You're listening to the Naked Bible Podcast. To support this podcast, visit nakedbiblepodcast.com and click on the support link in the upper right-hand corner. If you're new to the podcast and Dr. Heiser's approach to the Bible, click on newstarthere at nakedbiblepodcast.com. Welcome to the Naked Bible Podcast, episode 206, the 70 Bulls of the Feast of Tabernacles. I'm the layman, Trey Strickland, and he's a scholar, Dr. Michael Heiser. How you doing, sir? Pretty good. This listing of the title made me think that there's a joke in there about bull or no bull somewhere, but what can we do? When I think of it, the first thing that comes to my mind is a slaughterhouse. I can imagine the sea of red after seven bulls. That's because you're from Texas. Yeah. I mean, that's like a feedlot right there. Yeah, I guess it would be. You probably should have got some steak sponsors for this episode. Maybe we can go back and do that. I was just going to say maybe too late for that, but that's not a bad idea, I guess. This is our first of several single topic episodes, so is there a reason why you picked this one? This is something that I can't remember how I got the question. It was probably email. It may have been in some Q&A thing somewhere, but somebody asked about this. Why are the 70 bulls of Sukkot, which is the Hebrew term, the Feast of Tabernacles, in numbers 29? That's our passage, numbers 29, 12 through 34. Is the number 70 significant? Does this have something to do with the sons of God and the nations that were divided and allotted to the sons of God and all that stuff? It actually derives from that question that I got quite some time ago. Here we are. That's how we came to this. This is sort of like an extended Q&A. We needed one full episode for this. As we get into it, we're going to post a link to a couple of things here. There's an online source about this that was authored by Dr. Noga Ayali Darshan, who I believe is over at the Hebrew University in Israel. I think that's where she's still at. But she has a journal article, a published journal article, a scholarly article that's published in 2015 called The 70 Bulls Sacrificed at Sukkot, numbers 29, 12 through 34, in light of a ritual text from E. Now that article is not obtainable for free online, but Professor Ayali Darshan actually sort of created a shorter version of that for the interested layperson. And that is online. So we're going to post a link to that. And that particular article is entitled This. It's kind of an inflammatory title. I guess you need that for online stuff. It's Sukkot's 70 Bulls. The Torah's adaptation of a polytheistic ancient West Semitic custom of sacrificing to 70 gods. Okay, we'll have a link to that online so people can go read that. Now I'm going to interact with both the online source and her journal article. We're going to be referencing Milgram's commentary on the book of numbers. And we'll also put a link to www.jufaq.org about the holiday of Sukkot just so that people can get familiar with it. I'm going to, again, interact with this material and I'm going to disagree with Ayali Darshan as far as her conclusion, sort of the trajectory that she goes off on with respect to this passage. There's something actually in Milgram's commentary that I think at least hints at a better approach than saying the Israelites were offering to 70 foreign gods. So with that as a setup, let's just take a look at the, I'm not going to go through all the verses of the passage because it's, you know, this day they offer this many bulls and this many lambs and all that sort of stuff. The reference is numbers 29, 12 through 34. If you do want to go read through the whole thing, the point is that if you count all the bulls offered in that passage, they add up to 70. And again, the number is what drew the initial interest as far as the question. Now to get us rolling here, I'm going to quote from her online article, Ayali Darshan's online article, the shorter version. And she writes this, this will help set up the whole topic. In describing the offerings for Sukkot, and again, that's the Hebrew term for tabernacles, what we, you know, our English Bibles have as the feast of tabernacles. In describing the offerings for Sukkot, the holiday offering section of Parashat Pinkas stipulates the sacrifice of a total of 70 bulls as burnt offerings spread over the seven day autumn pilgrimage festival. In addition to the other sacrifices of the day. So this isn't the only thing that gets sacrificed, you get 70 bulls and lots of other things. But again, the point of interest is the 70. Back to her, her quotation, this huge number of offerings is striking, especially in comparison with other Pentateuchal festivals, none of which requires more than two bulls a day. Scholars have suggested that the double number of rams and lambs on Sukkot relative to Matsot, again, the bread, the unleavened bread, and the unparalleled 70 bulls sacrificed during the seven day autumnal festival highlight its importance in the Israelite calendar. It is indeed referred to as the festival. The Hebrew there is hachag, without any further identification in the description of Solomon's dedication to the temple in 1 Kings 8, 65, and also in the law of Ezekiel, that's Ezekiel 45, 25, and in certain rabbinic texts. Now, what she's saying there as the end of that quotation, she's saying, look, the fact that you have so many animals offered for this particular festival must mean it had special importance. And it is called the festival as though everybody who's reading the text, when you when you get to the festival, they just sort of would know in the days of Solomon, in the days of Ezekiel, they know we're talking about that one, we're talking about the feast of Sukkot, the feast of Tabernacles, that was the festival. So this is how she begins, you know, her presentation of the issue. And again, it's the amount, therefore, of the sacrifices. And then she's going to zero in on the number 70. And then this reference to the festival, like everybody knew this was the big one, had special significance. Now, before we get too lost in this, we need to talk about, well, what is this festival about? You know, what's the meaning of the festival? And this is where I'm going to draw on the website, jufaq.org. If you just go to that site, look up Sukkot or Tabernacles or something like that, just even holidays, you would find this. As far as the meaning of the biblical festival, this is right from that website. It says the festival of Sukkot, which is outlined in Leviticus 23, begins on Tishri 15, the fifth day after Yom Kippur, it's the day of Atonement. It is quite a drastic transition from one of the most solemn holidays, Yom Kippur, in our year to one of the most joyous. Sukkot has a dual significance, historical and agricultural. Historically, Sukkot commemorates the 40 year period during which the children of Israel were wandering in the desert, living in temporary shelters. Agriculturally, Sukkot is a harvest festival and is sometimes referred to as Chag Haasif, the festival of ingathering. The word Sukkot means booths. Again, the English Bibles will often have Tabernacles and refers to the temporary dwellings that we are commanded to live in during this holiday in memory of the period of wandering. The name of the holiday is frequently translated Feast of Tabernacles which, like many translations of Jewish terms, isn't very useful. This translation is particularly misleading because the word Tabernacle in the Bible refers to the portable sanctuary in the desert, a precursor to the temple called in Hebrew, Mishkan. The Hebrew word Sukkot and the plural Sukkot refers to the temporary booths that people lived in, not to the Tabernacle. And lastly, Sukkot lasts for seven days. Now that, again, is drawn from the jufaq.org website, just about what the festival is. But another little rabbit trail, Tishri 15, again, that date was noted in what I just read. Tishri, of course, was the first month of the civil year. Tishri 1 is Rosh Hashanah of the civil year. It was also the year of inauguration of Kingly Reigns in ancient Judah, southern kingdom. Tishri is usually September or October on the Gregorian calendar. That's why it was associated with ingathering the harvest. Now, on the Ecclesiastical calendar, Tishri is the seventh month. And so we have this little reference to Tishri. And again, if you're familiar with some of the other things we've done about calendar, you probably were alerted.  This is, again, in the same month. But for our considerations, the importance of this is going to have to do with the fact that it follows the day of atonement. And again, it's this sort of festival that commemorates the deliverance or the successful traversing of the wilderness, deliverance from the wilderness and being able to successfully navigate that journey and wind up in the promised land. So now back to the fundamental question that prompted the whole topic. Why the 70 bulls? This is where we want to camp on for the rest of the episode primarily. And again, we will have a link to Ayali Darshan's shorter version on our on our episode page, but this is drawn from her scholarly journal article published in the Vedas Testament in 2015. Now, from her online article again, she writes this. Well, the suggestion that Sukkot was the autumnal New Year festival. In other words, again, think of that in the civil calendar. This was Tishri beginning the year while the suggestion that it was the New Year festival, or at least part of the New Year festival, that may explain the double number of rams and lambs offered in relation to other festivals. OK. So she's conceding that, hey, maybe it was a big deal because it was the New Year thing. OK. But she adds it does not explain the additional sacrifice of 70 bulls. Again, the number to her is significant, and I would agree. I think the number is significant. The rabbinic tradition, she writes, was the first to note explicitly that the number of offerings was 70 and the first to draw attention to that. And it links the 70 offerings offered at Sukkot with the 70 nations. You actually have this link created. Somebody in one of the rabbis. This is tractate Sukkot 55 B rabbi El Azar states, quote, to what do these 70 bullocks that were offered during the seven days of the festival correspond to the 70 nations? You actually have that in rabbinical writings. Some rabbi noticed the number, did the counting, did the math and saw it was 70 and wanted to come up with an explanation for that and actually proposed that it had something to do with the 70 nations. Now, that's kind of interesting just to go on a little rabbit trail here, because if you remember from reading Unseen Realm, or maybe some of you have read my article Deuteronomy 32.8 and the Sons of God published in Dallas Seminary Journal back, I guess it was 2001, whatever that was. You know, there's this whole issue of how the Maseridic text, the traditional Hebrew text gets rid of the reference to the Sons of God there. But here you have some sense in this rabbinical writing that, OK, this must have something to do with the 70 nations. And what Ayyali Darshan is going to do is say, yes, we agree with that. And the number 70 is significant because it's not only 70 nations. It's, you know, you have these 70 Sons of El from Mughar, the number of the Sons of God. So you actually have a little bit of a vestige of this worldview, even in the rabbinic writing, even in this rabbinic