The OECS, represented by Dr. Dedekas Jules, Director General. Represented by Dr. Bonnie Richardson-Late, Fermanent Secretary, Ministry of Social Development and Education. Antigua and Barbuda, represented by Honorable Darryl Matthew, Minister for Education, Creative Industries, Youth and Sports. Dominica, represented by Honorable Oscar George, Minister for Culture, Youth, Sports and Community Development. Grenada, represented by Ms. Colleen Perriman, Coordinator of Youth, Ministry of Education, Youth and Sports. Montserrat, represented by Honorable Charles Curnan, Minister for Education, Health, Community, Service, Sports, Youth and Ecclesiastic Affairs. St. Kitts and Nevis, represented by His Excellency Kenneth Douglas Ambassador. St. Vincent and the Grenadines, represented by Honorable Orlando Brewster, Ministry of National Mobilization, Social Development, Family Affairs, Youth, Housing and Informal Settlement. British Virgin Islands, represented by Marcia Porter, Permanent Secretary, Ministry of Education, Youth Affairs and Sports. Anguilla, represented by Dr. Bonnie Richardson-Lake, Permanent Secretary, Ministry of Social Development and Education. Martinique Guadalupe, represented by Honorable Kenson Kazemir, Minister for Youth Development and Sports. The National Anthem of St. Lucia will be played by the Royal St Lucia Police Band. Please remain standing as Pastor Delvin Ford of the Barbano Pentecostal Church leads us in prayer. Let us pray. Dear Heavenly Father, we thank you for this day. We thank you for your grace and your mercy over our lives. For those who have traveled from far, we thank you for your protection that they are here today. And Father, we pray that you bless this meeting of the OECS, Council of Ministers, Youth and Sports. And Father, as this opening ceremony has begun, we pray your blessing over this opening ceremony. And Father, whatever has to be discussed and agreed upon, may it be for the benefit of God, of all stakeholders and for the member states of the region. Once again, we ask for your blessings over this in Jesus' mighty name we pray. Amen. Please be seated. My apologies. Our protocolist, Honorable Kenson Kazemir, Minister of Youth Development and Sports. Honorable Alva Baptist, Minister for External Affairs, International Trade and Civil Aviation. Honorable Moses Jabatist, Minister for Health, Wellness and Elderly Affairs. Honorable Sean A. Edward, Minister for Education, Sustainable Development, Innovation, Science, Technology and Vocational Training. Honorable Stevenson King, Senior Minister and Minister for Infrastructure, Ports, Transport, Physical Development and Urban Renewal. Honorable Joakim Henry, Minister for Equity, Social Justice and Empowerment. Our visiting Ministers, Honorable Daryl Matthew, Minister for Education, Creative Industries, Youth and Sports for Antigone Barbuda. Honorable Oscar George, Minister for Culture, Youth, Sports and Community Development for the Commonwealth of Dominica. Honorable Charles Cohnon, Minister for Education, Health, Community Service, Sports, Youth and Ecclesiastic Affairs, Montserrat. Honorable Orando Brewster, Minister for National Mobilization, Social Development, Family Affairs, Youth, Housing and Informal Settlement, St. Vincent and the Grenadines. Senator the Honorable Shaq Elbog, Palaimentary Secretary, Office of the Prime Minister, St. Vincent and the Grenadines. Your Excellency, Mr. Kenneth Douglas, Representative of St. Christopher and Nevis. Your Excellency, Dr. Dedicus Jules, Director General of the OECS. Ms. Auguste Degazon, Cabinet Secretary. Ms. Mary Wilfred, Permanent Secretary, Ministry of Youth Development and Sports. Dr. Bonnie Richardson Lake, Permanent Secretary, Ministry of Social Development and Education, Anguilla. Ms. Marcia Porter, Permanent Secretary, Ministry of Education, Culture, Youth Affairs, Fisheries and Agriculture, British Virgin Island. Permanent Secretaries and Deputy Permanent Secretaries. Ms. Sursa Simeon, Head of Human and Social Division of the OECS Commission. Chantel Kasset Gaydoom, Director of CREPS Guadeloupe. Mr. Joseph Reds Pereira, Honorary Guest. Other visiting delegates, Staff of the Ministry of Youth Development and Sports, Staff of the OECS Commission, other specially invited guests, members of the media, welcome. Once again, good afternoon. I am Krista Sintaj, Author, Writer, Poet, Historian and this evening your Chair of Proceedings. Welcome to the opening ceremony of the inaugural meeting of the OECS Council of Ministers Youth and Sports and to whom it may apply welcome to St. Lucia. Now at this time I have been included in the program outside of all the dignitaries, outside of every official part of this evening. I have been included in my capacity as spoken word artist and this piece it speaks to St. Lucia's identity so hopefully the St. Lucia's in the room can relate and I think everybody from the Caribbean is able to relate as well. So this piece it is entitled, Tell Them. Allow me to take a breath. Home. Land of legacies, legends and prosperity. We have so much to be proud of, so much to unearth. Mountains break through the clouds again and again. There we go shooting for the stars as if they themselves were already ours and we know it too. Might as well just paint them yellow, black, white and blue because through and through anything Aleutian put their mind to must come true. So when they tell you life tough and tough it will stay or that a better day just a little too far away when they try to put a halt to your freedom song. Tell them to want to be free is not done please. Do not lose sight. Tell them your rights. Way back. Way back then. Way back when St. Lucia was a canon sight, a constant back and forth fight. I imagine the continuous feeling of fright every night and I can't see it. Her children amongst all of that possibly losing sight. Sight of better, something else, something bright of what is without a doubt and without question. Right. No. I cannot see it. They could not have possibly lost sight. Important things like those don't simply lose value overnight so when they tell you the more you fight the further you get. If it was going to end, why do end? Yet I believe that in a nation like ours there are some things we cannot afford to forget. Like how having it easy did not simply come free. That there was once upon a time on this very soil free was a little bit too hard to see for. Free was something we grabbed and held tight so do not for the sake of those coming after you lose sight. When you're shunned and told that's a long time ago child be quiet. Tell them your rights. Arm in arm. I feel like that's something we've always kind of done back when the candlelight was dim and building our nation required a team. Look at us now. Living in something we can take pride in. Still fighting because one thing about better it can always get better. Even now when candlelight is street light and our path is significantly more bright. Sometimes it seems that on some days somehow we sort of lose sight. Like we kind of forget to fight when things at home aren't quite right for just one and for everyone. Gwamwun ektima mai sent lisi. Mertio the way you think and the words you speak the revolution our evolution does not end with you and will not end with me because one thing about lutions before there's a solution for sure there will be contributions.  Remind them that although back then our people had too. Dignity. Equality. Fairness. Equity, respect, independence are not fundamentally complex. The intention was not for them to be fought for in order to be possessed. Tell them in a nation like ours we cannot afford to lose sight. I imagine no I see us continuing the fight with bloodlines like these. There is no maybe no might. One thing about saying lutions we know how to unite so correct to them. No matter how you live, where you're from or what you believe, don't you dare lose sight. Tell them. Justice, truth and charity ideal forever be. Tell them. The voice is a little something but thank you. So to kick off the ceremony I invite Dr. Didekas Jules, Director General of the OECS to deliver the opening remarks. Let's welcome him. While I set up perhaps you can give a round in applause to Krista. Okay protocol already have been established. I want to nevertheless welcome all ministers, women and secretaries, delegates, distinguished guests all. The revised treaty of Basté which is our North Star in article 23 human and social development 23.1 speaks to development and adoption of a harmonized common policy for human and social development. It speaks about achieving and surpassing international goals for poverty, eradication, for universal primary education, for gender equality and empowerment, for health resilience and environmental sustainability. And it speaks to the effective participation of all sectors of society in decision making at community and national levels. The RTB specifically commits each protocol member state in 23.1 F to and I quote provide an enabling legislative policy and administrative environment needed to support social relations and cohesion for children, youth, men and women in the economic union area. The concern for social development of the people and youth of our region while articulated in 2010 has become an increasingly urgent imperative as we are increasingly confronted by internal and external challenges that threaten our very survival as small states in a world of heightened uncertainty and volatility. This is the context we have come today in which we have come today to inaugurate the council of ministers of youth and sport, a pivotal moment in our collective efforts to secure a brighter future for the youth of our region. It is also significant that today coincides with the fifth anniversary of our sister Guard Loop's accession to the OECS. What are the major challenges that we face in youth development? Dispand a range of areas from unemployment to youth crime and violence as a public health concern to the empowerment of indigenous youth to mental health concerns and far too many students being left behind in educational attainment. All of these issues are interconnected and multi-dimensional. One deficit leads to another to other deficits and the situation becomes a compounded generational crisis. In the face of this we have designed an approach to youth development that is unique to the OECS and which is an idea I have both is unique globally and which is a significant departure from the old prescriptive models of youth development. For too long youth have been objects of youth development strategies designed by older folk who have not taken enough time to listen to the problems as perceived and experienced by the youth themselves and to recognize the aspirations that they can articulate for themselves. The OECS approach that will be that was presented or will be presented to ministers by the youth themselves is one that has been refined over a couple of years and which draws on the best practices of members various member states. It is not accidental that we have associated sport with the youth agenda because we recognize the increasing interest of youth in sport. We have noted the spectacular accomplishments being made by our sportsmen and sportswomen. We see the attraction of popular sports to youth who otherwise would have been at risk and the world of sports has created a virtual global arena of economic opportunity. Let us be clear that the association of the youth and sports portfolio does not mean that we view sport as an exclusive domain of youth. To the contrary we believe that sport would be a whole of society should be a whole of society lifestyle endeavor of benefit to young as well as old to all