process. Right? So it creates an identical process. What's the only difference between the two? The process ID is different but that's not necessarily in the process itself. Different what? No. The return value of fork, that is the only difference between the two process, right, the child and the parent. I believe the, I don't remember the exact same index, I think it's something like the parent gets returned, the process ID of the child and the child gets returned zero, I think, or something like that. So that's the only difference between the two. And then so what does that mean when we fork, what does that mean about file discriminators then? Same for both. Whatever was standard input for the parent is now standard input for the child. Same with standard output, standard error and any open files. And then when we want to call out to another program, we have to call exec, right, which is then going to replace our current process with a new process that it loads from disk, right? And that's how we said new, a brand new different process gets executed. We call fork and then exact. And on exec, what happens then with those file discriminators? Yeah, the new process also has access to all the new file discriminators. So when you think about it, so yeah, so the new process inherits the standard input, the standard output, the standard error of the parent, of the original process and all of the open file discriminators as well. So let's say you have a program that reads, a secondary program that reads, let's say the ETG shadow file, so it opens it, which means it has a file descriptor and then it calls exec to call out to some other program. What does that program now have access to? A file descriptor, so it can read from file descriptor 3 or 4, whatever it is, to read that open file. So that's exactly the problem with the file handle or reuse. So the idea is these file handles are reused and passed between children and fork processes and the fork process. And so by using this we can try to maybe read any files that were opened in the standard ID process. So there is of course a way to do this securely. Also of course it is not the default. This is another instance where insecure API defaults means that they will develop it insecure first because they don't know about how to do it securely. So if this close on the exec flag is not set, the file descriptor will remain open. And of course these things might have access right, so in case any of these open files are important, the children process can read or write to those programs. I believe so. Either open or exec. I don't think you should be able to specify her file descriptor, but I'm not 100% sure on that. So if someone wants to look that up, that would be good. Great. So this is not an abstract vulnerability. There have been instances of this. So the CHPAS command is just like the ESSWD command on Linux. It allows you to change your password. And so to do this it would create a temporary copy of it. So on VSVs, we're talking about VSVs so they have a different system. They don't necessarily have easy password and all that stuff. And so the change password created a temporary copy of the database and it's fun to edit it. So it opened up an editor so that you could change and edit your password. Then when I committed it, it took that copy. So this makes sense. It's actually from a software engineering perspective. Because if you're writing, let's say, a change password function, would you want to write an entire editor too? No. And would you want to force your specific editor on the user? No, because you'll get people like me who hate using VIM. You'll force them into VIM or if you decide to do an EMAX you'll force the VIM people into EMAX or nano people into nano. It's all kinds of madness. So why not just let the user decide which ones they want to do. With certain editors, we actually don't call them editors now. So in VI, there's an escape to shell function which allows you to run shell commands from inside the editor. And so you could get a shell and that shell would have the open file of the temporary password database. Which then you could read and write from in order to edit and change your file operations. This is actually pretty cool. Vulnerability. This is like a multi step. The idea is the original CH pass is the one that has this open file descriptor. It invokes VI. Which from there we can go to a shell and that shell still has the open file descriptor of the original change pass. So by editing that file descriptor we can then all the changes we made will get merged back into the old database so we can make ourselves root. We can do any kind of fun stuff that you want to do. Because the change password function program has to be root. It's running a second ID root. So what some things to do is if you want to be secure and you want to prevent this you have to be sure that there are no open file descriptors that are inherited by core programs. So this is a pretty simple ish fix. But it's something that can be easily overlooked. Because like I said it's not the default. The next type of vulnerability that we're going to talk about is command injection. And this occurs in multiple like pretty much all over the place. So you'll find these in web applications, lots of places. So the idea like we said was that hey, rather than for some of you, rather than writing your own GZIP library, why not call out to the GZIP program on Linux. And this occurs a lot in all types of software. It's hey, we don't want to deal with this. Let's reuse