selection, which I find kind of interesting. You know, some of it survives despite the alteration of the Hebrew text in the Maseridic text tradition. Now, she adds, Ayyali Darshan adds in her journal article the following. She says, rather surprisingly, modern commentators tend to ignore the issue. Unquote. Yeah. Yeah, we've we've found that in a number of cases. When you get into, again, the old ancient Near Eastern Israelite worldview. Yeah, lots of commentators just ignore this. And I think, you know, I think she's trying to be fair here, but I would go further and say a lot of them just aren't even thinking about it. It's just not on the radar. Well, it's it's on her radar and certainly on our radar. So she's well aware of it. And what she's going to do in her article, what she does do, and you can get the shorter version for free, is she will apply this to the 70 nations and not only the nations, but the 70 gods over those nations. And her view is that the Israelites once a year actually offered sacrifices to these other gods. OK, and that's the part I'm going to disagree with. I think that there's something else going on here. Now, in his numbers commentary, Milgrom cites the Midrash in Numbers Rabbah. And this is another Jewish text that's extra biblical, rabbinic material, loosely called. Midra, Milgrom cites the Midrash in Numbers Rabbah for what is presumably his own explanation. I mean, if you read his commentary, it sounds like this is where he's at, too, that this tradition relates the 70 bulls to an atonement offering for the 70 nations of the world. And that's a little bit different. That's a little bit different than saying that Israelites are offering sacrifices to foreign gods in some sort of vestige of polytheism. Milgrom connects this with some kind of atonement offering for the nations of the world. Now, here's the selection that Milgrom cites. I'm going to read it to you. This is from Milgrom's commentary, and he has content from this, again, rabbinic material in his commentary. So I'm going to read you this, the commentary selection. He says, you find that on Sukkot Israel offers to him, to God, 70 bulls as an atonement for the 70 nations. Israel says, quote, sovereign of the worlds, behold, we offer for them 70 bulls, and they ought to love us.  As it says, in return for my love, they are my adversaries. That's Psalm 109.4. So the rabbi Milgrom is quoting, quotes the Old Testament and says, look, you know, Israel's offering these these bulls for the 70 nations for the atonement. Because remember, Sukkot comes right on the heels of the day of atonement for Israel. So you have a Jewish writer saying, well, this is an atonement for the nations, and they ought to love us for doing this, but they hate us. Then he quotes Psalm 109.4. In return for my love, they are my adversaries. Now, continuing with Milgrom, he says, he's continuing with the quotation. The Holy One, blessed be He, in consequence, said to them, says to the nations, now, therefore, offer a sacrifice on your own behalf on the eighth day, one bull. And he quotes that numbers 29, 35 to 36. And Milgrom says this may be compared to the case of a king who made a banquet for seven days and invited all the people in the province during the seven days of the feast. When the seven days of the feast were over, he said to his friend, we have already done our duty to all the people of the province. Let us now make a shift, you and I, with whatever you can find a pound of meat or fish or vegetables in like manner. The Holy One, blessed be He said to Israel, on the eighth day, you shall hold a solemn gathering, make shift with whatever you can find with one bull. Now, again, you have Milgrom mouthing the words of this source. Really, it's actually really drawn from the source. Again, the numbers rabah source. And Milgrom quotes this to sort of say, well, this is what I think it's about. This is what I think it's about. It has something to do with offering atonement for the nations and the nations could care less.  Now, Ayali Darshan does not go that direction. She's frankly unsatisfied with that interpretation. And she notes that in her article in the footnotes and whatnot. And she goes through a couple of other options that honestly are, you know, this is me talking now, honestly, are a bit more contrived. And she doesn't like any of them. So she's going to go on and off for her own perspective here. And it's kind of an interesting parallel. She she goes on to cite a ritual text from Imar. Just think, you know, ancient Syria, that part of the world. This is Imar six and then line 373. So she cites this text from Imar as providing a better context and explanation. Now, if you had her article, she summarized the text on pages five through six. She says a little bit about it in her online summary of her article. I'm just I'm just going to summarize it here.  So here are the high points. The text, this this Imar text is about something called the zoo crew festival. It's celebrated in two versions, according to other records that are from Imar. It can be annually celebrated, and it's also celebrated in a seven year cycle. On both occasions that it was celebrated. You have had it go for seven days. And so there's, you know, sort of a match to Sukkot. And it begins on the 15th of the month. It's another match to Sukkot, 15th Tishri. The seventh year festival is elaborated in much more detail. It was celebrated in Imar on the first month of the year, called the Sumerian Sagmu, namely the head of the year, first of the year. On the first day of the festival, when the moon is full, the God Dagon, or Dagon, D-A-G-A-N, who was the supreme God of Syria and all the other gods in the pantheon were taken outside the temple. They take their their cult objects, their statues, or whatever they take it outside the temple and the city in the presence of the citizens to a shrine of stones called Sikhanu. This cultic object, also known in other Syrian cities such as Ugarat and Mari, they were both cities in ancient Syria. This object is best described as a Betel Stella, that's B-E-T-Y-L, a standing stone anointed with oil and blood. The seventy lambs were then sacrificed to each of the seventy gods of Imar. At the culmination of the ceremony, all the gods and citizens returned to the city. On the seventh and final day, Dagon and all the gods of Imar were brought out again to the Sikhanu where a similar ceremony was performed. Over the course of the seven days of the festival, numerous offerings more than any made in any of the other documented festivals of Imar were given to all the gods attesting to the significance of this feast in the city's religious calendar. That's a summary, again, drawn from from the work of Iali Darshan here. Now, on a side note, you know, she in her article, again, if you have that, she makes a comment about 70 patron gods that I think she gets wrong. The gods of these nations were not given to protect the nations. This is something she she goes off on. The text never biblical text never says that. Later Second Temple texts have that idea, but that's not the point. They were essentially placeholders. They weren't, you know, protectors. What are they protecting anybody from? The other God, the God of Israel, it doesn't make any sense. It's not what the text says. But anyway, that's a little bit of a rabbit trail. You can see generally that there's, you know, some similarity here to what's going on in this Imar text and this ancient Syrian festival and biblical stuff. Now, let me just stop here and say now, Imar is a city in ancient Syria, one of its neighbors. Also in ancient Syria was Ugarat, Ugarat is where you have the 70 sons of El, you know, and all that language, again, that we, you know, we have noted both an unseen realm and in podcast episodes and other material that I've written either online or in books and lots of other people have noted it too. I mean, there's this relationship between what's going on in Ugarat and Ugarat. In this case, we bring Imar into the picture and biblical stuff. And again, we've talked about this before and others have as well that the biblical writers are drawing on some of this stuff to make, you know, their own theological case for the God of Israel, being in control of the nations and assigning the other gods. You never have in the Bible, God fathering these other gods with a consort, a goddess or anything like that. You don't you don't have that. So there are there are some clear differences. But there's there's this they're these theological touch points and the biblical writers are going to touch base with that material, both in terms of a of a common idea that they, you know, there's Israel and there's these other nations that got abandoned and disinherited because of the Senate Babel and they're just placeholders now.  It's so many to Isaiah 34. They're going to be judged. All that stuff that we've covered a lot on this podcast before. So there there's going to be these common touch points, but there's a theological trajectory that the biblical writers take with that material that is quite different from anything you'd see at Ugarat, that is quite different from religion in ancient Syria. You know, their their theological worldview. They do this because this material was familiar to Israelites. Syria is next door. Again, Baal and, you know, other other gods associated with Ugarat and the Syrian Pantheon. These are the chief competitors to the worship of Yahweh. The prophets are they have their hands full with this stuff all of the time. And so it's very understandable that they're going to be referencing this material, both in a positive and a negative way, you know, positively, like, OK, we've got this shared worldview, the shared idea. But, you know, these are not other gods to worship. They are underlings. They are there. They were actually assigned as a punishment to the nations. These are not, you know, this isn't at the level of the most high and all that all that kind of talk. So there's a reason for, again, the commonalities. But we want to, you know, we want to not miss the messaging that's different, the messaging that the biblical writers have that goes with this. And I think Ali Darshan, that that's kind of what she does. She sort of misses an opportunity to look at some specific messaging that Milgram actually is going to bring up. And she just sort of either she doesn't talk about it in her article. She either misses or she sidesteps or she doesn't think it's important. She does notice it. And I'm going to follow a different trajectory with all this. So what she does, though, obviously, is she takes this material that we've just, you know, overview, we've just summarized. And she says this, here's from her conclusion on page nine of her article, her published article, she writes, in light of the Emerite custom, I would like to propose that the law in numbers 29, prescribing the offering of 70 bulls during Sukkot, which has no parallel in any other Israelite festival, reflects the old Syrian custom of offering 70 sacrifices to the 70 gods. In other words, the whole pantheon of Syria at the Grand Festival, celebrated in the month of the new year. Over time, the polytheistic traces of this ancient custom disappeared from the priestly law from the Torah. And the autumnal New Year festival in the Pentateuchal calendar also lost its significance. The 70 sacrifices, however, have been preserved in the text in the book of numbers