genders to all classes and a basic social foundation for healthy and vivacious living. So for us sport is a vehicle for social development as well as economic advancement given the extraordinary talent that we see being unleashed in and beyond the field. We recognize the capacity of sports to foster personal development community engagement and societal advancement. Allow me to quickly list the opportunities that transcend the boundaries of traditional athletic training and they include investments in sustainable initiatives such as sports management and administration programs providing educational pathways for youth interested in the administrative aspects of sports such as event management marketing and governance. We have noted considerable progress in many member states in the strengthening of the administration and programming of sporting associations and we would like to encourage the formation of not only national but OECS associations of various sporting disciplines. Secondly sports journalism and broadcasting creating avenues for aspiring journalists and broadcasters inspired by the legendary Reds Pereira to cover sporting events thereby amplifying the reach and the impact of sports beyond the field. There is legacy here that needs to be celebrated and emulated and we will be paying effusive homage to Mr. Reds Pereira who has made and continues to make in his own way an incalculable contribution to sports development and journalism in the OECS. We also believe that the popularization of sports is essential. Sports requires audience and audience needs a communication infrastructure as the vehicle to carry the excitement to our homes, our watering holes, our lazy cultures and this is why we will be pushing for support for an indigenous OECS dedicated sports channel that will showcase and inspire our own. We cannot continue to digest foreign television and social media while neglecting our own. Mr. Brian Bartlett of Winners TV who has taken the brave entrepreneurial step put in his money where his mouth is will be given an opportunity to present to ministers in this meeting. Then there's the area of sports science ensuring that our athletes are up to date with current training protocols, testing and preparation for the enhancement of human performance. Here again we need to make full use of facilities available in the OECS starting with CREPs, the Center for Sports Resources Expertise and Performance which is an Olympic high performance facility in Guadeloupe and representatives are here and most welcome and the Saint Lucia Sports Academy and then ultimately embracing any other centers of sporting specialization in other member states. There's sports medicine and rehabilitation supporting training programs for healthcare professionals specializing in sports medicine ensuring the holistic well-being of athletes and enthusiasts alike. Sports technology and innovation encouraging innovation in sports equipment analytics and virtual training platforms thereby enhancing performance and accessibility. It would be good to know that just a couple months ago we had a visit from a Finnish delegation and they have made they have we've had discussions with them about the provision of computerized high performance training equipment that could be made available in the OECS. And finally exports recognizing and investing in the growing field of competitive gaming which not only offers career opportunities for players but also encompasses aspects of sports management broadcasting and technology. In all of this we must prioritize empowering youths to become active participants in shaping the future of sports and society. This entails youth representation in decision-making ensuring that youth voices are not just heard but actively incorporated into the decision-making processes of sports organizations as well as governing bodies of all kinds facilitating grassroots initiatives that can use sports as a tool for social cohesion fighting crime youth mentorship and community development on the good in all of this is our approach and the structures that we have been building for youth development the yes initiative which is both yes as in why yes youth empowered society why yes youth engage strategy has been elaborated and is being managed by the youth advisory network a body of the most energized articulate and committed youth in the OECS and many of them are represented there maybe you should stand to be recognized hello do be shy where the other reps i think there are some other reps around i want to publicly thank them for the dedicated and extraordinary work that they have persistently pursued with no compensation other than the joy of their accomplishment and the assurance of the autonomous future that they are defining a powerful tool that we have used in collecting data that was needed was provided by unicef and the OECS as one of the first regions in the world to access and utilize this mobile tool ureport OECS has been an indispensable development tool providing information in real time through polls the results of which have been utilized by various stakeholders to inform their respective policies and programs as they seek to create relevant youth focus initiatives this tool is now available to our governments as a vital conduit to connect with youth opinion and sentiment i don't know if you're aware of the statistics but in the OECS we have two point something phones to every member of the population thank god we only have two ears maybe we would have had four phones a milestone in the evolution of our ministerial councils was created in Antigua and Barbuda in 2023 when under the chairman under the leadership of minister daryl matthews who was then chairman of our council of education ministers a decision was taken for the inclusion of youth representatives as part of ministers delegations to council meetings this has created a precedent for us to encourage host countries to invite various stakeholders including youth and student bodies sports coaches young athletes as observers and to contribute to the discussion voice concerns and make recommendations in a structured manner and we intend to extend this best stakeholder engagement practice to all our ministerial councils given the challenges that we all face with disturbing involvement of youth and crime we continue to work with our development partners to diverting rehabilitating and reintegrating youth who are in conflict with the law us aid has provided support in successive projects focused on this critical area and we are hopeful that the new oasis the opportunity to advance support youth for success project will show great results and strengthen the efforts being made by our governments in this front in closing permit me to express our sincere thanks to our host member states and lucha the government of st lucha for its willing hospitality and especially to minister kenson kassimi for his persistent i may say almost peaceful and insistent call for convening such a ministerial deservedly deservedly he assumes the inaugural chair of this council deepest gratitude is also extended to the center for sports resources expertise and performance crepes of guard loop and our development partners by the way with whom we will be in the course of this meeting signing an mou so that the center will be available for all olympic teams in the oasis in preparation for the next olympics with express this deal with express this deal and talk of other ferries coming on stream to be easy and cheap to sail across to mark to guard loop and also thanks to our development partners to unicef u s a the european union who's represented here by dr boys the kaibyan development bank the i l o the world bank and the global partnership for for education for the ongoing collaboration in youth spots youth and sports related endeavors i thank you and we look forward to a highly successful meeting thank you dr joules for context contextualizing the council of ministers youth and sports meeting it is my pleasure to welcome mr michael fletcher to do a musical rendition entitled dejmore by joseph ive simian a traditional violinist from the village of labry michael is a self-taught musician and a student of the schoesel secondary school let's welcome him to the stage like mr sheik's where said if music is the food of love play on unfortunately for us at this time only one piece is it has to be satisfactory but michael thank you i am indeed yes one more time yeah i am indeed honored at this time to introduce our next speaker honorable kenson chazamir sinush's minister for youth development and sports and chair of the council of ministers youth and sports he will address us now let's welcome him thank you mr so ceremony protocol already established let me recognize my cabinet colleague the honorable joachim henry is the minister for equity and parliamentary representative for castries southeast let me also recognize my ministerial colleagues my compatriots in this endeavor ministers from the oacs countries let me also recognize a doctor didicus jules who is one of the most potent instruments you could use in the fight to ensure we have all sorts of development in st lucia and of course indeed the region put your hands together for him an absolute resource for all of us let me also recognize excellencies of the diplomatic corps the permanent secretary of the ministry of youth development and sports other staff also see many well-wishers sports enthusiasts president of the st lucia olympic committee mr alfred immanuel is in our midst joseph redsberrera honored today our honored guest today tonight other staff at the ministry staff of the oacs commission especially invited guests ladies and gentlemen good evening it is an honor and a privilege to address you this evening and to welcome you most cordially to the official opening of the inaugural meeting of the oacs council of ministers youth and sports i must express my appreciation to the oacs commission for choosing our beautiful island the helen of the west indies to host this meeting which fittingly makes me the chair of the council i must also applaud my team from the ministry of youth development and sports for the enthusiasm and assistance in collaborating with the planning team at the commission additionally i wish to commend the prime minister and the cabinet for agreeing to st lucia hosting this meeting it is an opportune time in our history for policymakers at the highest level in the eastern caribbean to discuss pertinent issues facing the most energetic and vibrant sector of the population and by this pronouncement i refer to our young people during this strategic meeting as evidenced by today's proceedings a conscious effort is being made to integrate youth and sports a combination that would be would hopefully bear fruits that are sustainable inclusive diverse impactful and enjoyable the theme for this meeting is beyond the field ensuring sustainable impact and legacy of oacs youth i will try through my personal experience and through the retrospect of what happens in st lucia to reveal the importance of this topic and suitable actions that must be taken to see it to fruition robot kennedy once said this world demands the qualities of youth not a time of life but a state of mind a temper of the will a quality of imagination a predominance of courage over timidity of the appetite for adventure over the love of ease it was in june 1966 that he appealed for the empowerment of the youth to become a reality today in 2024 these worlds are even more powerful and inspiring the reminders of the potential and strength of youth in our change in world the theme calls for promoting youth being streaming in policy decision making processes