somebody else's functionality and use this tool or command. So how do you an arbitrary command on Linux? How can you? Yes, you all look at that on the back of our web server. It's almost like that is actually relevant to this box. So how does this actually work? What does it do? It's got a high level, I guess, yeah. So it does fork exact on whatever you give, but how does it know what files to open? Is it just a fork and then an exact? When a studio is in a studio and saved up, a studio is going to open. I don't think system itself actually stores standard out at all, unfortunately. Which a lot of you only use different function calls for that. I don't know what it does on a Python system. I think also PHP. Would it see if the command in the string is in the environment path? Yeah, so I have to look that up in the environment path. Is it just used for executing commands? So can you just do slash bin slash s ls? Can you run executables? Can you pass arguments to the executables? Can you do the output of those executables? Redirect them to a file? Is that normal program functionality? Is that just forking an exact executing a program? Can you pipe input between programs? So it's the equivalent as if you're where. On the command line, exactly. So it's just as if you're in front of a terminal and you're typing your command that it's going to do. So there's actually a lot more steps in between the fork and exact. Because we're actually having to parse this string to determine what commands to execute. Are there any, and there's so many things that BASCH does, is looking, are there any file redirections? Are there any pipes? Are there any background processes working? Are there any ampersands or ors in order to execute conditionally commands? Are there any semicolons for multiple commands at once? This is all shell functionality. So actually what it does is it's the exact same thing as passing your string slash bin slash sh dash c with your string. So dash c tells s h that you're trying to execute a command. And so bin s h does all that stuff. It's parsing this string as if you had typed it on the command line. The same thing with p open. So some of you use p open. P open does the same thing forks and execs it as a shell. So what's the language look like for this input string here? What characters are important? Dash isn't really important to the parsing. It's important to the program itself. The program needs to decide how it wants to read arguments. Spaces are important. What do spaces do? So tokenizes the input, right? So it specifies the difference between what's the executable we're trying to execute and what are the arguments to that executable. What else? What else is important? Which slash? The escaping slash? Or are you talking about backslash now? The escaping slash. What else? The number of arguments is not even part of the string. It has to parse and figure out how many arguments based on the spacing. What else? What was that? Quotes. Quotes. Double quotes or single quotes. This is how you can pass arguments to a program that has spaces. You can have any kind of spaces you want. Inside that string, inside the double quotes, if you want to pass in double quotes you have to escape it. So you also have double and single quotes. What was that? Dot. What does the dot do? Linux actually, dot does nothing. So the dot's not important at all. Give your hand up. Do you want to answer anyways? Yeah. And the ampersand symbol. So the ampersand symbol has two different uses. One is to run a program in the background. Another one, so a single ampersand means run the preceding command in the background. Two ampersands next to each other means conditionally execute the next command if the previous command returned true of which the return value has to be zero. What else? What was that? Semicolon. Semicolon separates command. Semicolon says now everything else is now not an argument. This is a new command that I want you to execute after your previous command. What else? Pipe. Pipe also has two different uses. What is a single pipe? Yeah, so take the output of the program on the left and make it be what? Yeah, so we can actually talk about this incredibly precisely which is how you should be thinking. The pipe means set the standard output of the program on the left make that be the standard input of the program on the right. And the operating system creates a buffer between the two where the other one can write to it and it will write up to a fixed amount. And then it will basically wait and sleep the other one to try to write more. And it waits until the other process reads from that buffer. And then as it reads from that buffer that creates new space for it to read more. And it's literally just about creating the file descriptor. So essentially it's actually not the other way, it's bash creates this buffer in between the two and it just manages the communication. And it sets that up in the file descriptor. So we have bar for piping output and we have double bar for or. So execute this command and if that was false then execute this command on the right. Arrow, what's an arrow? Angle brackets, yes. I think the arrow has to have the dash first. Preferably two dashes otherwise that's weird. So the arrow brackets for redirection and they actually do a lot more things, right? So there's, let's do this. There's a single arrow is to redirect the standard output to this file. So what does bash do when it sees that? It says, good, create this file, I have a file descriptor and make the standard output of that