here, a sole remnant of the local or the ancient local tradition of sacrificing 70 offerings to 70 gods at the New Year festival. End of quote. So that's her conclusion. That's where she winds up with this. Now, I don't find that conclusion very persuasive. It's really based on a single presumption, and that is that the offerings of these bulls are for or to the nations and therefore, logically, they're gods. That isn't what the text ever says. OK, numbers 29 never actually says that and neither does any of the other texts, because obviously this is the only place you're going to find this. It's unique to the festivals that the text never says that. The text doesn't suggest that the nations and their gods are the object or objects of these sacrifices. And the rabbinic midrash that gets quoted is what it is. But again, that's not the biblical text. And it's it's made up. I mean, it's an effort to do something with the passage to give it meaning to interpret it. And I think Ayala Darshan is allowing that midrash with its idea that these are sacrifices to or for the nations and their gods, these other 70. I think she's allowing that to have a bit too much influence on her reading of what's going on here. So I have a different proposal. Now, a couple of things here before I get to to, you know, sort of where I land, we have the number 70. Again, 70 speaks to the totality of the pantheon. Everybody agrees on on this point. And it even was referenced in Ayala Darshan's, you know, her summary that we just gave 70 refers to the totality of the pantheon, all the other gods. Now, again, this isn't a I want to land here just for a minute because I get this question a lot. You know, what about the other nations that aren't in the Bible?  You know, did they get assigned? Like what about Australia and China and all these places that aren't mentioned in the Bible? Okay, 70 is about totality. The whole point of the Deuteronomy 32 worldview is that any place that isn't Israel was disinherited by God. It's not God's land. It's not the promised land. It's not the land that he chose for himself or his people. That means every other place is under the dominion of something else. So it doesn't matter if you have a nation that isn't, you know, listed in the 70 in Genesis chapter 10. The whole point of it is totality. So the answer is, yeah, all of those other nations are not Yahweh's. I mean, he has disinherited them from his from his loving, covenantal relationship. It's Israel and everybody else. So I get that question a lot. And I think we need to remember that 70 is about the totality here. And in Genesis 10, it is the totality. If you actually count the nations, that's what you get. And if you use the Septuagint, you get 72, which is why the New Testament, when Jesus sends out 70 or 72, it just depends on which text the New Testament translator is giving preference to. The Masoretic text or the Septuagint refers to the same place. Genesis 10, Table of Nations. Another note, the festival, Milgram says, it focuses on man's need and desire to give thanks to God for the year's harvest. Fair enough. But what does it come memory? This I think is the main point. This is the main point I'm going to follow that it gets lost here. We've got Ayali Darshan zeroing in on the 70 and saying, oh, well, this is, you know, this is a polytheistic reflex, a polytheistic vestige. And then she again allows the Midrash to influence her too much. She allows the rabbinic idea that these offerings were to or for the other nations and their gods, I think, to have too much weight. Again, Milgram has this idea of atonement, that the sacrifices are to atone for the other nations. Neither of them really focus on what in the world, Sukkot commemorates. It's not just about agriculture. Remember, even, even, you know, Ayali Darshan, I think it was her. There was a note was the GFAQ. It has two focuses, historical and agricultural. Agricultural, yeah, it's about God meets our needs. We have a harvest. Good. Fair enough. But what does it commemorate historically? This is lost in both Ayali Darshan's take and Milgram's take. Now, Sukkot has this dual significance. We are let's not focus only on the agriculture. Historically, it commemorates. This is back to GFAQ.org. I'm just going to quote it again. Historically, Sukkot commemorates the 40 year period during which the children of Israel were wandering in the desert. OK, they were living in temporary shelters. What does the desert? Symbolize in biblical thinking. And this is also recalling the Day of Atonement. Remember, the Day of Atonement has this wilderness theme in it, too. In the Day of Atonement, which is linked to this festival as well. The Day of Atonement has the goat for Azazel sent out into the wilderness. Why? It's not a sacrifice to Azazel. And again, you can read about this in unseen realm. I'm not going to rehearse all the content there. It's because the wilderness is the place geographically as they're wandering through the desert. Where is the presence of God among his people? It's in the camp. It's in the tabernacle when they camp, you know, the whole that that becomes holy ground with the presence of God is and the people and camped around it everywhere else out there in the wilderness is under dominion of hostels. God's because of the punishment of Deuteronomy 32. The wilderness is where sin belongs because that land, that territory is under the dominion of entities that are hostile to Yahweh and his people. Because of their punishment, they become corrupt. Deuteronomy 32 17. They seduce the Israelites into sacrificing to them. Again, this is all old unseen realm turf. You haven't read the book and you need to go back and do that. Where you can watch the videos here on the podcast site for where to begin. Just click on that tab and you'll know what we're talking about here. The wilderness is where sin belongs. It was associated with ground under dominion of other gods. It was a fearful place. It was associated with death. It's the place where you could find gateways to the to the netherworld, like in Bashan, Asteroth and Eddrai in text that were external to the Bible. You know, the whole gates of health thing. This is where you could go to these places and these are these are ways, you know, places that you could go if you wanted to enter into the netherworld, the underworld, the realm of the dead, again, the scary place, the place where, you know, the Refaim spirits live. Bashan, again, was Refaim territory. All these ideas are part of this matrix that get associated with the wilderness. And Israel has to trek through all of this turf.  You want to know what spiritual warfare is? This was it. I mean, they're trusting God to to provide for them while they're in the worst possible position they could be in. And that is what Sukkot is about. They're deliverance from this situation. And wilderness is the place of chaos and death and hostility. It is unholy ground. And Sukkot, five days after, you know, the day of Atonement, you have Sukkot which celebrates the deliverance from this place, from these entities, from these supernatural forces, that want death and destruction and chaos for Israel. That's what Sukkot is about. So how in the world, why in the world would they offer 70 bulls to these other entities? They don't need to do that. They were just delivered. They don't need to turn around and say, oh, we better make those entities happy now. No, the entities lost. Hey, the entities were held at bay. They could not defeat the God of Israel and harm Israel. There's no need to placate them now. You don't placate a defeated enemy. It just doesn't make sense. So again, I just think it's a wrong trajectory. Now back to Milgrom. Milgrom writes in his commentary, this is page 247, he says, rabbinic tradition may be correct in stating that the total of the 70 bulls represents all the nations of the world, assumed to number 70. Again, I'm with you. This festival focusing on man's need and desire to give thanks to God for the year's harvest is of universal appeal. Again, I would add, that's not all it's for. It's not just agricultural, Dr. Milgrom, it's more. It's celebrating deliverance from these supernatural forces. Back to Milgrom. It is small wonder. Now this is again an important observation he makes. It is small wonder that Zechariah prophesied that Sukkot would become a universally observed festival at Zechariah 1416 and that the pilgrims at Plymouth modeled the Thanksgiving celebration for their first harvest on the biblical paradigm. So we get Thanksgiving, by the way, that this whole idea, they actually pilgrims actually modeled it after this particular feast. So yeah, we'll give you that it's about harvest. But even the pilgrims, it seems, could recognize deliverance. It's not just about having enough food. It's about deliverance. And the observation in Zechariah 14 is the one I want to sort of key on that Zechariah prophesied that this festival, this particular festival, would become a universally observed festival. So how about this? How about this interpretation? The 70 bowls are offered to commemorate deliverance from the totality of the gods hostile to Israel. It's an expression of joy, not to placate other gods or to kiss up to them. It's not to ask Yahweh to show favor in some act of common grace to those nations and their gods. Rather, it is to thank Yahweh for deliverance from those gods during the wilderness wanderings. Honestly, it just doesn't seem too complicated to me. Now Zechariah 14-16 is interesting if you take that view. Okay, the view that this is my view of it. If you take that view, Zechariah 14-16 becomes kind of interesting. Again, how does the view of Ayali Darshan make sense of that passage, of the Zechariah 14-16 passage? We might as well go to Zechariah 14 and just read that. By the way, Zechariah 14, does that ring a bell? Zechariah 14 ring a bell? I'm going to read the whole thing. And you'll see where verse 16 comes in, the whole thing about the feast of Sukkot. Ayali Darshan's interpretation just doesn't make sense in light of this passage in Zechariah. In fact, it robs it of some real significance here. So here's Zechariah 14. Behold, a day is coming for the Lord when the spoil taken from you will be divided in your midst, for I will gather all the nations against Jerusalem to battle. Does it sound familiar? And the city shall be taken, and the house is plundered, and the women raped. Half of the city shall go out into exile, but the rest of the people shall not be cut off from the city. Then the Lord will go out and fight against those nations, as when he fights on a day of battle. On that day his feet shall stand on the Mount of Olives. That's the idea that is quoted in Acts chapter one, by the way, when Jesus ascends. Men of Galilee, the angel says, why do you stand looking up into heaven? This Jesus who was taken up from you into heaven will come in the same way as you saw him go into heaven. Then they returned to Jerusalem from the Mount called Olivet. That's where they are. They're on the Mount of Olives. So back to Zechariah 14. The Lord will go out and fight against those nations, as when he fights on a day of battle. On that day his feet shall stand on the Mount of Olives, that lies before Jerusalem on the east, and the Mount of Olives shall be split in two from east to west by a very wide valley, so that one half of the mount shall move northward, and the other half southward. And you shall flee to the valley of my mountains, for the valley of the mountains shall reach to Azal, and you shall flee as you fled from the earthquake in the days of Uzziah, King of Judah. Then the Lord my God will come, and all the holy ones with him. Now this in what follows is the sourcing in Revelation for Armageddon. It's about the transformation of the cosmos and the restoration of the Lord's rule in these awful circumstances. Verse 6, Isaiah or Zechariah 14. On that day there shall be no light, cold, or frost. And there shall be a unique day, which is known to the Lord, neither day or night, but at evening time there shall be light. On that day living water shall flow out from Jerusalem, half of them to the eastern sea, and half of them to the western sea. And this transformation of the cosmos, it shall continue in summer as in winter. Verse 9, And the Lord will be king over all the earth. There is the restoration of the Lord's rule. On that day the Lord will be one, and his name one. The whole land shall be turned into a plain, from Geva to Ramon, south of Jerusalem. But Jerusalem shall remain aloft on its site from the gate of Benjamin to the place of the former gate to the corner gate, and from the tower of Hananel to the king's wine presses. And it shall be inhabited, for there shall never again be a decree of utter destruction. Jerusalem shall dwell in security. And this shall be the plague with which the Lord will strike all the peoples that wage war against Jerusalem.   