in the oacs and acknowledges that the participation of young people is an essential condition in the political economic and social processes in order for them to trust and believe in the work of our institutions it is fundamentally important to have a youth engagement and participation in various developmental issues the young people they are a major human resource for development they are key agents for social change economic growth and technological innovation participation in decision making should be a key priority area of our agenda it is indisputable that the current times are unprecedented and filled with confusion and uncertainties with the regional and global impact that the COVID-19 pandemic the challenges of climate change economic uncertainty social and economic displacement and growing up in the context of an aging population the time is ripe to engage the youth to identify innovative solutions to the intricate problems facing our region for all of these problems there are no easy or quick solutions but success can only be achieved by creating safe platforms and nurturing their talents creativity and potential our youth are undaunted and have expressed a keen desire to be part of the solution they are very much seized with the issues of today and they know that the solutions that they can contribute to will make an impact in their lives in their lives tomorrow young people have extremely strong values of tolerance and social cohesion they aspire to a life of dignity for all they are committed to peace they are champions for development and change in communities and societies they are essential contributors to conflict prevention and peace building 46% of the world's population is under 25 years old which is the highest in human history that's according to the World Bank in 2017 therefore we have to understand that in such demographic realities the youth hold an enormous potential for change and positive action too often young people are painted with a brush of indiscipline and accused of being responsible for the malaise of social problems opposing this false narrative is our responsibility as the state of our nation's youth in microcosm greatly reflects that which exists in a wider society I am convinced that the youth are already leaders of today and they need and deserve a place at the decision making table I challenge us to an urgent call to action a call that transcends borders and resonates across our shared commitment to the well-being and development of our youth it is time for us to unite in the pursuit of professionalizing youth work fostering positive youth development and the catalyzing collaboration and investment on a regional level professionalizing youth work is not a singular endeavor it is a shared responsibility that demands our collective attention by standardizing qualifications providing ongoing training and establishing a framework for excellence we can ensure that those entrusted with the care and guidance of our youth are equipped with the skills and knowledge necessary to make a lasting impact a regional approach allows us to tap into the collective wisdom of our diverse cultures and find innovative solutions that transcends geographic boundaries as a region we need to take back our young people from the snares and the wickedness of criminal elements we need to take back our current generation from a few thugs that have caused them to identify themselves by the numbers six and seven we need to strategically diminish the appeal of those numbers to our young people by encouraging them to glorify and embrace the number one so instead of only being reactive and investing in law enforcement and modern legal proceedings we need to couple these initiatives with proactive efforts targeted at this and future generations minds you see the good book explores if the good book implores us to be ye transformed by the renewing of your mind and so as a chair of this organization the proactive efforts on youth involvement in crime will be targeted at their minds through a project one campaign we'll ask young people to not see themselves as six or seven but we'll ask them to declare themselves as one instead of stating publicly that they are six or seven this campaign will promote young people seeing themselves as one in a million with this campaign we'll get the biggest social media influencers musicians youth leaders and sports personalities to endorse the promotion and encourage the young people to look within and declare that i have a contribution to make to my country to declare that i could apply myself in achieving my dreams that i can contribute positively to society i kenson kasame i'm not six i'm not seven i'm one ladies and gentlemen this inaugural meeting of ministers of youth and sports is both timeless and timely timeless in that it revisits the recurring issues of the need for greater investments in youth and sports it is timely in that the recent world championship medals won by both st lucha and dominica and the persons of julian alfred and theale of fun should serve as the impetus for the oasis leaders to call for an oasis championship games in the past we had the sports desk however relegating a single desk at the commission to sport will produce the result will not produce that the results that we're uniform what we need is a well-resourced mechanism that would organize the oasis games or championships to provide athletes with a platform to showcase their talent and provide the citizens with the opportunity to witness and enjoy sports at the highest level from 2008 sports journalists and sporting organizations like the sentencing the grenadines olympic committee have been pleading for caricum to establish a olympic committee to establish a regional sports development commission to maximize regional growth in sports and foster sports research and innovation to keep the caribbean at the forefront of the evolving trends of technologies the oasis have proven to be the envy of the rest of the caribbean in terms of our ability to unite and deliver our collective agreements i believe this is the appropriate time to make sports development a priority in the oasis we need to dedicate resources to sports in our region enhance infrastructure provide historic or holistic talent development and strategic partnerships to propel oasis sports to new heights there is a well for sporting talent in the oasis they've properly developed it can reshape the landscape of sports in the entire caribbean the future sports in the caribbean should be driven by the very individuals it aims to serve sporting ministers and governing bodies should actively seek the perspectives of young athletes the technical officials administrators and community leaders by creating platforms for open dialogue and meaningful participation i'm elated that tomorrow history will be made as the policy makers at the highest level will be meeting with the sports fraternity to discuss the future of sports in the oasis a trend that must be emulated and continued ladies and gentlemen the cry for greater investment in youth and sports seem to resonate in all corners of our society if we are serious about tackling the problems in our region it is vital to prioritize involvement of young voices in decision-making processes when youth lack opportunities they are more easily led to crime and violence and other deviant behaviors descending into slippery slopes to the bottom of the social scale failing to invest in our youth is a false economy conversely investing in young people will pay great dividends for all because by playing sports young people can achieve something modern trophies and modern medals they can rise up to become champions of their own lives and score goals for development if we think we have invested wisely and responsibility responsibly sorry in today's youth and it's not too much to expect a good return on our investment which will be a manifestation of the legacy of oasis youth sports can propel sports can transform the oasis region and it also serves as a major commodity for economic activity during our interactions at this inaugural meeting we hope that policymakers advocate for sports to catapult us into a new and improved dimension of economic activity our young people are eagerly watching our athletes are on the starting blocks they are yearning for an enabling environment that will stare their generation beyond the field where they desire to make a lasting impact in this treasured space of the oasis let's get it done for them thank you thank you thank you honorable minister for this very passionate presentation on the need for inclusivity and mainstreaming youth in policy decision making indeed the youth are the leaders not only of tomorrow but also of today at this time a very special presentation will be made i invite mr terry finnister to take us to this next item on the program terry finnister is an award-winning writer and commentator writing for world athletics fifa fivb norc norc secker fina fib and fiba and covering events including the commonwealth youth games carifter games and world championships for regional and international media he is a track and field coach and technical official as well as an administrator currently serving as public relations officer for the sainutia aquatics federation and also as a director of sports sainutia incorporated let us invite him to the stage thank you very much madam mistress of ceremonies protocol having been established let me nonetheless recognize director general your excellency dr diddakas jules uh honorable kenson casimir minister for youth development and sports siren sain lucha and all the ministers for youth and sports from across the oes yes this is indeed an auspicious occasion the gentleman we are honoring today is someone that i am prouder than i think he knows to call a friend i don't think he realizes how much i look up to him um in the years that we have known each other um since i was but a lad as he would say joseph reds prayer is on the verge of his 85th birthday by the grace of god he is known to and revered by cricket fans worldwide here in eastern caribbean of course we have laid claim to him as our own let me tell you a story of an overcomer the story of a man truly crafting his own legacy reds as i think would be public knowledge born in rural gianna he says that when he moved to gianna to georgetown rather at the age of six he was somewhat intimidated awed by the city from childhood he was a stammerer but he did not let that define him and i'm sure for people who don't know the background it might surprise you to discover that reds prayer whom we've been listening to on television on radio for decades up until about what the age of 20 or so reds was a stammerer he actually had a debilitating stammer reds though defined himself just as i grew up listening to him on shortwave radio as i suppose many young men of my age in particular would have grown up listening to him from the far flung corners of the world broadcasting west indies cricket so too did he follow the exploits of the great west indies teams of yore yearning to be part of that greatness but in as much as he played a bit in his youth it was not as a player that reds aimed to make his mark living in europe but nowhere near any organized cricket pussy he stood before his mirror practicing his own cricket commentary growing in confidence and perfecting his craft reds would go on to narrate entire games to himself you had an audience reds your mother his mother so reds spent years narrating his own cricket games to himself how long has it been since he was first handed a microphone when reds prayer first provided commentary for cricket it was between british