program, this file descriptor and go. And that's all that happens. If you're redirecting input, it's open this file and set the file descriptor of standard input to be that file. And so that's when the programs only ever have to read from standard input and standard output but we still get this beautiful redirection and piping functionality. Because bash is changing what standard input means to that program but they just think they're reading from standard input. So we have redirections. This is why you also can do I think I'm going to do this off the top of my head I can't remember. And it's the two and the angle bracket redirect. So that's the redirect file descriptor two. So I think you have to do one, so you have to have two and then the bracket and then one. Which is redirect standard error to standard output and so that's how you can capture both in one string. All kinds of complicated stuff. What else? There's still other functionality that we haven't touched on. What is that? Percent? Question mark. What does question mark do? I'm asking you because I don't know. I shouldn't say that. You're trying to imagine what though like in the shell. Is that correct functionality or is that I don't know either. If you need to make but as quantifying as it may use question mark. Right but I think that's an argument to grep. That's a grep specific functionality. I don't know whether it's shell functionality. It might be because you still have wild card. The asterisk is wild card functionality. So that's actually shell functionality to look for all of the current files in the file directory and replace them there. What else? Dollar sign. Incredibly important. What are all the things you can do with dollar sign? Was dollar sign home? Yeah home. So environment variables. The dollar sign is a way for you to access environment variables. Dollar sign home means at this point in before you execute this program replace this with the current value of home in the environment. Is that the only reason dollar signs use? I can't remember. I usually don't use that to set it. I don't know if that's that. I don't know if that's a standard thing or not. So there's only four variables that have other uses. Right. Okay so loop. Like you talked about like while Do you use the dollar sign on that? Actually I don't know. I don't know. I guess okay. So you can define that variable that way in the loop bank. Actually we can go another direction. Dollar sign parenthesis where it executes the command inside the parenthesis and takes that output and just puts it in there. Yeah we'll do this. Let's see how this connects to that. Cool. So we want a simple example even though we basically already did. So here we're building up the cat.mr.log rd1 here. So one thing is to set uid binary. What's one thing that this is vulnerable to? Type of the argument to the string. It's a character one. Maybe we don't talk about that yet. Any file. Right. From here. We're going to read any file. So it's already vulnerable to a .5 attack. But specifically we can then use it to output any file we want. So we can do it just like we've been talking about. We can do a semicolon to output things. Anything that we want. So this is not a an arbitrary thing. Because you essentially get full access to the system as if you were this user. And then around a long time they still remain today. So these like I said are in several other context. One of those is the shell shock vulnerability. Does anyone remember hearing about this? Too long ago it didn't matter if you want people. So in 2014 there was actually a huge bug found in Bash that had been there I believe for I want to say 20, 25 years. And what happened was this is kind of a combination of things. But the idea is similar to what we've been talking about. Bash instances inherit the environment from whoever forked them. So in Bash instances it inherits all the environment variables. And there was this definitely known functionality of Bash that if you wanted to pass let's say a function from one instance of Bash to a child instance you would create a special environment variable that looked this certain way and then Bash wouldn't execute that function in order to get that function definition. So Bash as literally every time we would start up would look through all the environment variables. See if we were defining it this way we would take that code and basically execute it. So it looked like this. So if anybody if you set an environment variable whose value started with parentheses followed by a function definition it would be executed by the interpreter in order to create this function. So on the surface this doesn't seem to be a problem. So this would only be you can change your environment you can inject environment variables but every instance of Bash you execute will be executing as you the user. Bash is not a set UID program because that would be horrible. So it seems on the face of it that this is just like a simple little problem. So this actually has two problems. So one is you can pass when you ssh so actually you've seen this. So when you as part of the wechall challenges or sorry it's part of the bandit challenges that integration with wechall. You can specify your ssh configs what environment variables to pass to your remote shell. So it is possible if you've ever wondered how can I get how can I clone a repository from GitHub using ssh to my ssh key without getting an account on GitHub's servers. So the way they do this is it's actually a way in your authorized key file you can specify