And on that day a great panic from the Lord shall fall on them, so that each will seize the hand of another, and the hand of the one will be raised against the hand of the other. Even Judah will fight at Jerusalem, and the wealth of all the surrounding nations shall be collected. Gold, silver, and garments in great abundance, and a plague like this plague shall fall on the horses, the mules, the camels, the donkeys, and whichever beast may be in those camps. What's the point? The point is that on that day when the Lord returns there will be complete victory and transformation of the cosmos. And then we read verse 16, Then everyone who survives of all the nations that have come against Jerusalem shall go up year after year to worship the king, the Lord of hosts, and to keep the feast of booths, the feast of Sukkot. The point again is the remnant of the nations themselves will keep the feast of Sukkot. You know that the feast that commemorates Yahweh's deliverance of His people from them, from those hostile nations and the gods that rule over them. The nations are forced, the survivors are in a situation where they turn and celebrate Israel's deliverance from them. Now there's a couple of ways you could read this, and part of this depends on how you sort of think about eschatology and really moving more fundamentally. How you think about the New Testament's use of the Old Testament, there we go again. I mean we keep coming back to that issue. I'm going to read a little bit from Boda, Mark Boda, his commentary on Zechariah here. He writes this again just to help us get the flavoring here. While Zechariah 14.9 depicted Yahweh's kingship over all the land of Judah, 14.16 makes it clear that this kingship extends over all the earth. As noted above, in reference to 14.9, kingship is directly linked to victory and war, and so the focus on kingship in 14.16 is appropriate following the depiction of Yahweh's total annihilation of the armies which had attacked Jerusalem. Yahweh's victory establishes him as an emperor over a large territory who receives now obeisance and tribute, expressed and delivered by yearly attendance at the Feast of Tabernacles. This connection between kingship and victory is made clear in the title and name of Yahweh cited in verse 16 and verse 17, the king, the Lord of Hosts. The latter of course referring to his role as the divine warrior at the head of a mighty heavenly army. Again, this is the passage is quoted in the Armageddon section and also I think alluded to in the Revelation 20 section of the Book of Revelation. So what's my point in the Zechariah Rabbit Trail? Rather than Sukkot being a vestige of polytheism, offering 70 bulls to the gods of the nations or for their behalf or to sort of help them out, to chum up to them, the 70 symbolizes deliverance from the gods of the nations by Yahweh. Why 70 bulls? Because Yahweh delivered Israel from every other god. He delivered them from the totality of the other gods and their nations. It has nothing to do with sacrificing to those gods. And if it ever did in the mind of some Israelites somewhere at some point of time, again the biblical text, the worldview expressed in the biblical text as we have it, sets that record straight. This is deliverance from the wilderness, the totality of turf that is not Yahweh's turf. God delivers his people from the totality of every supernatural power. That's what it's about. Again, I don't think it's really that complicated. Zechariah 1416 bolsters this because Sukkot is the festival in which the people of the nations who have been enemies of Yahweh will be required to celebrate. It will be a gesture of submission. This makes better sense if the original offering of the 70 bulls was about deliverance from the nations. At the day of the Lord, the nations will have been defeated. And any remnant that survives Yahweh's judgment, anybody who's allowed to live in the new Jerusalem, I'll catch that idea, anybody who's allowed to live in the new Jerusalem will also thank Yahweh for his victory, the victory of the Messiah, because it is that victory that transformed the cosmos, that makes the world new, that takes us back to Eden. Now I know some listeners just can't divorce the words of Zechariah 14 from a particular or a few particular pop popular eschatological schemes, but I'm going to suggest that to understand it abstractly like this is to make sense of it. You can't literalize everything here because items in Zechariah 14 make no literal sense after the second coming. You just just read the rest of the passage. So I would say, again, try to think a little bit more abstractly.  Why are there some Gentiles who are still around in the new earth, in the new Jerusalem, that will celebrate the Feast of Sukkot as both a gesture of Yahweh's victory over their gods, over the gods who had enslaved them? The only answer is because they're part of the remnant, they're part of the people of God. The remnant of the nations after the cross looks different than they did before the cross. And that's okay. The end of Zechariah is transformed in terms of its fulfillment and meaning, I would say, just like Amos 9, 11 through 12 was. And I don't want to rabbit trail into that, but if you remember, we've had a, I think we did a podcast episode on this, or at least it's been part of a Q&A. Amos 9, 11 through 12 is the one that says this, in that day, I will raise up the booth of David that has fallen and repair its breaches and raise up its ruins and rebuild it as in the days of old. Now, you think that refers to like a new building, maybe a new temple or something like that, but it doesn't. It doesn't. And we know that because of the way it's quoted in Acts 15, the next verse, you know, so in that day, I'll raise up the booth of David that has fallen at verse 12. Why am I, why is God going to raise up the booth of David, repair its breaches and its ruins, that they may possess the remnant of Edom and all the nations who are called by my name? So it sounds like if you're reading Amos, that God is going to, you know, do something that will allow Israel, the national Israel to possess the remnant of Edom. They're like to, to conquer its enemies. And we talked about this. Edom was a metaphor for chaos and Babylon, because, you know, they helped the Babylonians at the destruction of the temple. We, we spent two episodes on Obadiah, where we got into this whole issue. But what does the New Testament do with this passage? It's not about conquest of, of turf anymore. If you look at it in Acts 15, the booth of David turns out to be Jesus. It's not a building. It's Jesus. And, and they don't possess the remnant of Edom. Edom, Edom, olive, dollot, mem, is transformed to Adam, to mankind. It's about mankind coming to Christ. It's about the Gentiles being included in the family of God under the Messiah. And I'm suggesting that's the way we need to read Zechariah 14 here, too. It really helps. It helps make sense of it. That you have, that the Lord's return and revelation quotes Zechariah 14 in relationship to the Second Coming, victory, you know, halting the forces at Armageddon. Again, and I think that that passage is mirrored in Revelation 20. People are going to hear this and go, oh, he's a non-millennialist. No, I'm not a non-millennialist or a post-millennialist. I still believe the kingdom comes to earth. I'm not any system. So throw the systems out. Don't worry about them. Okay. The text is more important than systems. What you have going on though, is you have the Lord returning at that day, day of the Lord. He returns. And the Gentiles who survived this, the vestiges of the other nations who are allowed to live and enter into a transformed cosmos, a new Eden, a new heaven and a new earth, of course, they're going to celebrate the Feast of Sukkot. Of course, they're going to celebrate the Feast of Tabernacles. Why? Because the Feast of Tabernacles commemorates God's deliverance, His superiority and victory over all other gods. It's how it's supposed to end. And if you're a Gentile, again, who are outside the family of Israel, the physical descendants of Abraham, you're included, again, if you align yourself with the God of Israel, who became incarnate in Jesus Christ. Okay, it's very coherent and cohesive. If we can, on one hand, not view this through the lens of the rabbis, oh, they're sacrificing two other gods, vestige of polytheism, or they're sacrificing bulls to make God look more favorable on those nations and atone for them in some way. Even the nations hate God, so I don't know how that works. I mean, you need to change your heart here. I don't know how that works. So instead of looking at it in that way, why don't we just take it, take secote for what it is historically, not just agriculturally. Historically, it's about deliverance from the wilderness, through the wilderness, from the wilderness, and just the realm of death and darkness that was under the dominion of other gods. Again, it doesn't seem complicated to me. Of course, they're 70 because the idea is to commemorate Yahweh's victory on behalf of His people over the totality of the powers of darkness, every other supernatural being. And when that's celebrated in the future, at the Lord's return, of course it makes sense, that the Gentiles who are allowed, who are not annihilated, they survive into the new set of circumstances by going up and worshiping the Lord. That implies a switch of loyalty. They're believing loyalty is now in the God of Israel. And of course, they would celebrate the Feast of Secote in His honor and out of gratitude, because look where they are. Look where they are. So again, the subject is interesting. I hope it's been interesting for you, but again, that's my view. That's my view of the whole 70 bowls of Secote thing. So if you want to read Ayali Darshan's article, please do. We'll have the link to that, the one online anyway, not her journal article. That's not freely accessible. And that's my take on it. I think it's really a neat