guy and i wouldn't have that anymore trinidad and tobago with their opponents that was in 1951 10 years later he did his first tests between west indies and india at border when reds retired from cricket commentary in the middle 2010s i should say from maybe test cricket commentary because he still does um he still does us the honor of commenting on our our spl and so on which we are very pleased to have him be part of his voice since then has been known by hundreds of millions having covered 152 test matches over 200 one day internationals five world cups most notably of course the west indies triumphs in the 1970s where he did i think you would have done the final reds and that's a work i was not i'm listening by the way just before you know you try to start calculating my age i was a little bit too young for cricket at the time i must say but um he has too many first class matches to count in this corner of the world though we have taken reds in as one of our own he was invited many moons ago way back in 1984 to create the organization of eastern caribbean states sports desk to work as a sports coordinator with federations across the sub region to build their programs to reinforce their administrative practices to develop champions he spent 12 years at the sports desk molding it building it in his own image in that time we saw the emergence of numerous champions numerous championships volleyball track and field netball table tennis basketball so many more many of these competitions or several i should say of these competitions persist to this day oh we see a swimming started in hotel pools in grenada and sen lucha has produced olympic qualifiers dozens of scholarship athletes we've seen in swimming or in a track and field obviously the exploits as the minister recently mentioned of our two oecs champions at the world indoor championships the likes of grenada's kirani james anderson peters going on to conquer the world levon spencer um so many other great champions coming out of the organization of eastern caribbean states might have been possible without the intervention of the sports desk perhaps but the role that was played by the sports desk in enabling and growing sports in those years that reds was there leading that charge cannot be discounted the example that red set with little more than a shoe string budget and a massive injection of enthusiasm and love for sport and for sports personalities is one that many of us would do well to follow more years ago than i care to remember he granted me a brief interview in barbadas i think it was during a test match at kendington i left that interview with some of the best advice i have received in my career about preparation research attention to detail and i think most crucially most crucially about brevity of questioning because i think i asked read some long-winded question that took about five minutes and he told me don't know no just ask the question and let the questioner answer you so thank you for that reds your advice back in the 90s sticks with me and guides me to this day your passion for sport for national development for the development of our people remain strong stronger clubs more media coverage better coaching a number of the interventions that you had dr jules and minister kasmir talking about using sports to better engage potentially at risk youth don't get red started on how we can improve sports in sen lusia in the ues yes not unless you have a half hour 45 minutes to spare because he will take up the rest of your day the ues is working on a special feature unlocking the evolution of the sports desk under a synogural coordinator before we make a special presentation to reds let's share with you a snippet from that upcoming project which i think we have lined up and it to rock the gentlemen and the other gentlemen for the other end of the phone introduced himself as dr von lewis as the director general of the oecs and he said that um you are one of the names which is being suggested to a head the oecs uh first step of sports desk and would you be interested now um you don't have half an hour to find out about you know all sort of things about conditions and you know you had two or three minutes i mean a director general is calling you your answers are a yes or no and i said yes because just about every event to me was important and important to whatever discipline you know we were trying to focus on to tell you the truth i mean people make much of you know you'll be in a commentator and talking to millions of people and all that that's the easy part but the oecs the oecs appointment was the greatest challenge in my life he has certainly a round of applause for joseph reds plurera we give reds his flowers and lay claim to him as a solution and an oecs man we are pleased to present him at this time with a painting by one of our fine artist mr jonathan glading and let me share with you at this time as we bring the painting across mr glading's words to reds first i would like to congratulate reds for a remarkable career that has touched the lives of so many it was an honor and a pleasure to do this painting for you it made me think about how it takes me hours and hours to create an image like this whereas you can paint a scene in real time with words extemporaneously keeping listeners just riveted and engaged as they would be if they were right there on the cricket pitch so i offer this painting as an artist who works in paint to an artist who works in words this particular match took part took place at la farge chose l if you look very closely there is a rendering of you in the background watching perhaps commentating i took the liberty of adding you to the painting as a way of suggesting your presence in caribbean sport which has become ubiquitous thanks to your decades of hard work professionalism and dedication thank you for bringing athletic events to us in a way that only you can and elevating sport and culture in the process ladies and gentlemen joseph reds perrera first oh yes sports coordinator good evening and for the person who created that protocols has already been established thank you very much for that person who did that because it has helped thousands of people because to have the repetitiveness i think that was brilliant in the words of the late great zevotin the coursey weeks he once told me reds is nice to be remembered and when people remember you appreciate it thank you the organization of eastern caribbean states i left that as i drove away from the mourn head office on the 16th of december 1996 and since then i've always held the organization of eastern caribbean states close to my heart i had the honor of working in another island with the director general when he was working in another area of education and begumon well today is just the anniversary of that a beautiful island like sin lusia like the rest of the of the oesias it's the fifth anniversary of granada right um i don't have 20 minutes of commentary for any test match here tonight but a couple of takeaways i'd just like to to zero in on um the idea of a special sports channel we have many boxing matches many basketball games many netball games many football games and i can go on which are recorded in this entirety and we turn on our televisions at night and we'll see three minutes of that event what has happened to all that material where does it go it goes nowhere we should have a dedicated channel in the oesias when we have all these major events for it to be put on not just the two minutes on whichever television station you might be watching but let us use the material which is there which does not cost whether it can go on the gis whether it can go on commercial televisions i do not know um i'd like to do a takeaway um from the honorable kenson customare um when i listened to his speech he rarely reminded me how basic we were in 1984 the only technical piece of equipment i had was a fax machine there was no google no smartphones no whatsapp you had to really use the one thing that was there to provide the kind of communication in the oesias that was important so what was happening in bvi everybody knew thanks to the fax machine what was happening grenade everybody knew because of the fax machine so things were tough then but i'm very happy that all the oesias ministers have the kind of technology that the oesias staff in 1984 did not have but did a great job in establishing the organization of eastern caribbean states and i wanted to thank dr von lobis for giving me a free hand not looking over my shoulder you're here to do a job res go ahead and do it and i must say that the media in the oesias the media in the wider caribbean played a major role the individuals who then headed the various ministries the directors of sport and i've made a little note here because i want to be thankful to these people some have gone to the great beyond some are still with us sin kits mr swiney granada mr grinnage and tiga barbuda mr samuels and mr white san vincen and the grenadines mr hudson dominica heavy shilling for the mr sarvin the bvi mr penn monzerat mr boxel and i left the first point of contact with sin lucha when i came here here mr's aldeck isaac's who was then the ps ministry of sport to be put our hands together for those people if it wasn't for the media if it wasn't for the sports officers if it wasn't for the prime ministers if it wasn't for the private sector we could not have had a development at the sports desk i must tell you that the game of cricket helped the sports desk a great deal because i was known i was able to knock on doors and help came but i would be making a challenge to the ministers political parties trade unions church groups are strong because they have cells working they're not strong because they have a cathedral or they have an office in in in the city and i'm leaning towards saying that unless we build from the ground up we can build many stadiums we can build many facilities we can have all all the technology we need to build from the ground up and unless we empower the clubs unless we give the clubs a simple constitution which of acts their sharon to share with all our ministers unless we have a club structure which is strong a club structure with a non-playing executive not one president and a hard-working secretary it doesn't work that way we need to build a club structure strong clubs make strong associations strong associations make a strong olympic committee it is not reinventing the wheel it's the only way up the only way up it will have an impact on the unemployed it will have an impact on the boys and girls on the bridges because they have something to belong to every little club in every village of the OECS needs to have a club structure so it has to be tackled it cannot be ignored it must be tackled or rest you would not make the development it don't care how much money was spent it is really almost careful just a few short weeks ago to see that two members of the OECS two athletes bring home two gold medals to the region there are many european countries who left scotland without a medal and the OECS had two gold medals there's so much to be proud about so i focused on the need i challenged the sports minister i challenged the chair to focus on the development of the club structure and i think Sharon kindly shared with each minister here each foreign secretary here a copy of the club structure i shall be a little bold before i close and forgive me if i might not be politically correct we train you look at television at night we trade so many parts and parts of our society we train nurses we train teachers we train police officers we train customs officers you know the gambit but we need to start training