that certain users can only run certain commands so you can create incredibly limited shells. So this would be for one instance if you wanted one machine to be able to access another machine without a password and have full access to the system to do backups you can have it to where anytime that program ssh's to that system it only runs the backup command and nothing else. But with this functionality now if I can pass arbitrary shell parameter sorry pass arbitrary environment variables to a remote server I can then get it to execute any commands that I want which essentially destroys that functionality. So it completely hosed these like limited access ssh accounts files. So you can do things like this to get the easy shadow password a really incredible problem here was web applications and specifically CGI web applications. So we haven't talked about web applications yet but at a high level CGI is a technology that allows you to write a web application in any language all you do is create an executable file. So you can have a CGI web application that's C code. But as part of this there's a defined protocol for how parameters are passed from the user's web request to your CGI program and they happen to use environment variables. So every certain parameters are set as environment variables and so remotely just by making one single web request you could get arbitrary code to execute as the user of that system. Or as the user of that web application. So you can execute arbitrary code through a web request using this vulnerability. So this is why this was such a huge issue and there was a really big push to roll out patches and fix servers. It was like a huge deal because this was such a wide-trend problem in so many different scenarios. So how do you fix this? Sanitize the input. Only accept certain commands So if you're expecting a command, yes you can do that. What if you're expecting file names? Yeah, so we talked about that right? White list versus black list, right? So I'd say this is a really good instance of demonstrating that black lists are very hard because there's not just a single character you can eliminate to fix these, right? It really depends. There's a whole host of characters. So one way to do this would be to specify that the user input before you ever add it is either out of numeric and that's it and don't allow anything else. Another way to do it are sanitization functions you can use. So it depends on the specifics here. But fundamentally yes there are functions you can call to properly escape but usually you have to be even careful with those because you have to be careful to place them inside double quotes usually. So even doing the sanitization, it can look like it's done correctly but can actually be incorrect and cause problems. So it depends on the assumptions of the sanitization routine. The other way is to never use these functions, never use system and v open. If you use the function exec or exec v e, so usually you pass in argv vectors to the operating system. So there there's absolutely no parsing involved and that's the key there. The key is the problem is the bnsh is parsing. The shell is parsing these strings that are passed in. So you basically throw that out but then you don't get any cool stuff like redirection or piping or anything like that in your commands. So you have to be very careful with this. It may show up in a lot of Any questions on this before we continue? Does it exactly only execute one single command? Yes. Yes, only one command. So that's you're essentially giving up flexibility by making it much more rigid but you get added security because you know only this program will execute and even if I pass the second argument the user can arbitrarily put whatever they want. But that argv1 is passed directly to the program that I execute. There's no parsing involved there. I miss what I did on Monday. When I come to overflow, this is super important because we're getting into the class name of overflow vulnerabilities.


Hello everyone. It is our honor to present our work here. In the following, we shall introduce our work from five aspects. First, we shall introduce some basic backgrounds of our work. QB attacks were first proposed by Dina and Shamir at Eurocopter 2009. For stream ciphers, the output of Z is a trigger-ball boolean function f on security key variables and array variables. For a given public variable set i, f could be written as the following form, where Ti is the product of variables in i, and Q is the summation of terms that misses at least one variable in i. The basic idea of QB attacks is that Pi is equal to the summation of all the two to the power of D polynomials derived from f by setting Q variables to all the two to the power of D possible values. In Q attacks, variables in i are called Q variables, and the remaining variables in V are called non-Q variables. The linear space Ci is spanned by Q variables as called a Q. The polynomial Pi is called the superpoly of i in f. Q attacks could be divided into two phases. In the offline phase, which is the independent of the security key, one should find some useful superpolis to recover the security key. In the online phase, one should solve a system of equations derived from the previously found superpolis under the real key. Later, based on the idea of Q attacks, the concept of the Q tester was proposed. Different from the Q attacks, the idea of Q tester is aiming at non-randomness, namely binding superpolis, which could be distinguished from random polynomial, such as narrow constant