part and again, a cohesive element, a cohesive part of what we call here in the podcast or the unseen realm of the Deuteronomy 32 worldview. I think it fits in real nicely. That 70 number is always coming up, Mike, and also you know what is 70 this year, don't you? Well, it isn't me. No, it's the 70th anniversary of what? Oh, yes. Yep. The founding of the state of Israel, yeah. And where will we be? That's a very nice segue. And where will we be on that day? We will be in Israel. And as far as I know, there were still five or six openings left. So that might be where you're angling here. Exactly. We will be in Jerusalem on that exact date. Nicely done. Nicely done. Thank you. All right. Some other things here in my switch gears is I noticed we have over 500 ratings on iTunes for the podcast. So thank you for everybody who has done that and over 200 reviews. So thank you all for taking the time to do that. And if you haven't done so, we're on Facebook. We got almost 2,000 people in our Neck and Bible group having great conversations every day. So go like the Neck and Bible podcast page. Mike's got a public page. So go like his Michael S. Heiser. Yeah, we're trying to put our focus there. Michael S. Heiser. So go like his page, like the Neck and Bible podcast page. We have a paranormal page for those that are interested for that. And then also, you can join the groups for both of those. So get in there and have some great conversations. Subscribe to the newsletter too. Go to drmsh.com. It's on the right hand side. Why should I subscribe? Click on that and it'll tell you. Sounds good, Mike. All right. Well, with that, I just want to thank you everybody for listening to the Neck and Bible podcast. Thanks for listening to the Neck and Bible podcast. To support this podcast, visit www.neckandbibleblog.com. To learn more about Dr. Heiser's other websites and blogs, go to www.brmsh.com.


Hello, and welcome to COVID Facts in 5, your comprehensive look at Sintusha's management and mitigation of the novel coronavirus. I am Hermadi Mark. The Ministry of Health and Wellness in the past year has been using contact tracing methods to prevent the spread of COVID-19. Contact tracing is the process of identifying, assessing and managing people who have been exposed to a disease to prevent onward transmission. Contact tracing can break the chains of transmission and stop the virus. It is an essential public health tool for controlling infectious disease outbreaks like COVID-19. Government has invested in an app for that very purpose. Systems analysts in the Health Information Management Unit, Kevin Harris, tells us more. The Contact Tracing app helps the Ministry in its contact tracing by first allowing individuals to upload the data from their phones, which would include all the locations that they have been in the last 14 days. The reason for this is that normally human beings may not necessarily remember where they have been in the last 14 days. Also remember that as somebody being contact traced, you are under a lot of stress. You may have just been informed that you have been diagnosed with a certain disease and this may cloud your memory. So the Contact Tracing app helps by keeping track of those places and allowing the Ministry to have factual information as to where you have been in the last 14 days. The Contact Tracing app is absolutely free. The Contact Tracing app is available in both the Apple, stores and Google Play stores. All you need to do is search for 758 Care Alerts. Saint Lucia's very own Harvard University graduate and researcher Khalil Lwizi served as the project consultant. Remember the app is not designed to invade privacy, not collect or transfer your information. Join us next time for another COVID-19 Facts in 5. I'm Hermione Mark.


All right, I'll hand it over to you these wonderful people. Give them a big round of applause. All right. Okay, so you guys are all here. I'm sure you know what this talk is. You should pet yourself in the back because this is the right choice for talk to attend right now. It is the best talk. You made the right decision. Your life is already done. You're good. You're good for life because we're talking about Cisco routers and secure boot and the title of this talk is 100 seconds of solitude. My name is Aung Sui. Is that on? Sisting on. Hey, my name is Jatin Gadaria. Very good. Okay. And what is primary main objective? Primary main objective is not Chimpogo Camp. It is Cisco trust anchor.  So the trust anchor is something that we had no idea existed when we started this project and we'll take you through all of that story. But ultimately what this revolved around was the work that we developed, techniques that we developed to manipulate FPGA bit streams in order for it to do something useful. So, you know, even though we're going to talk about the security implications of our techniques on this router, we're really here to talk, well, okay, so the deeper primary main objective is FPGA bit stream manipulation. And the reason why this is is because, you know, yes, Cisco routers and switches, you know, all use or a lot of them use this type of, you know, Spartans, Ilings, FPGA, but so do a whole lot of other things in the world like, you know, advanced driver assist in cars, I'm sure legacy weapon systems and missiles and all sorts of things and the, you know, the techniques that we're going to talk about here are going to affect those devices too. So even though this might seem like a fairly large impact vulnerability disclosure, the real impact of using these techniques in devices we haven't even started to look at, I think is much larger.  And yes, I have exactly those. But before we start, you know, this is kind of an epic story, you know, there's love and loss and betrayal, more love and friendship and defeat and, you know, redemption and more friendship. So we're going to go through the cast. Jadon over here, right, that's him. Rick is actually in the front row, that's Rick. Joey is sadly not here, I think he's at a wedding. This is me, I'm wearing sandals just like the photo shows. James, right there, okay. And well, over the last three years at Rebel and Security, we've invested a ton of our resources in creating this massively complicated, highly intelligent, automated testing framework, abbreviated to Brian. You know, it's so complicated that some might even say that he is border-aligned sentient, which I think is ridiculous, but you know, we'll get to that. All right, so as with all great epic tales, we start in mid-story, okay. So, you know, we started this work in 2016. In 2015, Jadon and I worked on this little thing where we got code execution inside the on-screen display controllers of all sorts of, you know, probably over a billion monitors. And then in 2017, you know, Rick and I worked on this thing where we built an EMP, electromagnetic pulse generator in order to defeat secure boot in truss zone on a Cisco phone. So, you know, those projects are pretty simple, straightforward, you know, there's really no thinking involved, I mean, very easy to do. So in the middle of all of that, you know, I say, hey guys, like art and lives are so easy, you know, like it's going too well, let's punish yourselves for like no reason. And then Jadon says, what the f, no, it's very, very good. He says, what? All right, so ultimately, you know, fast forward to 2019, here we are talking about all of that work. And, you know, it resulted in this thing called Thrangry cat, right. And technically, you can't pronounce it like Thrangry cat because it is the first vulnerability named after three unpronounceable emojis. So you can only come close to pronouncing it, but not really, you can't really say it out loud. Thrangry fact one, the domain name for this vulnerability is emojis, okay. And for uncool kids, you can type it out as Thrangry cat, it's fine. Thrangry fact two, we, you know, have all sorts of information about the nature of the vulnerability, you know, how we did it. And actually, I will temp fate and try to tab out of this thing to show you our website.  It's all in GitHub, it's right there on our website. So if you like getting this stuff and you're interested, check it out. The tools are actually super cool.  And I'll just give you one. Reason number two is that emojis are indexical to the digital age, right? And that's just one of four reasons. And Thrangry fact 2.1, and this made my heart sing when I read it, right? I found it interesting that the section that explains the name of this vulnerability is way more thought out and verbose than any other sections. It's almost, they had, like, a linguist on the team and the emoji name was his prideful contribution. True fact, true fact. I, thank you. If you're out there, you're good. Um, alright, so just the immediate impact of, uh, this vulnerability, uh, it affected, like I said, probably, I think, something like 180, uh, types of. 133. 133 Cisco devices. And here's a list of some of them, you know, go like this page and more on this page and this page and this page and this page and this page and this page. I think there's one more. Nope, two more. One more, right? Alright, cool. So it affects a whole lot of Cisco routers. Alright, let's talk about how we did it. Uh, you know, so. It all started when we wanted to, um, hack ASR 1001. But it was end of life. And, uh, Cisco started, uh, you know, sending 1001 X in 2013, right?  So whatever, I see this thing called the 1001 X, uh, whatever. Let's, it's probably the same, you know? Yeah, but, uh, what, um, doesn't matter, we don't care about documentation, who care about the X, you know, X is what jumps. It's probably fine, right? So we looked at it and we, you know, signed ourselves up to do this work and, you know, to be fair, look, the left is the 1001, the right is the 1001 X, looks exactly the same. Uh, you know, the 1001 X, uh, was kind of expensive. It's like $11,000 per router, but we bought it anyway, to help everyone visualize what exactly that is. It was on sale. Oh, that's right, it's on sale, so you can get it for a little bit cheaper. Uh, anyway, so what is that? Let's talk about what that means. So $1 is, uh, 6.14 inches by 2.61 inches. It's approximately one gram, so the cost of that 1001 X is approximately 3.58 feet or 22 pounds, which, uh, to put in a unit that you guys can understand, it's basically two healthy three month old babies stacked on top of each other, like that's the right height and weight, that's exactly what it is. Okay, so the 1001 X, the X, uh, has this thing called trust anchor and secure boot, which again, at the time, we had no idea what it is. Uh, so we thought, hey, maybe this is just like a new bootloader, whatever, let's, we can do it. Alright, so goal is, uh, what do we want to do? The goal is to modify the RAM on, like we just wanted to run our own firmware, our own stack on the SR 1001, and it was, that's what we wanted, so, uh, we have done, you know, previous work and we thought, you know, like it would be easy, it would just like change the root key, change the firmware, it doesn't matter, let's just do that. Alright, so, and uh, this is kind of like iron shift. The secret ingredient is, okay, we actually have one of these things in front of you. If we don't keep the lid on, uh, it'll, the thermals are horrible, so it's not great. But anyway, so, when you open this box, uh, you see this thing over here, uh, it might look a little weird, but a lot of this is basically a