our coaches the only way we're going to produce more our friends and more the funds is by empowering our coaches the only way we can empower our coaches is if we create a program to lift the standard of our track and field coaches our volleyball coaches our basketball coaches and it means that the olympic committees of the OECS has got to put aside a special amount of money to bring in people to create that empowerment to create the betterment to create the skills of our coaches if you have better coaches you have a higher standard if you do not improve your coaching you will continue to produce here and there but if you have a strong empowerment of coaches you will have the requisite standard in at the youth level at the club level at the national level etc so i'm appealing to the ministers to have dialogue with the olympic committees of the subregion to see if we can have a focus on empowering our coaches that to me is the only way we're gonna really lift the standard a club structure national association becoming stronger olympic committee becoming stronger and your coaches working in the schools working with youths lifting the standards the night is a very moving night for me it's not easy to stand here and not feel like shutting a tear but big men don't cry big men don't cry Gary touched on a part of my life which was almost like a nightmare it's a terrible a terrible problem of being a stammerer I never ever believed that I could ever have become anything near a commentator but my mother believed in fantasy and I used to lie in bed and do boxing for Madison Square Garden ID Adele and Joey Jordan and Brazil playing England at Wembley and all the cricket matches possible and slowly but surely I was able to overcome it when I told a certain country that I was going to St Lucia to work for the OECS they said what you're leaving here to go to St Lucia brothers and sisters that's the best decision I've made in my life the cricket commentary was not really challenging if you do your homework if you do your research the players are there you know who's bowling it's Walsh or Zambros is you know Marshall Hall but the OECS sports desk was challenging but it was the most satisfying job in my entire life so the organization of Eastern Caribbean states I say thank you very much and it's nice to be remembered and I want to ask the sports minister to remember my challenge constitution for every little crub in any little village that they need something to govern them and we need to train our coaches empower our coaches and we'll have greater standards a number of stars coming through thank you very much I'm sorry it was a little long but I must apologize I must be a very special person to have two outstanding delusions thank you Mr Finister and congratulations Mr Pereira the OECS is indeed very grateful for your years of dedicated service ladies and gentlemen the Royal St Lucia police band will now captivate us with a rendition of local music another round of applause for the rousing performance by the best police band in the OECS the Royal St Lucia police band I apologize on behalf of the Prime Minister who is out on out of state on official business at this at present so we move right along for our final presentation this evening I call on the Silver Shadow Dance Academy to put on a cultural presentation of traditional music and dance let's welcome them to the stage to the front few Silver Shadow Dancers for this pulsating performance a fusion of Afro Caribbean French and of course our ever-popular denry segment music genre of St Lucia finally for this evening I invite Mr Rohan Luber Luber St Lucia's director of youth development in the ministry of youth development and sports to deliver the expressions of gratitude let's grant him a warm welcome thank you very much good evening everyone I'd like to adopt the protocol that has already been established and I'm very honored to be here this evening to deliver the expressions of gratitude known as our voote of thanks it is of great pleasure I stand before you this evening to express our gratitude to all who are tasked with organizing such a momentous occasion first and foremost I would like to highlight and sincerely thank the government of St Lucia the prime minister and his cabinet for grabbing the opportunity to host this inaugural meeting of the OECS council of ministers youth and sports this undertaking is not only timely but also serves as a platform for local and regional development in relation to youth and sports which from time to time may be overlooked by some of our leaders we all will agree that the youth is our now which ships our future and the role of sports recreational and social activities definitely help to shape attitudes and to pave the way for progress special thanks to Pastor Delvin Ford for blessing our ceremony in a moment of reflection and guidance you are provided you have provided us with the necessary spiritual tools to navigate the path that lies ahead your prayer has provided a sense of purpose and unity as we embark on our journey ahead we also extend our gratitude to Dr. Delicas Jules director general of the OECS for his warm welcome remarks setting the stage to ensure that this inaugural meeting fulfills its objectives your insight and leadership are invaluable and we are honored to have you support to have your support in staring the course of action we are privileged to have with us serving as chairman of the council they're not so young but definitely vibrant our very own minister for youth development and sports the honorable Kensin Kazeme thanks for your words of wisdom and for sharing your opinions ideas and your passion for youth and sports development you are a living example of the tremendous positive impact sports can have on the lives of young people we appreciate the extensive work you have done within your ministry and by extension your country may we look forward to your guidance perseverance and labor for many years we would like to express our gratitude our appreciation to the Royal Saint Lucia police force for gracing us with the rendition of the national anthem and a captivating musical interlude your performance has imbued this ceremony with a sense of pride and patriotism it's a round of applause yes and of course we can't at all omit such a captivating musical piece performed by mr. Michael Fletcher a round of applause to mr. Fletcher yes your inner talent and dedication to the arts have added a touch of elegance to this ceremony and you truly provide a sense of hope and encouragement to our youth we extend our gratitude to the Silver Shadow Dance Academy for your fascinating cultural presentation your performance did not only entertain but has showcased the rich cultural diversity that makes the OECS region unique recognition must be given to the media representatives and journalists who are here this evening as well as those who will continue to cover the event your role in spreading the message of youth empowerment and sports development is invaluable you are a critical component in our quest to achieve our mandate thanks to mr. Terry Finister my comrade classmate for providing us with a comprehensive citation ensuring that all boundaries were well covered as we honored our stalwart mr. Joseph Reds Pereira and of course a well played innings by Reds ending the day's play on 84 not out due to poor light conditions however play resumes tomorrow as it will take the Chris to head for his century round of applause I should say Dr. Joseph Reds Pereira thank you Reds for all you have done for our region you are very much deserving of the accolade of the you are very much deserving sorry of the accolades showered upon you this evening and prior may your legacy live on to our wonderful mistress of ceremony Ms. Krista Settage you executed your duties remarkably your my poise and experience provided a spark to our proceedings and thanks for your intriguing and thought provoking piece of spoken word around of applause for our mcf youth month is around the corner so we'll be approaching you soon to the management and staff sorry thanks to the individuals and groups who have contributed to the uplifting ambience of this opening ceremony your collective efforts will not only make this event unforgettable but would have mirrored the high standards which aligns perfectly with the attributes of our council also thanks to our host the management and staff of harbour club for the professional service you have provided in ensuring that we are comfortable and at peace and so I speak for all as we look forward to the cocktail reception which follows just in a few minutes to the dedicated team behind the scenes the event coordinators protocol officers volunteers administrative staff I know my ps and my dps along with a secretary worked very hard your attention to detail and commitment and commitment to excellence have contributed significantly to the seamless execution of this opening ceremony last but certainly not least a heartfelt thank you to all invited guests here tonight especially the delegates ministers permanent secretaries youth and youth and sports directors and all other distinguished guests and attendees who have traveled from various corners of the OECS region to be a part of this of this gathering your engagement and enthusiasm are the driving force behind the success of this event and we are excited to witness the magic that will result from our collective efforts as we embark on the deliberations and discussions that lie ahead let us carry with us the spirit of collaboration innovation and determination to make a lasting impact on the youth and sports landscape of the OECS together we can build a future that empowers our youth and promotes the positive influence of sports in our societies and beyond the field thank you thank you mr. Lubon ladies and gentlemen we have reached the end of this wonderful ceremony I invite you to join us for refreshments which will be served in the reception area to the front of this room thank you for being a wonderful audience once again I am Krista Sainterge honored to be your chair of proceedings have a good evening and please get home safely thank you