polynomials. Originally, linear tests are applied to find the linear superpolis in Q attacks. However, the computing complexity increases exponentially as the size of i increases. Generally, the size of i is confined to 40. At the crypto 2017, total and some other researches applied the diffusion property to the Q attacks for the first time and make a breakthrough. The main idea of a diffusion property-based Q attacks is using the diffusion property to analyze the algebraic normal form of the output bit, as cubes with large sizes could be used. Diffusion property as a generalization of the integral property was first proposed at Eurocrypto 2015. Later, at FSE 2016, the beta-based diffusion property was proposed to investigate integral characteristics for the beta-based bulk cybers. Then, at AsiaCrypt 2016, Xiang and some other researchers combined mixed integer-linear programming methods with division property. With the aid of MIOP, beta-based diffusion property could be applied widely. With the development of beta-based diffusion property, the division property-based Q attacks were proposed. Later, total and some other researches improved the diffusion property-based Q attacks by considering the effects of non-Q variables, which are acced to zero. Then, one and some other researchers made improvements by proposing some techniques such as the drag technique and the degree evaluation method. In the following, we shall present our motivations and contributions. In division property-based Q attacks, for a given Q i, a set J, which contains all the key variables appearing in the superpolice, could be figured out. However, the best division property could not analyze the AF of the output bit precisely, since it does not consider the terms managed by XOR operations. Hence, for a Q set i, even though the set J is not empty, the superpolice PI may be constant. To keep the validity of key recovery attacks, there was an important assumption which is called a wake-up assumption. The main idea of wake-up assumption is that, for a given Q i, there are many values of non-Q variables such that the corresponding superpolice is not a constant function. However, wake-up assumption does not always hold, and indicates that some so-called key recovery attacks may be distinguished attacks only. Based on the above motivations, we further studied the division property-based Q attacks and proposed a new method which is able to recover the superpolice of i in the output. With our new method for the cube also to attack 832 rounds to view at the critical 2017, we recovered the exact AF of its superpolice. Based on this exact superpolice, we could do key recovery attacks on 832 rounds to view. Furthermore, for the cubes proposed at the critical 2018, we proved that their superpolice are all their constant. Hence, the key recovery attacks are all distinguished attacks, actually. Table 1 summarizes our contributions. Before illustrating our work in detail, we shall introduce some preliminaries. The division property is defined on a multi-set whose elements take a value of an n-dimensional binary vector. When the multi-set x has the division property d subscript capital K, upscrewed 1, upscrewed n, it fulfills the following conditions. It can be seen that the n-dimensional vectors are divided into two paths according to the multi-set x. Considering the propagation of the division property, Xiang and some other researchers proposed the concept of division trail. The detailed definition is shown in the slide. With the concept of division trail, one could calculate the division property of the auto-policyte iteratively. Based on these concepts, the division property could be used to analyze the a and f coefficients of a Boolean function. In specific, for an dimensional beta vector, if there is no division trail, such a lot starting from K to 1, then the coefficient of x upscrewed u is always there for u. Following the above lemma, Toto and some other researchers proposed the following proposition, let f be a polynomial and i be a cube set. If there exists a division trail from the vector formed by e subscript j and K subscript i to 1, then it is regarded that xj is involved in the superpoly of i in f. Based on the above proposition, in division property-based cube attacks, one could figure out a set j containing all the key variables involved in the superpoly. After that, in division property-based cube attacks, there are many three steps to do key recovery attacks. In the first phase, one should find the proper value of non-cube variables, such that the corresponding superpoly is a non-constant polynomial. In the second phase, one should query the encryption oracle to obtain the value of the superpoly and the real key, so that some wrong keys could be discarded. Finally, in the third phase, guess the remaining secret key bits to recover the entire secret key. It was noted that the set of key bits that the superpoly depends on is a subset of j. Our main work is focusing on division property-based cube attacks. Since the bit-based division property could not analyze the ANF coefficients precisely, it is possible that key recovery attacks may be used to distinguish attacks only. Tagging at the above problem, our solution is computing the exact ANF of the superpoly for a given cube i. And our main idea is expressing z as a polynomial on the initial state iteratively and discard terms that the superpoly of i is zero constant in each iteration. Assuming z is expressed as a polynomial on the internal state at time t, following