standard, you know, Intel based computer, right? So, the things that we care about is, um, you know, obviously there's the Intel Xeon processor, so probably a lot of that code runs there, uh, and there is a Xilinx FPGA, so who knows, maybe that's doing something interesting. And this thing has a number of different little SPI flash chips that, uh, we thought might actually be, you know, useful to look at. Uh, and the rest of it is a whole lot of complicated hardware that actually makes, you know, the routing and switching stuff work. But, you know, we opened this box and we said, okay, you know, we probably understand something about this piece of hardware, you know, this is somewhat like a normal pro, a computer, but it certainly has a whole lot of weird stuff that we haven't seen before. Okay, so let's look at the software analysis. Um, so, if you guys have worked with Cisco, they used to have, uh, this, uh, proprietary boot console called Ramon, so which allows you to boot through TFTP, you know, change images. Uh, so what they did was they changed to UEFI in 2013 and, uh, but they still wanted to work with their Ramon. So, they implemented a pre-Raman as a pre-EFI module. What it does is that it manages Ramon. It also, with those two SPI flashes as you saw, as you can see, it also handles the updates. So, in the Linux kernel, if they want to apply a patch to the boot loader, the Linux kernel will update one of the SPI flashes and then the pre-Raman will validate, uh, that whether it is right or not, and if it is not, then copy the code and copy again. Uh, pretty common stuff. Uh, then they had Ramon, uh, then they had Ramon and, uh, basically this is implemented as a DXC module. Uh, again it does the exactly same thing. It can allow you to boot, uh, uh, Cisco images, um, through TFTP. It also allows, it also validates the next operating system it's gonna boot. In the boot loader, um, the OS stage and, uh, it also has a privilege mode which allows you to, uh, introspect what is happening in the DXC. Oh, by the way, so Ram doesn't stand, uh, for what you think it does. It's not actually read only memory, it stands for romantic monitor. True fact. True fact. So, uh, then comes the Linux kernel. Uh, so they ported, uh, they started using, uh, you know, uh, uh, off-the-shelf Linux kernel on which they ported their own Cisco stack running, uh, as a privilege process. They also wrote a process manager which, uh, manages this process so anything, any kind of crash happens in the iOS, it reboots the whole, uh, system. And once you combine this, this becomes your iOS XC stack. And if you go to their website, this is the most secure stack. Uh, so we, while doing this analysis looking at everything, we saw no hashes on the UEFI, no certs on the UEFI, so it should be like a really easy mod because our goal is to just run our own stack. And, uh, we also disabled, uh, some of the checks, um, which were in the pre-ram on and we mod, uh, booted the modified firmware and everything worked. And I was, this is pretty simple. Uh, so, but, wait, then drive to reset. Then we saw, like, wow, it reset after every hundred seconds, which doesn't make sense. And, uh, we spent a lot of time. Well, so first it was, uh, you know, it, you know, it resets what he was able to get code execution on the XAM processor and it allowed us to do it. And then you would eventually kind of reboot. And then, uh, at first, you know, he was like, well, once in a while, maybe a minute, right? And then he was like, uh, it's kind of like a hundred seconds. And I say, well, how many seconds exactly a hundred seconds? Because computers don't like to count in decimal. You know, it's not like they have ten fingers and ten toes.  So this is signified by a loud fan noise. These fans, as you can see, four fans, make a very loud noise. And this was crucial in doing all of the reverse engineering. This is probably the key, the fan noise. So we came up with the hypothesis of, like, what is this hundred second reset causing? You know, there are multiple x86, because the processor is an x86 core.  Uh, but we analyzed the code, it was already disabled. Uh, x86 has dozens of Vosh stock timers, so we disabled all of them because we had hundred seconds to run whatever code we want. And, uh, that also did not help. Uh, then we went to SMM. And we saw, like, SMM was enabled. Uh, so we disabled that. Uh, but it was still pre-booting. So it was like, um, I don't know, man. Yeah, so we, we hypothesized, like, is there like a magical deity in this processor that somehow, despite the fact that we control every instruction that executes on the processor, still is watching us. And tempting us, right? It allows us to execute, like, our hopes are coming true, right? And it waits for 100 seconds before it takes our dream away, right? Like, what kind of thing is this? Uh. Alright, so, you know, normally, every time we ask this question, like, how do we mind read the computer we don't understand, uh, we typically like to default back to electromagnetic emanation. And if you look at some of the past research we've done, this is a really useful tool and a way to kind of figure out, you know, what the computer is kind of doing without really understanding a lot. So, you know, basic stuff, like, when you push an electron through a wire, right, it likes to induce a magnetic field, then electric field, so it kind of emanates, right, EM. So when you take a near-field probe to the thing, right, you should be able to measure out the, you know, activity around certain parts of the machine in order to kind of come out with a timeline of what is probably executing. So, you know, we have a CNC machine that we like to hook up to a near-field probe, right, that to do this type of, you know, analysis automatically, uh, I think the zip type broke, so we're just holding it by hand, but usually it's automated. Uh, we swear, right? So, uh, after gathering some data, here's what we have, okay? So, uh, on this one, on the, on the way, way on the right, we have, uh, the emanation coming out of the, the CPU power supply, okay?  Up here, right? So this is, you know, time, right? Uh, so, you know, as we go downwards, that's later in time.  Now, uh, there's nothing coming out of the, the CPU, the Xeon processor until basically the bottom of, of, of this graph. So the processor is sitting idle doing nothing, but the FPGA, the Xeon Spartan 6 FPGA, has this, uh, emanation profile. So, you know, slightly after the initial power turn on, right?  And then the SPI chip, one of the SPI chips, which is actually connected to the FPGA, right, has similar, uh, electromagnetic emanation profile, uh, in the beginning, and then, you know, it gets red, and then basically nothing happens. So, you know, if you put, like, this is like blues clues, right? You put all these clues together, I wonder what's happening. So, power turns on, right? The FPGA reads from the SPI flash, uh, its bit stream, right? It actually reads two bit streams, and then it loads that configuration into the FPGA, and then the FPGA does some magical thing, right? And then basically at the very bottom of this, this is where the, uh, the Xeon processor starts to do stuff. So, uh, you know, we start hypothesizing that this is basically the mean little deity that's hiding in the machine that's taking our dreams away after 100 seconds. You took my joke. But, uh, there is a slide. So, uh, there were unknown bits coming out of this SPI. Uh, and, uh, we saw, you know, like it was not available in the bootloader and turned out, uh, we had 100 seconds so we can dump this code. Uh, and, uh, these were interrupt handlers, uh, for the real mode. Uh, basically the BIOS ROM, VBIOS, which is present in that range. Uh, then we also, you know, analyzed, we saw some, uh, address ranges, which was like, uh, ZXFED4, as you can see. This is usually used for external devices, uh, which are mapped, uh, uh, you know, maybe mapped as, um, I.O. devices for SQI's, you know, bus, which is basically a serial quad interface. And, uh, once you, once, this also gives us, like, kind of an idea, like some other I.O. device is mapped in and X86 is, uh, uh, breeding it's state. So, just to validate, we also hijacked the first X86 instruction, wrote the whole serial driver, literally validated and there was an external entity which was doing it. And that was a joke, but. Well, hold on. So this is where, you know, he put in the slide and I said, well, you know, let's not be culturally insensitive. So I added, we do have a cat guide and then the rest of this presentation. So cat Buddha, cat Buddha. So there is a deity, it is a vengeful one. So, uh, we wanted to, um, you know, we knew that FPG is doing the reset. Um, so this was our assumption at this point, like FPG is booting, uh, it's validating the UEFI, so any bit change in the UEFI, uh, address space, you know, it causes the whole thing to, uh, reset. And also pre-Raman checks, Raman, Raman checks the Linux OS, um, it's kind of a, you know, secured boot flow. So then we wanted to find the reset pin and, uh, uh, it was the first $10,000 device which we did because it was a BGA chip.  You know, that was for all of us, uh, and we've destroyed many more than just one of these. Uh, so this was, uh, for all of us, probably the most expensive soldering mistake we've made in life until this point. So in, in honor of those mistakes, we've built a fail fort, right? So the fort grows over time and there's a whole history of mythology about the rise and fall of fail fort. But anyway, fail fort version 1, $10,000, uh, humble beginnings. This is the start of the civilization. Um, then we wanted to test this theory, right? Uh, an RTL reconstruction is really hard and we'll come back to article, RTL, what is RTL? And then, uh, but we still wanted it.  And then it, again, costed, it basically costed $1 per one ohm and it was total cost was $20,000. All right, so now, Router sitting there doing, like, completely unfazed except, you know, the ones that have died. Uh, and us, we're negative $20,000, uh, in a, in a hull. So version 2, you know, we started racing recklessly towards sales guy. This is, this is where we, uh, you know, took over the temple of the jungle.   Like, why don't you try to Google this, you know? And he said, like, I'm a level 9 Googler. So, look, I type into the computer thing and I found this patent. So here is a patent, uh, awarded to Cisco in 2012 that talked about a lot of the things that we were kind of seeing, right? So it is a patent on secure boot through an external device and it's, it's specifically said, you know, you can implement this using an FPGA and it actually has a very similar diagram to the thing that we came up with. So anyway, this document is super useful and one key thing that the document said is you must implement the trust anchor, which is, I think what they call it in this patent, with an immutable, uh, thing, right? Because if the attacker can, like, change it then the whole premise of it goes away. Uh, and they also said that you can implement it with an FPGA. But you know, we'll get back to that. Uh, wait. So it is also, if you see, it is connected through LPC bus. So the way it is actually doing it is like it turns off the south bridge. So, uh, the code has to just reset. Alright. So at this point, you know, we can, we're kind of getting somewhere, but, you know, for, for us, and I think for a whole lot of other folks out there, you know, we're firmer people, you know, maybe software people, maybe some hardware people, but all of us found FPGAs to be scary.  