So, Dennis, the left speaker, finished his Masters of Science and IT Security this year. The next talk is based on his Master Thesis, Internal Blue, which is a Bluetooth Experimentation framework for which he even received a prize. Yiska, the right speaker, for you left speaker, has been his supervisor during the Thesis and she loves breaking things. After several talks about wireless security, software defined radio and fixed bits, she's now talking about Bluetooth. Please welcome on stage Dennis Manns and Yiska Klassen to their talk, Dissecting Broadcom Bluetooth. Thank you for the introduction and welcome you all to our talk. I'm Dennis and as said, I choose Bluetooth as the topic for my Master Thesis. The outcome basically was I reverse engineered the firmware of a Bluetooth controller, which was manufactured by Broadcom, and I built a little experimentation framework around it. And today we are not only going to present the framework, but also various kinds of use cases around it, and we also brought along some demos. Now if you start such a big reversing project, you certainly know that this will not be an easy task and also quite time consuming, so you might want to ask, why did we do that in the first place? So there are several good reasons. One, dissecting the firmware and exploring it through reverse engineering is really helpful if you want to get insights from a security perspective, and this is what I had in mind when I first started my thesis. But then secondly and even better, once you're able to modify the firmware, you can actually leverage this fully featured and working Bluetooth implementation to be your very own experimentation platform, where you can add new features or can also alter existing behavior. And it almost feels like you can add a kind of an open source touch to a closed source and proprietary platform, which I really like about this project. Certainly this requires certain background in like many different departments like security, code analysis, wireless signals, embedded programming, and also not every researcher has resources and time to do such a reverse engineering project. But we think that the outcomes of this project are really helpful and beneficial for the security community. So, and last but not least, we actually really like reverse engineering. So we already had great experiences with similar projects in the past. For example, some of you might know the next month project where we reverse engineered and also modified the firmware of a Wi-Fi controller. OK, before we show our work, we first have to introduce a few Bluetooth protocols, which we will be mentioning quite a lot throughout this talk. So the first one would be the host controller interface. Some of you might know that it's the HCI and it's a protocol layer between the Bluetooth controller and the host system, where the host system would be, for example, an Android phone or iOS or Linux or any other operating system, which implements those upper layers of the Bluetooth protocol stack. And all the lower layers are actually implemented inside the Bluetooth controller and one of them would be, for example, the link manager protocol, the LMP. And this one is also really interesting. It actually manages connections to other remote Bluetooth devices. For example, pairing is also done on this protocol layer. And what's an interesting difference is that the link manager protocol is actually transmitted over the air to communicate with other devices, whereas the HCI protocol is only used locally to communicate between the operating system and the Bluetooth controller. And another interesting fact to know is that the HCI is actually able to be observable from the host side. So if you maybe tried to capture on a Bluetooth interface in Linux before or if you turned on the BT Snooplock feature under the development settings in Android, you probably have seen HCI packets in Wireshark before because this is an easy task to do. However, you probably did not see LMP packets in Wireshark before because this protocol layer is actually implemented inside the controller and it's not observable from the host side. You won't see those packets if you just capture on a Bluetooth interface because you can only see what's above the HCI layer. And so the other thing is that you cannot also simply sniff this from the air because Bluetooth has frequency hopping and encryption, so it's a lot harder to sniff those packets from the air just as with Wi-Fi, for example. But today we try to change that. Now I will introduce the framework I developed and show its features and then later we go into more details and also present some demos. As already mentioned, we named the framework internal blue. It's open source and you can find it on GitHub. Currently it's only compatible with the Nexus 5 if you want to use all of its features, but we are also working to port it to other Bluetooth chips and other smartphones and also other platforms like the Raspberry Pi. And soon you will have more devices which are supported by this framework. We also already gave a talk where we introduced the framework and give some details about internals and how it works. So if you're interested and want to learn more, then you should check out our previous talk which was also recorded and you can find the link down at the bottom of the slide as well. Basically in the nutshell we use vendor-specific HCI commands which are implemented by Broadcom and allow us to read out and modify the firmware while the chip is actually running. And on top of this we basically implemented a Python API to interact with the firmware and we used this API to then implement all kinds of features which we find interesting. For example, one of the first things we did was implementing such a LMP monitoring mode so that we can finally see LMP traffic on our laptop in Wireshark. And what comes along with this is that we are also able to inject arbitrary LMP packets inside existing Bluetooth connections. And this turned out to be also very interesting because then we can test how other devices react to maybe packets they don't accept or at least it's very good for experimentation. And for example, we used this to write a little proof of concept script for the fixed coordinate invalid curve attack that was released this summer, not by us but by other researchers. And we were able to actually prove that other devices are vulnerable to this attack. So this is a really helpful and practical tool. Also, at some point, we found Crash our own. So we found a bug in some older Broadcom firmwares which allows us to remotely crash the firmware in some of the Broadcom chips. And in some cases, we're even able to execute a limited set of functions. So this might be even more interesting than just a crash but more on that later. Now, if you first start with the main thing about this is how do we actually modify the firmware? How is patching done? And I already said that Broadcom uses those vendor-specific HCI commands to read them out, their read RAM, write RAM, and launch RAM. And they do exactly what you think they would do. So basically, we're able to read and write in the address space of the firmware and also to execute arbitrary code snippets in the context of the firmware. And this is pretty powerful. Broadcom actually uses this to do their firmware updates. So they ship so-called HCD files which are files that contain firmware updates. If you have a Broadcom chip inside your laptop or inside your phone, you should find such a file with the extension HCD on your file system. And those files actually contain just a sequence of those commands to upload all the changes and patches. And they're even able to do temporary patches to the ROM of the firmware by another mechanism that they call PatchRAM. We also had to reverse engineer this and now we are finally able to do all those patching ourselves. Now, what is also interesting is that those files, the HCD files are neither encrypted nor signed. So it's quite easy to actually modify them once you understand how they work. And also the firmware itself on the controller is not obfuscated. So there are basically no major attempts done by Broadcom to prevent anyone to reverse engineer and modify this firmware. Currently, we write our code in assembler. So we write assembler patches, but we're working on including this in our next month project to finally be able to write patches in C code, which will be more comfortable and portable. First, of course, we have to do the reversing. Yeah, so as Dennis told you, the code is not obfuscated, but there is no strings and no function names. So you end up with thousands of functions that just have no name.  And then there is a tool that I used which is called CodeCard to try to separate those function into modules. But also the modules don't really tell you that much because the problem is then you have hundreds of modules and then you know which modules are central and you might to start reversing, but it's not really fun. You have 2,800 pages of Bluetooth standard. You might have some parameter checks in there. So we have bounds which the parameters should be in. And then you search for those numbers again in assembly code and you might find some matches and then you have a concrete functions. So that's what we both did for months, staring at standards, staring at the code. Then people asked me, yes, yes, yes, that's not nice, but does it work on recent devices? And now the problem is even the Nexus 6P has a firmware from end of 2014. So I just decided to buy a development board which has also a slightly outdated firmware, I mean just one year old. Meanwhile, this part of Broadcom was acquired by Cypress so it's called Cypress, but it doesn't matter, it's still the same mechanisms in there. And I was able to use the same HCI commands. So I can still modify the firmware on this. I can extract the firmware. And actually I just got that on December 6th and three days later I had all function names because somewhere someone forgot a patch.elf with all function names in the development kit. So that's 11,000 function names, 3000 object names. Nice, yeah. So by development kits earlier. Okay, let's get closer to the first demo. So as mentioned, we have this link manager protocol which does interesting things like pairing and all kinds of stuff. And it's implemented in the firmware so we cannot really see it from outside, we cannot capture it in Wireshark. And we wanted to change that, so we wrote a patch that will actually hook some of the functions inside the firmware, those that are handling LMP to actually forward all the traffic over the HCI interface back to our Android phone. And then on the Android phone we use an Android Bluetooth stack which has debugging features compiled into it so that we can also forward all the HCI traffic via TCP to our host computer. And from there we can then show it in Wireshark. We use a custom LMP dissect the plug-in which we borrowed from the Ubertooth project. And yeah, that's it, we have a LMP monitor mode. I will show that in just a second. We also have an LMP injection mode. So we can simply invoke functions inside the firmware and so we can also invoke the function which actually sends LMP packets to other devices which are connected to our Nexus 5. And so yeah, with this we have both channels of the communication and can actually send arbitrary traffic to other devices. So for this, let's go into a command line, start the framework. The framework has a command line interface where you can use all of its features and like interact with the firmware and to start the monitor mode I can just type this command which will start a Wireshark instance and also install all the patches which we need into the firmware of the phone. And now from this time on we actually have all LMP traffic forwarded and shown in the Wireshark frame but currently we don't have a Bluetooth connection that's why you don't see anything. Okay. Okay. Yeah, so we still need a Bluetooth connection, right? I could just pair those devices to create a connection and then we would see LMP traffic but I wanted to show something else. So this will be a combined demo actually because Bluetooth has some more interesting features which maybe not everyone knows, at least for me that was a surprise when I first learned about it. So even if your device is not being said to be discoverable by other devices it still accepts connections from any other device. The other device just needs to know your MAC address and can simply connect to you without even being paired before. You don't even notice this because the device doesn't have to trigger the pairing process and then the user won't be notified. And so by just finding out the MAC address of any other device, I can connect to it on this LMP layer and start communicating with it. And finding out the MAC address is also not that hard. There was another talk which we mentioned down at the bottom of the slide. It's called Bluetooth Smells Like Chicken by Dominic Spill, Michael Osman and Mark Stewart which shows that this is actually possible and not hard to do. So I can actually just type connect and give it the MAC address of another phone. So we need it again, we need