our main idea, for a cube set i, it needs to judge whether the superpoly of i in u is zero constant. By analyzing the division property of the internal state at time t, the following lemma gives us a sufficient condition such that the superpoly of i in a term u is zero constant. Accordingly, we introduce the idea of invalid terms, where the superpoly of i in an invalid term is zero constant. Based on the above lemma, we could define the polynomial gt into two parts, namely gt1 and gt2, where the superpoly of i in gt2 is zero constant. Hence, we only need to consider gt1. According to the above two lemmas, we propose a new method to recover the superpoly of a given cube based on division property. First, we express the output z as a polynomial on the internal state at time t. Then, we discard invalid terms, and so a reduced polynomial gt1 could be obtained. For gt1, we further express it as a polynomial on internal state at time t minus nt, and then repeat the above procedure. When reaching the initial internal state, the superpoly could be recovered according to the initialization way. In the following, we discuss some details of our method. The first one is how to discard invalid terms. According to lemma 2, we could use MRP added division property to remove invalid terms. However, when the number of terms is large, the computing complexity is high. It was noted that when the degree of u is smaller than the size of i, u is an invalid term. It indicates that we could use a degree evaluation method as a numerical mapping to remove invalid terms. Consequently, our solution is first using the numerical mapping method to discard invalid terms, and then utilizing the MRP added method to discard invalid terms. Another issue is how to determine nt. In the first iteration, nt is set to 300. Hence, it only needs to build MRP models tracing the propagation of division properties through r minus 300 runs. Therefore, the scale of MRP models could be reduced, and so it could be solved more efficiently. In the next iterations, nt is set to a proper value such that the terms in gt minus nt are not too much. The details could be found in algorithm 5 in our manual script. As illustrations, we apply our new method to Trevium. Trevium is a bit-oriented stream server designed by Kanye and Prenew. The main building block of Trevium is a 288-bit nonlinear feedback shift register. It supports an 8-bit key and an 8-bit highway and has 1,152 initialization runs. Trevium is one of extreme hardware-oriented finalists and became an international standard under RSO-IEC. Tagging at Trevium, we verify our method experimentally. First, for a cube set shown in the slide, we recover its superpoly in the output bit of 591 run Trevium. According to the ANF of the superpoly, by setting different values of non-cube variables, different equations could be obtained. In particular, when all the non-variables are set to zero, the corresponding superpoly is zero constant. It implies that setting the non-cube variables to zeros, which is adopted widely, may be not the optimal choice. Second, we calculate the superpoly of i in the output bit of 586 run Trevium. The superpoly is complexity. Fortunately, by appending some non-cube variables to the set of cube variables, some simple superpoly could be obtained. 3 table 2 full details. Finally, we apply our method to Trevium variants with more than 830 runs. For the cube used to attack 832 run Trevium, we calculated its superpoly, which is given by equation 1. Accordingly, under two different assignments of non-cube variables, we could obtain two different equations which are shown in the slide. Based on these two equations, we could recover at least one bit information of the sacred key and for 832 run Trevium, the 80-bit key could be recovered in less than 2 to the power of 79 plus 2 to the power of 73 requests. Furthermore, for the cubes used to do key recovery attacks against Trevium at crypto 2018, we prove that their superpoly are all their constant. It indicates that such key recovery attacks are all distinguish attacks in fact. Thank you.


Ukraine receives new weapons, war moves to next phase. The strikes on Russian facilities in Leningrad region show that the Ukrainian Army has effective long-range weapons, a Ukrainian military expert and development director of the information and consultation company Defense Express Valery Ryabik. According to him, this indicates a transition to a new stage of combat operations. The distance to the target in the straight line is 700 to 900 kilometres. In order to bypass the nodes of the Russian air defense and various threatening directions, then such a trajectory should be somewhere around 1200 kilometres. The expert said on the air of Espresso. Ryabik notes that these long-range weapons can bypass Russian air defense systems and hit facilities that the occupiers use to supply their army with fuel and lubricants and conduct economic activities. Russians who adore Putin can already observe the result of his policies directly from their windows and far from the front line. He said. Recently, Ukrainian presidential adviser Mykhailo Podoliak has called on Kiev's allies to provide more weapons to aid the defense against Russia's invasion. According to Podoliak, the number of weapons should be large since the entire front line is 1300 kilometres long and the fighting is taking place over 600 to 800 kilometres. He also said Ukraine needs investment in military production especially to make long-range missiles, drones, grenades and artillery rounds.