A lot of smart people are working on it and, you know, they haven't done the thing that we needed.  And we said, well, you know what? Like, why don't we stop, let's give up, but say we didn't. And then, like a year goes by, right? Because, uh, you know, we have actual work and, you know, we're already defeated twice, like $20,000 in the whole. Um, and then, you know, one night, Jadon was like, yeah, I, I basically went to Ong and I said, like, give me $20,000 more. Let's do it. I can, I can hack FPGA. Yeah. And I said, okay, fine, let's go do it. So, uh, he read a ton of docs and he's going to talk about. Yeah. So, uh, again, as I said, like, I'm a systems guy, so, you know, how do you understand FPGAs? And, uh, actually we never, what is an FPGA? What does it stand for? Yeah. So what is an FPGA? Right? Like, it looks like a lot of blocks, a lot of registers, a lot of flops. No idea. Feel programmable gate array. Oh, I see. I still don't know that. Okay. So, uh, how does the FPGA design flow works? Right? Like, uh, the code basically provides the hardware circuit and an SG, hardware description language, uh, the render tool chain synthesizes it, places it, maps it, all this information about the truth tables, about what is the memory initialization, routing, and so forth, uh, gets encoded into a bit stream, which gets encoded into a binary, which we call it a configuration bit stream. So anytime FPGA gets configured, how the, uh, you know, because it is an IC, which has, uh, benefits of both hardware and software, uh, so it has hardware logic block to implement to do computations and, uh, it can be reconfigured as software. And there are different types of FPGAs, there is SRAM based FPGA, which is basically boots its configuration bit stream from an external static memory. Uh, so anytime it reboots, it has to reload itself and that's what we're talking about here, uh, for Cisco ASR. And then the other one is the flash base in which the flash is automatic, uh, is already present on the die. It's less power consumption. It, uh, boots really quickly. And then the other one is the anti fuse, which is, doesn't allow you to configure again. So it's not kind of an FPGA. So but still, what is FPGA? Now we learn about advanced FPGA because that's how smart we are. Yeah. And beginning FPGA and I just learned field program over Gator, right? Okay. And actually, you still didn't know what FPGA stands for. So FPGA can be thought of, think of as like a combination of blocks, you know, each block does something and they basically correlate with each other. But again, what is FPGA for systems people? It's y is equal to fx. So this is very important because what matters is like if we can control the y and the x with irrespective of the logic f, then we win. Doesn't matter how complex it is. So let's go inside like, what are the basic blocks of the FPGA? IOB is a group of basic elements which drives, uh, the output and the input functions of the FPGA and the value could be zero one or z. But really, what is it? It is just a thing which is connected to IO pin. And it gives zero or one. That's all you care about. The second thing is IO interface. This is how the pin gets the uh, uh, the value from the rest of the logic and provides value to the, uh, to the other part of the logic. And the third is BRAM, which is just memory. It can be of different data width. Uh, you know, it could be one bit, uh, one width or two or 32 or it could be, uh, for Spartan 6, it's like 18 kilobyte, 9 kilobyte blocks. You can configure it, you can make it single or dual port. The other, uh, which does, uh, so complex logic block is something which implements the boolean function of the FPGA. It has two slices, a switch matrix. Switch matrix allows it to con, uh, you know, like communicate with rest, rest of the FPGA or also allows it to communicate it to other parts of the IO. Uh, and uh, the slice contains flip flops and you do again, doesn't matter for system scrap. Uh, and then there is, you know, slices can be of multiple types, slice x, boolean function, slice l, with the carry logic, boolean function, and slice m also allows, gives you some memory. Uh, but this is the complexity of the FPGA. Do I- It's so complicated. I'm, I'm bored just listening to this. I know. Do we? Because there's so many, you know, like little nuances of piece of, like all of the stuff and all of the innards of this is, uh, almost always in commercial FPGAs kept as a secret. This is a proprietary thing. You know, they allow you to, they give you a tool chain that generates, you know, from the, the Harvard description language, the bit stream that configures their specific vendors, specific, you know, FPGA, and it will work, but they don't actually, they will generally never tell you that any of the internals of how that bit stream is read and what, what that bit actually does. But, you know, you have to know all of this stuff about the components and you kind of just depend on the fact that the magical tool chain will give you the bit stream that will magically configure this hardware thing to do what you kind of told it to do through, you know, VHDL or Veralog. So other resources doesn't really matter, David. So what is the developer domain? Right? The developer domain is like, you specify the source code and the attacker domain is the bit stream. So how do you reverse a bit stream? Well, let, before that, let's go back. Right? So as an attacker, you know, you don't have access to any of the information about the hardware description language. You don't actually even know how the various blocks are routed. All you have is this, you know, end of the result bit stream, like literally a stream of bits that is fed through the FPGA. And magically, like I said, you know, that bit stream makes the FPGA do what you think it should do. But as an attacker, all you have is the bit stream. So you have to reverse engineer the bit stream, you know, like you would reverse engineer a piece of binary with the machine instructions and then figure out, you know, what the logical constructs is in that massive bit stream without any documentation from the vendor. And again, you know, each vendor will have a different format, right? Each type of class of FPGA from the same form of vendor will have a different format. So the rules are literally changing on you underneath your feet. And that's what we have. Okay. So, so we wanted to reverse the FPGA, right? And there is some people have tried it. Jbits was one thing which Xilinx released in 1999. It allowed you to like change logic. But then they started to start supporting it. Then Bill, which it requires a net list, it was released in 2012. And the guy did say that it's very, it's like impossible to reverse engineer. And then 2017 Bitmare, it also allows you to like move logic, relocate logic. So by reversing, you know, we mean you take the bit stream. And then the goal for the most part is to be able to recover the hardware description language and underlying logic that went into generating that bit stream. And once you have that, and if you did that 100% correctly, you might be able to modify that logic to have it do something different than its original design. And then you will have to run the whole synthesis tool, right? Regenerate the bit stream.  And if you did that 100% correctly, again, without knowing any of the rules about how those bits are actually used for that FPGA, then you might have a hope of, you know, taking something like the bit stream that we found in the FPGA that we think is implementing the trust anchor and then altering its behavior in a way that it might allow us to bypass, you know, the trust anchor capability. But the chances, you know, people doing this on anything but a very simple FPGA is very low. In fact, I'm not actually aware of anyone who has successfully done that entire path on something like a commercial, you know, like a real world commercial application of an FPGA on some commercial, you know, bit stream. So chances that working very low. Yeah, let's talk about the pie. All right. So like I mentioned, you know, on the FPGA you have complex logic blocks, right? So this is where, you know, your hardware description language with the logic gets configured. Then you have pins, right? Pins are literally those little metal things that stick out from the chip, right? That you wire to other metal things on other chips. So, you know, we're humans, we like to design things on, you know, few layers of PCB, right? So the number of pins we want to keep reasonable and the largest, you know, Spartan 6 FPGA has something like 560, 76 pins, right? So, you know, that's a lot, but that's a very small finite number compared to the logic blocks which go up to about 200,000. And in each block you have a whole lot of, you know, like smaller logic blocks. So, you know, we have about no more than 600 pins and we have 200,000 CLBs and, you know, standard sort of approach to FPGA reversing was to, you know, recover all of the logic from all the CLBs. And we looked at that and we said, well, you know, we're not FPGA people. Like, we're, you know, this is too complicated, right? Like this probably won't work. A lot of smart people have tried and haven't really gotten far. But why would, why don't we look at this? You know, they're not that many pins. So if we can figure out a way to deterministically reliably manipulate the pin, who cares about what the logic is doing? You know, if we can disconnect the pin, right, and hook it up to something else that we supply, then it's one of those things that like, if the FPGA falls in the forest, like, did it really happen if no one hears it? No, right? Because, you know, if we take a pin disconnected from its logic, and that pin is still connected to the rest of the circuit board, and then we bypass that logic, right? So, and this is an actual plot of the Spartan 6 family, the largest, the most dense chip has, yeah, 576 pins and 150,000 logic blocks, right? So if you put that, you know, actually in scale, the graph actually looks like something like this, right? So, and this is not even to scale. That curve grows really fast. So one of our intuitions at the beginning is, forget about reconstruction, you know, reconstructing logic. It's too hard. Let's look at, you know, a way for us to reliably manipulate the pin itself and see if we can do that. So, also, you know, BitStream does optimizations and there are no optimizations in the IOB. This is one of the logic complexity we are looking at. So this is a SHA-256 we wrote, and this is a very small part of that logic. It has, like, thousands of CLEs, but what is interesting is this thing, right? Like, this is the binary representation of the BitStream. The top part represents the complex logic block, which is implementing the Boolean functions, and the seven, yeah, six of those are basically the IOB blocks. Each IOB block is eight bytes in Spartan 6. And if you can control, if you change a little bit in this, you know, like a byte here, you can change the value of the logic of the IOB from 0 to 1 or 1 to 0. And you can, you can also change, these eight bytes represents the characteristics of this IOB. So you can convert it from, you know, like input to output. By just changing one parameter, the number of rounds in the shot of 56, look at the logic changing, but the IOB remains the same. And this