it, yes, great. Yeah, perfect. So on the right side you actually see an Exos 6P which will be our target. You can hopefully barely read the MAC address which is shown there. On the left side is the Nexus 5 which is the phone we use for testing like the phone which is connected to my laptop here and is used for internal blue. And as you also can see, the Nexus 6P is currently not in the Bluetooth menu so it's not actually discoverable by means of Bluetooth. I still can connect to it when I actually type connect and the MAC address. This might maybe take a few, no, worked directly, perfect. So now you can see that we actually have traffic on the LMP layer. What you also might notice that on the Nexus 6P there wasn't anything. So the user didn't notice but I have now an established connection to this other phone and you can see the LMP traffic which is going on this protocol layer. As you can see, this is quite a lot. There are feature requests, version requests, also name requests so that the phones know how the name of each other is. And yeah, from now on I can also try and inject arbitrary LMP packets. For example, I can send an LMP packet with opcode one which would be a name request and ask for the name at offset zero. And you should see that the name request has popped up here and the other device even answered with its name if we scroll down here. You should at some point see that we have the name Nexus 6P because we don't rename our devices. But I can also send like arbitrary LMP packets so I'm not bound to anything that is in the specification. You've already got the detach. So the other device actually detached which happens from time to time can reconnect. So if we don't do anything in between we will get a detach from the other device because we didn't do a pairing or something so we reestablished the connection and now Dennis is going to send something that is not specified just LMP 99. So it's even saying here this is unknown but as you can see the payload is actually sent and the other device correctly answers with this is not accepted, I don't want this. But you can probably see that this is very interesting for a security researcher because now you can see how the other device happens in certain conditions if you send them certain packets and yeah, quite nice to actually experiment with. Okay, I think that's it for the first demo. Let's stop this and go back to the slides. You don't need to in-screen anymore? Yep, great. Okay. Thank you. Another thing in a Bluetooth standard is that you need a possibility to pair devices which have no input and no output capabilities so they cannot show a pin and you cannot enter a pin and this is the standard for any headset but also a man in the middle can change the input-output capabilities and then you might just get displayed this yes-no pairing without a pin request even though your smartphone could show more than this. And I have a demo video again of the same thing that's this one so on the left-hand side I have again a Nexus 5, on the right-hand side I have an iPhone and I'm pairing them. I just changed the request in the capabilities that I'm not having input-output capabilities so you can see on the right-hand side on the iPhone it's just showing this yes-no question and on the left-hand side you still have the same algorithm which just does the same thing. So pairing will succeed. There's the same cryptographical routines but you are not being warned on the iPhone and that's a bit critical so the standard is not saying please warn the user to check if the other phone really has no input-output. So I just say pair and it pairs. Yeah. So far that's only things that are as they are in the standard so it's not too surprising. So the question is can we find more bugs? Yeah, finding bugs in Bluetooth. Actually, I didn't even want to find bugs in the beginning I just wanted to understand how everything works so I went through the handlers and I checked there's this checks of the parameters so there is a parameter check in the beginning of each handler that shows me a bit which handler it could be according to the standard and suddenly there is a handler which does not have any check so there's just a missing if somewhere. And then I compared the firmware versions that I had and found out they silently patched that already someone between June 2nd and August 19th in 2014 but they never updated all the devices so they never shipped an HCD patch. So I contacted Broadcom and said yeah you have a problem and they said no we don't and I said you really have a problem there and so on and then they said nah it doesn't exist and then I showed them more and then they said yeah okay but it's not compliant to the standard what you're doing. I'm sorry my next exploit will be standard compliant. And then we discussed a bit more and then they said it does not affect Wi-Fi performance well in my test it did whatever. Doesn't matter. So basically you can switch off Bluetooth on another device and then Bluetooth restyles typically depending on configuration. And as Broadcom didn't tell me much about this I started testing out things on my own so which devices actually still have a firmware that is affected in their Broadcom chip. It's quite a lot. So it's like the iPhone 6 MacBook Pro from 2016. Of course my Nexus 5, Raspberry Pi 3 and so on. And this list is really not complete this is just like I asked my students can I test your smartphone some of them said no are you crazy. And that's the list I got just during the last weeks. And this is the one I'm going to demo. I just named it BTB Gun so you can kill the Bluetooth of annoying songs or something. Yep so I need to go into the Bluetooth here. That's great I even had a Bluetooth is not real and so on that's really great what is going on here. Yeah let's go for the demo. So first we are going to patch the Nexus 5 with our funny attack and then I just press enter and now it takes a while until the iPhone is realizing like oops my Bluetooth is gone. So if I'm playing music you will see it faster the music would already stop playing. Let me just enter another time just yes and there it's gone. Oops. And then it appears again. And so now I can just do it again and again and again and it's actually so fast that the other person could not play music because music also stops playing after this disconnect. Yeah that's that demo. Now we were wondering what is actually happening. So actually the crash is the best case. So there is a handler I call it handler A because I'm not leaking the actual problem here. Broadcom didn't fix it yet. So there is this handler which just should take let's say two arguments or something but it doesn't check the parameter range and the compiler likes to put one handler after the other and then we just go into the next handler and so we have something like 250 functions that we can call from the next handler but with wrong parameters so it's a bit buggy and sometimes if a function expects to get other parameters it just crashes but otherwise we can execute functions and on the Nexus 5 we looked a bit more into this and I found out that I can enable test mode. So test mode should be something only locally to be enabled on a phone if you have root access to the driver and then you tell the driver I'm now going to test your frequencies and so on please go on test mode but I can now do this remotely. So I didn't bring this one as a live demo. I mean I have a hack RF with me if you can do that during Q and A because the problem is there's probably too much going on in the spectrum here and you wouldn't see the test mode starting anyway. So I'm just doing the attack and then on the left hand side I just do the quick pass you can see the test mode so that's just the default test mode hopping around in all channels. The packets now appear a bit out of order because I just put them into a queue, send them. This question mark payload is the malicious payload. I just say test control and test activate and first they get this not accepted and then after this question mark payload you can see that it's accepted and on the left hand side you can still see that there is the test mode going on so really block things for a longer time and then it's accepted magic. Yeah. If you combine this with disabling adaptive frequency hopping you can even force the other device which is also done in test mode to stop hopping for a while and then just jam a selected frequency so you could also jam a selected Wi-Fi frequency that this device is currently using and it's a combo chip so you would really be on the same antenna. We can confirm this works on Nexus 5 and Xperia Fats set three because they both have this BCM 4339 chip it might also work on other devices with that chip. It's a bit random to find out what is in there. You need to find teardowns and so on. So when finding this bug we started developing a tool chain so Dennis added a feature for trace points you can add now a trace point to a function which is then called once and dumps all the registers and the stack and heap. I then fed this into an emulation framework which is currently quite slow with Unicorn and Radary 2 but I get a full call trace which is very nice to look at so I have an idea of what is going on what is changed in the memory and I currently also have a student working on QEMO-GDAB set up which is faster but producing less output just to fast more efficiently. However, you get really a lot of output that we weren't able to completely analyze yet so there's probably more maybe tell you something later. Now you need to somehow fix that bug and that's really a problem and that's also why I didn't tell you the exact payload that is causing these issues because the fix would be in one of those HCD files it would be plain text, it would not be signed and it would just tell you directly this handler is vulnerable in exactly this position and so on. The patch is just 14 bytes but you need to install it and then it's easy to understand what it does, right? So I had the idea, let's do some more generic fix so what I planned to do was having a generic filter filtering some packets like that you won't reply to Pings connection establishments and so on to entrusted devices and then just over Christmas I started testing that one with bigger setups or with more phones and so on and then I realized, okay, if I throw away some packets and the other device does not expect me to throw away packets then the Bluetooth stack of device which now tries to connect to me is going to crash. So I had the next bug so I try to fix one bug, I get the next bug, you know this. So I actually cannot release any fix because all of them still cause the next bug and so on. So how long will this bug be around pretty long probably because there is some devices which are no longer getting vendor updates. It needs to be in the vendor update, it needs to be this special HCD file and so on. I mean, we can also publish HCD files if needed. That's possible with our framework, that's the good news but it will probably never be an official update and the vendor updates will obviously leak the vulnerability so it's chicken egg. As we found this bug still to be present in devices that were produced in 2016, we recommend you to turn off Bluetooth, especially if you have a Broadcom chip set produced before 2017 but in general just turn it off, that's probably the safest option. And we found out that very old devices having something like Bluetooth 3.0 are not vulnerable because that feature that we used didn't exist back then but still it's a large number of devices having this issue. So thanks for listening. And again, if you have questions, we have eight microphones in the hall. Please line up at the