This is JSATV, the newsroom for tech and telecom professionals. I'm Dean Perine and welcome to JSATV. We are coming at you on location from Metro Connect 2019 in beautiful Miami, Florida. And I am here with, I'm going to say old friend, Mr. Tim Kaiser. Tim is the founder CEO of Colo ATL, a company that has been a mainstay in telecom for as long as I've been in telecom, which has been a while and even longer for Tim. Tim, welcome to JSATV as always. Thank you, Dean. It's happy to be here. Yeah, we're happy to have you here, Tim. Tim, I run into you every Metro Connect. You come here every year. Tell us why you, why Metro Connect? I believe this is the twelfth year I've been here. And this is just a wonderful time to come. There's a lot of friends, a lot of my tenants are here. And then there's a lot of operators or companies that are similar to me. And I get to hear their perspective on, you know, the panel meetings. And it's very intuitive and it's very, it's just a beautiful place. And as you mentioned, Miami is just not the, not the worst place to be today. I couldn't agree with you more, Tim, coming from Chicago, right?  Colo ATL is, I have a neutral interconnect data room or colocation room in Atlanta, where our downtown in 55 Marietta, right across the street from 56 Marietta, which I'm actually partners with them next door. And what we do is we are an interconnection room. I have over 100 tenants now. I've been in business over 17 and a half years. And we're looking, we just added some new, which we'll talk about in a minute. We're constantly growing. Our biggest model is how can we help you grow? And it's been that way as long as I've known you, Tim. And your own growth is a kind of a direct, it's been directly impacted by that philosophy. But let's talk about your growth now. I know that, and I know I'm going to mess up the name. Sumitsu, Hainville Fiber Transport, Data Bank and Call Tower. All new tenants of yours. Why don't you tell our viewers a little bit about that? Yes, last week, I think we had a good year starting off. We signed six new leases last week within a 10 day period. So that was a phenomenal start. As you mentioned, we have Sumitsu, a small firm in Savannah. I'm part of a larger organization in downtown now. It's called Fiber Network Alliance. So I'm trying to get all those folks. Hainsville Fiber Transport came to us. Data Bank, which is in town and is working with my alma mater, Georgia Tech, which I love, they came in the room. And then we have Call Tower. So you can see we have a good, I'd like to say smashing. I'm not sure the word I guess. I like smashing. Too many folks from the UK over here today. We have a good mix of all companies at the room and we welcome everyone. So Tim, you've had, I mean, I was going to say a great 2018, but it seems like your growth has been pretty exponential over the last like, you know, five or 10 years. But what can our viewers expect from Kolo ATL say in the next year, 2019? In the next year, we did a big expansion which used covered with me back in 2018, early 2017. So I got 10,000 square foot of space. We're ready to take on anybody or our existing tenants. New tenants, we're ready to fill that space up. We will always promise what we always do. We're there to help you. You know, I have good support. You know, you will not ever make a mistake coming with us because we treat you like family and we want to make you grow. Outstanding, Tim. And congratulations on a great 2019 already and a prosperous rest of 2019. We appreciate your being here. Thank you for having me again. You got it. Thanks, Tim. And thank you viewers for watching JSA TV. We'll see you soon.