microphones and you can ask your questions. The signal angel has the first question from the internet. Yes, so from the internet, ask whether you can guess the Bluetooth MAC address from the Wi-Fi MAC address of a device. So if I go into, can we switch the camera on again on my magic box here? Is that possible? Yes, so actually if you go to the settings about and then you will see that the Wi-Fi and Bluetooth MAC address they are just off by one. So yeah, you have to know, however, that this is not the case with every phone. So usually I think newer phones actually try to randomize their Wi-Fi MAC address to be not traceable anymore. I'm not sure which devices do that. I think the Nexus 6P does that. So the first part will be the same because it specifies which vendor this chip was made from but then the lower and least significant bits will change. So it's sometimes possible, sometimes not. Yeah, I think that's the answer to this question. Okay, the next question was from the microphone eight at the very end of the hall. Hello, thanks for your talk. I was wondering in your second demo, you showed us how you connect to a device just using the MAC address and this device was not advertising his name. How do you plan the MAC address if it's not advertising? Yeah, so there are ways to find out the MAC address of devices which are nearby you. So for example, if your device has Bluetooth turned on but it's not discoverable at the moment but you're listening to music on your headphones or if you have a smartwatch connected or any other Bluetooth device connected, then you will certainly send Bluetooth traffic and you can sniff that from the air. For example, if a software defined radio or an Uber tooth and so in the talk we mentioned and we also have a link to this in the slide, I guess it was here, Bluetooth smells like chicken, Michael Osman and Dominic Spill, they actually explain very detailed how you can then infer the MAC address from those packets you sniffed. And yeah, it's doable, it's not as easy as with Wi-Fi but it's certainly possible. Thank you. Okay, the next question was at microphone number one. Thanks for your talk and for demos. The question is, does this firmware have any mitigations against exploitation? And if we imagine that it has, would it help against such bugs? So there's no real address randomization, kind of the obvious way because most of the things are actually global offsets inside a firmware so everything is at fixed addresses like you would use global variables all over. There's also the RAM is actually executable so you can execute on the stack, you can execute on the heap everywhere so there's no real mitigations for such an exploitation. It's like, I don't think even the newer ones have this for the Nexus 5 obviously. And another thing that really helps is so LMP has a version request, version response which is always sent so I can ask a device, do you have a vulnerable firmware and which version and then I can run exactly the exploit and the firmware is standard and I can just run with the addresses that I know for the certain firmware. Okay, the next question was at microphone number two. Then again number one, three and five. Hi, thanks for the work especially for BTBGUN, seems like it's the new TVBGUN. I'm not sure with which kind of iPhone that works because you had a slide about iPhone up until six and then you had a slide that's saying if the chip is older than 2017. So does that work with the last phones as well? Only up to iPhone six that was the newest iPhone I could get so if you have an iPhone eight or something our attack does not work. Sorry? Are you gonna work on it because a lot of people are playing very bad music they have newer phones. You mean, so the attack, the attack is not working on iPhone six but the general framework like patching, HDD files or changing the firmware will obviously work on any Broadcom chip. Okay, thanks. Broadcom actually uses this mechanism for all their chips, all their Bluetooth chips. So you can use this framework for every Broadcom chip, every device that has a Broadcom chip. You only need to do the reverse engineering to get like the real addresses and offsets inside the firmware to do meaningful patches. But for this you always need to be to have a router device, you need root access on device to run our patching framework. Okay, thanks. Okay, now the question at microphone number one. Do you have a list of vulnerable chipsets so I can check if my phone is vulnerable if it's not in like, in the slides? Yeah, but it's very incomplete. So I also have the version numbers and subversion numbers of those phones but just consider the time range. So if your smartphone does Bluetooth 4.0 to Bluetooth 4.2 and has a Broadcom chip then it's very likely to be vulnerable. Okay, now the question from microphone number three. Thank you for the code and the talk. Quick question. So have you looked at car Bluetooth? And if not, are you thinking about it? So I actually used this tool. As I mentioned previously, we are also able to test other vulnerabilities. For example, this fixed coordinate invalid curve attack. And so I used my tool to actually check if a car radio was vulnerable to this fixed coordinate invalid curve attack that was released this summer. So it's basically patched since half a year but the car was still vulnerable to this. So the framework is basically usable to test car radios as well but I haven't like specifically looked into car radio. Thank you. Okay, now the question from microphone number five. Then we will take a question from the internet and microphone number six.  What's the worst case? Could you manipulate memory or something? The worst case is hard to estimate. I mean, we can change some memory addresses at least in the Nexus 5. And for each smartphone, there are other functions by the compiler put there. So to really know what is happening, we would now need to analyze like really tons of firmware and check what is in there and do some fuzzing. We already found out that some things only happen if you combine multiple packets and so on. So it's really hard to estimate what is the worst case. So the very worst case would be so to say that you can run arbitrary code in the Bluetooth firmware itself. And then the next worst case would be if there would be another vulnerability in the driver that you could escape the firmware. So that would be the next step, but that really requires an exploit chain. So the very worst case would be something similar. So there has been vulnerabilities in the Wi-Fi part of a program chips where you had the possibility to really run an exploit chain which then rooted a device in the end. But it's hard to estimate if you can do it with this or not. Okay, now the question from the internet, please. Do you know if any older but still supported devices like old MacBooks are patched and can the US actually detect this in any way other than the chip crashed? Not really. So we can try to not crash the chip by first checking if it is sending appropriate answers, but typically the really only thing to be sure is that it crashes. So that's so far the only way because I mean, obviously if Broadcom would tell the following chips are vulnerable, which they didn't so far because that's also to protect themselves probably, then you could be sure. But yeah, as of now, that's the only way to check it. Thank you. Now the question from microphone number six, please. Yeah. Would it be possible to increase the Bluetooth radio transmission power by patching the firmware? So that Bluetooth works across entire buildings and not only in a similar room. Yeah, so the thing is we are actually now patching the firmware of the chip and the firmware does like all the link layer stuff of Bluetooth. The real physical part is probably done in another component inside the chip, which may be running another kind of small real-time firmware and we haven't found that yet. We're still looking for it because it must be in there somewhere like the Bluetooth modem. And maybe we can actually change the settings for this modem. I don't think it will be too drastically, but maybe if you're in different areas of the world and like your Bluetooth has different strengths and different areas of the world, you can maybe manipulate that. But we haven't found it yet. Okay, thank you. Okay, next question is coming from microphone number four. Does Bluetooth chip set have access to system rain? Sorry, I didn't get the last word. The system writes or what do you mean? System rain, memory. You mean the memory of the main processor like where Android or iOS running on? Yes. No, it's not like as with Wi-Fi where you have direct memory access, but Bluetooth, the HCI interface is the only interface between those two processors and this is usually done over either USB or in the Nexus 5 is actually UART. Okay, next question is coming from microphone number three. Many thanks for the enlightening and scary talk. I missed a little bit of the beginning, maybe that question was inside there. Did you or do you consider to disclose this vulnerability, for example, to BSI, Bundesamt für Sicherheit und Informationstechnik? As I would consider their obligation to inform general public like put a note on their website saying, look, if you are running a certain smartphone, you are vulnerable to a certain attack and that would put much more stress on the vendors to really look into this. Yeah, that sounds like a good option. So far we are, so we asked Broadcom when we can publish things and at least they agreed that it's no problem to publish it in summer, then it would be public for everyone, but yeah, BSI would also be a nice option. Thank you. Okay, is there another question from the internet? Only. Please switch on the microphone for the internet. Hello. Hey, so do you know if any devices have been patched yet, which have not been released after 2017 or are there no rolled out patches? I don't think so. So it took Broadcom two months to actually confirm that there is this vulnerability. So on December 3, they said, oops, it really exists. And then on December 9, they were like, ooh, do you really plan to do that talk here? And I did the most recent iOS update on the iPhone 6 that I just showed you. And this one is still vulnerable. I think it takes some time for testing. So I would say the first patches will come out maybe in one, two months, but we don't know. Okay, one last quick question from microphone number one. So is it, do you think if it's possible to trace back when was this vulnerability introduced so we can go back and try to hack all devices that probably have the same firmware or firmware vulnerability because they should be backward compatible, right? So if the same handler is implemented, I don't know, in 2012 for the first time, then probably the devices can be narrowed down, right? So at least, so the Nexus 5 has a firmware from 2012 actually. So somewhere, so the Thune 2 is when it still existed in 2014, I don't know. So in each firmware, there's a build date and I would then need to extract the firmware of vulnerable devices and so it's a long process, but at least the vulnerability was there for multiple years. Okay, now give please a huge round of applause for Jeska Klausen and Dennis Mons for their talk. Thank you.


Three points, baby, one and we're tired. Yeah! We're winning. How you doing? What a shame, man. We got a lover, man. Titans get their first division game next week up at Indy, so a chance to string a couple of wins together. This is a f***ing divisional game. We don't like these moments. Let's keep it real. We're about to be a f***ing heavyweight match. Turn this into a dogfight. Hit again, Jeffery Simmons.