Hey everyone, welcome back to another trending product video. Q4 is here and the time to make sales is now. In this video, we're gonna be talking Black Friday, which falls out on November 27th. Now Black Friday is all about shopping for bargains and it's grown to be the internet's hottest end of the year online sale event. This is a major opportunity for us dropshippers to end the year with sales like we've never seen before.  But before we dive into our trending products, make sure you hit that subscribe button so you don't miss out on any future product videos like these and let's do you can always stay ahead of the game. So without further ado, here's our list of the top 10 trending products for Black Friday. Now our first product on the list is headphones. Now this is an evergreen product. You can leave them in your stores after Black Friday as well because people are buying these all year round. Now you have a bunch of different headphone types.  Different colors, some that are a bit more girly, some that are a bit more for children. Definitely list a bunch of variations and see how the market works for you. I would recommend listing 20 or more in your store and testing the market to see what really works for you. Our second product of the day is throw blankets. Now this is a great product for the upcoming winter season. You have a bunch of different variations that you could go with, different colors, different materials. Even you could list the same one with even different sizes and some are more decor that go in the living room or some that are just for your bedroom. So definitely look up all different variations that you could go with and start listing these in your stores because this is going to be an upcoming trending product. Our third product of the day is robot vacuum cleaners. So what we were talking about before is Black Friday is the time where people like to look for bargains and they usually like to look for bargains on things that are normally expensive throughout the year. So something like a robot vacuum cleaner is a good product to go with. I myself happened to have bought this on a sales day. I bought this on Prime Day a few months ago and managed to get a good deal. So people are usually looking out for these days specifically to sometimes buy a specific product. The one thing that I would warn about is making sure that you don't list any brand names that might be deemed as Vero products. That for example, being iRobot, which is a big brand. So go for the other versions, the ones that are bigger names, ones that aren't Vero and you should be fine. In addition, you have a chance to upsell here on this product with a cleaner for your robot cleaner because you know, you got to clean out everything. So over here, you can offer something that goes along with this product in your checkout process and make a bigger sale. Why not? Our fourth product of the day is cordless drill driver set. Great product, usually a higher ticket item. And again, people are looking for those sales on Black Friday. So this is a great thing to list. You have so many different variations so you can still make a pretty decent profit margin on this even on a sales day, depending on which one you're listing, which package you're listing. So definitely look into it, list a whole bunch of them and see what works for you. Now our fifth product of the day is gel memory foam pillows. This in general has been a product that's been booming on the market and it's also an evergreen product so you could keep it in your stores even after Black Friday. So you've got gel memory foam pillows which are meant to be shaping the neck and more comfortable for people to sleep on. In addition to that, you've also got memory foam seat cushions. Got more people working at home. Got a lot of gamers. People are sitting down a lot and this is something that makes sitting a bit more comfortable. So as well as the pillow, I recommend listing the seat cushion. All right, our sixth product of the day is the Instapot. Now this has become a all-time kitchen favorite. Most people look at this as a staple in the kitchen now and a lot of people are buying these. So this is just a great product to have and it's a good time to offer a kind of deal on it because especially with the holidays coming up, a lot of people are buying gifts and this has been a really common gift to give to a lot of people. It's a housewarming gift, a wedding gift. You name it, it's just a good one. Plus it's a great product for yourself too so people are out there buying it and it's a really great one to list. So I definitely recommend you put this in your store in preparation for Black Friday. Seventh on our list is camera drones. Now these are becoming increasingly popular. They're very cool. People are making super cool videos and really cool pictures with these and it's definitely trending. And what's great about this is that you have a real variety in price. You've got lower ticket ones that, you know, around $50 and then you can go up to a couple of hundred dollars all the way up into the thousands.  Now our eighth product of the day is Selfie Sticks. I'm sure you guys are probably familiar with this product. It's a classic. You've got a bunch of different variations you could go with. Some that are on the lower end again, some that are higher end, some just for cameras, some just for phones. List a bunch of different variations, test your market, see what works for you. Okay, now since we're on the theme of photography, drones, cameras, the next one we're gonna throw onto our list is action cameras. Now this is a really cool product. You can use them when you're doing any kind of crazy activity. They're built for it. They will last and it's a pretty cool product. Okay, now again here, I'll give the quick warning that you don't wanna list any Vero products and that's why I steer clear of the GoPro and go for some kind of random brands that people don't really know about and that wouldn't be listed as a Vero product. Along with action cameras, you've also got tripod stands that go with it and that way you can make a quick upsell listed along with that product and make a few extra bucks. Now our tenth and final product of the day is the Night Light Projector. This has just been a really cool product. We've seen it trending everywhere and we definitely recommend it as a product for you to list this coming Black Friday. It's cool, you've got a bunch of different variations you could go with, some that play music, some that show stars, different patterns. This one is definitely a great trending product to start selling in your store. Anyway, thank you so much for watching our trending Black Friday product video. I hope you enjoyed this video. If you did, make sure to give this video a like, hit that subscribe button and I'll see you again next time. Bye.