is the depth. So the only depth was actually in the complex logic block. It was not there in the IOB. And this is very important. So as I said- Let's back. So the thing that you look at is an actual graphical rendering of the actual BitStream generated from this little mock example that we created. Uh, and if you can go back one more slide, right? Yeah. So the IOB doesn't change at all. It's in very predictable places. We know where the pins are because they're numbered, you know, like one after another, right? They're designed on the PC board and they don't get to change because the PC board is, you know, in hardware. And if we figured out, like which eight byte construct, um, describes which pin, then we should be able to very predictably and reliably, uh, you know, change the behavior of that pin. Uh, and we have a much more hope of doing that than trying to do RTL reconstruction on the logic block. Okay. So as we said, like, uh, we can change the output from, uh, to, um, you know, we can assign the value zero without depending on the, uh, the function F. Uh, then similarly, output two one, change output to input. Uh, and the same thing goes with the input. So, uh, what we want to say here is that, like, you know, the vendor is not, vendor should not be dependent on the obscurity of the FPGA because as we saw, RTL reconstruction is hard but not changing IO. So how do you reverse a BitStream? Right? We see BitStream as a firmware and it can go with unpack, analyze, modify, repack. And it has, you can talk about, like, it has encryption but you can probably do, uh, you know, like, uh, uh, site-channel analysis to figure out the ES keys, you know, you can do fault injection to change, to basically skip this check. And then you can also do photon-emotion analysis. Uh, so our development board, which we chose to do all this research was Spun 6, uh, LX45T, uh, uh, is the model of the Spun. And how do you do on the unpack? If you read the documentation, you can do the unpack. Uh, which is basically, like, find the sync word, figure out which, uh, kind, what kind of, um, uh, Spartan it is, uh, downloads, uh, register in description language, parse it, and uh, find the registered FDRI, which specifies the hardware circuit for Boolean functions. So, uh, then we move to analyze. There are multiple types of logic, uh, uh, type zero pa- frames. The first one is the, uh, complex logic block frame, which also contains IOI, uh, um, you know, like how to configure a BRAM and all that. Type one is BRAM, the actual memory, what it contains. Uh, and the type two is the IOB itself. And all of these, which is very important, is all of these are serially laid out. So if you figure out the range of, uh, of each of those, then you can do analysis and reversing to figure out which, uh, pin is represented by which bits. And, you know, um, the main important thing here is like, if you figure out the device layout, you can exactly pinpoint which CLB is used, which BRAM is used, and which IOB is used. And each, you know, these are details which you can find in our, uh, github. Uh, and, uh, major represents, so it is a two, uh, SRAM is basically a 2D, uh, array. And, uh, each row has multiple columns. Each column represents one resource. So, you know, like a CLB, a memory, uh, slice MCLB will be one column, slice L, CLB will be second column, BRAM will be third column. And, like that. And similarly, each, each column has its own array of rows, uh, which defines which flip flop is used, uh, uh, which MUX was actually, uh, encoded. So, uh, we, we actually analyzed the BISTream and created this really cool, uh, uh, visualization. My team has really worked hard on this, uh, tool. Uh, as you can see, it specifies the resource utilization, uh, which column is used. You can see, this is for, uh, the Mojo board, uh, which uses LX9. It's a really cool devote. And this represents the ASR BISTream. So, you, you can see, like, which, uh, uh, block, which resource represents the PCIe, which resource represents the LCLB, and so forth and so on. So, this tool, can you go back, is, is Unkid help right now? It's amazingly cool. You should totally check it out. Because, uh, you know, you can, all that stuff that Jadon said, you can read maybe 2,000 pages of Xilin's documentation and try to figure it out. Great. Or you can use this tool which has already done that. And not only that, it will show you, like, every, you can pinpoint to any piece of the binary, and it will show you what that binary, what, what that chunk of binary represents. Is it an IO pin? If so, which pin is it? Right? Is it, like, a CLB? If so, like, what is the raw data in that CLB? Uh, and for us, you know, we, after reading the, the patent, knew that, okay, the trust anchor does a whole lot of magical deity stuff, right? And then if it doesn't like what's happening after 100 seconds, it will literally assert the reset pin on the Xeon processor and physically reset the processor. So that is how the mechanism we think worked. So if we can find out exactly which pin the FPGA is using, uh, for that, we can do our thing and disable that pin and make sure the trust anchor literally cannot reset that reset pin and then we win. And, uh, the next thing is, okay, so because the pins are set in, in serial order, uh, we know exactly what part of that binary it ought to be. So the only thing that we need to know now is which pin, uh, actually is used on the FPGA, which basically involves tracing, you know, the, the PCB on this router from the CPU reset pin to the FPGA, which is very simple. Um, we have only five minutes left, so I guess we're gonna go to the demo, but, uh, this is how the encoding works, if you know the range, figure out how, which pin represent, which bit represents which pin.  Um, we have a paper coming out in Woot, we have a lot of documentation at GitHub, all the details are there. And, uh, one thing I would want to say is that modification is really easy. Uh, they have like implemented this 22 bit CRC for single event upset, you know, uh, and, uh, that is also reverse engineered. You guys can just check out the GitHub, really have to go. But, uh, you can also disable the CRC. I haven't tried that, but, uh, you can just disable using this register. Uh, and then I want to, uh, the demo basically contains, uh, we have a bit stream which enables those four pins and we're gonna, uh, just turn this pin off, uh, using the tool which is currently present again. And, uh, as on set, we basically figure out which is the reset, uh, which pin is controlling the reset pin and you disable that. And really cool thing part about this is, like, uh, there is no patch available. Once it is allowed, we disable the emulation of the FPGA so that the Linux code actually cannot update the FPGA anymore. So that's pretty awesome. Uh, and, uh, I also want to talk about, uh, Rick, uh, found a really cool way as Aang was saying, like, there are 600 pins. In this case, there were 296 and, you know, our, uh, automated extraction bit stream tool, who's not here right now. Uh, so he really, he came up with a cool idea of JTAG scanching. Uh, as soon as the fan comes up, uh, he checks the state of all of those 296 pins using JTAG and we found 10 pins. And one of them was the one.  Sure. Okay, so this is where Brian comes in, you know, after years of investing in this, uh, we just couldn't make it work. So we got an intern. His name is Brian.  And he did it. He's great. Thank you, Brian. I mean, without him, this work would have not been possible. Because, you know, we need to trace through, like, the six, uh, layers of the PCB in order to find, you know, which pin goes from the reset pins to the FPGA. Uh, and then, well, you know, he touched the wrong pins. So, feel for it. Gross. Right? It was just fine. I mean, it was a very hard job. So, uh, but then, you know, we were able to make some progress, uh, and we were able to find that pin, right? Uh, and the last question is well, this is cool, but how are we gonna do this remotely? You know, if it's not remote, it's not really interesting, uh, because if somebody already has root, uh, on the router, then, okay, you can change all sorts of stuff. So, we said, well, you know, it's 2019, finding a remote, you know, code execution of all, and then privilege escalation is gotta be really hard. I mean, people have been looking at Cisco routers for quite a long time. Uh, so, man, like, do we, can we even do it? Uh, yeah. So, they have a driver, basically. That's how they use it. And, uh, we also did a lot of fuzzing on all these protocols. Uh, while this was going on, James come in. Well, you know, so we're like, man, this is gonna be really hard. Who knows if we're ever gonna get this to work? And then James, who's sitting over there, said, okay, guys, I got root. It was great.  So, let's just point that out.   Uh, and this was a very simple, uh, vulnerability to exploit. So, man, uh, this was great. So, if you couple any kind of code injection on any part of the tax surface of any Cisco iOS, uh, you know, platform or device that's affected by this, you can immediately use that escalate privilege and then update the firmware, uh, and well update the, the bitstream and then disable the, the FPGA, right? The trust anchor. So, you can take a remote exploit, couple it with this and make permanent modification of the hardware that is impossible to undo, uh, using software again. So, with that, let's, um, we broke some more, uh, and then final cost, $50,000, uh, the Fort is very large, uh, but as a result, we figured, finally figure this out. So, I'm gonna let John show the, uh, the two demos. Uh, we're gonna exploit the Cisco router and then show how this is done. And then, um, we're gonna also show the Moja board demo. Uh, okay, so, um, okay. So, this is what I want to show right now. This is booted, it takes like ten minutes to boot, so I have to boot that. So, this is the output of this ASR1001X right here, right? It's running the latest firmware. Well, one minus the latest firmware, because Cisco did patch this. So, what I want to talk about here is that, uh, look at this message. As soon as it boots, it says initializing hardware. And, uh, that says system integrity status. This status is coming from the FPGA. And the pre-RAMON, which we talked about earlier, is reading the status and printing it out. So, now we can go ahead and exploit it. We did. Yeah, we did. We connected to the wrong port. Uh, anyhow, never mind. Uh, sorry guys. This is part of the demo. Well, okay, it's going on. So what it is doing right now is that it is doing James Hack, uh, getting the root. And then we, uh, took a driver which was Quack.co. I don't know why they wanted to quack it. But, uh, so we took, we hijacked the driver. We understood this, we reverse-engineered the CPLD driver, understood how to emulate, uh, how the FPGA emulates the SPI, uh, flash for the, uh, Linux, uh, OS and then, uh, basically applied the patch. You only require around 15 bytes of patch to disable the complete, uh, update and also disable the reset. This is going to take some time. I want to go ahead and, like, do the mojo demo. So, we're watching as a full remote exploit of Cisco AOS, uh, followed by a full modification of bitstream bypassing trust anchor and then permanently disabling any future updates to trust anchor via the FPGA with this bitstream, uh, you know, modification. So, that being said, right, look at all, think about all of the devices that's affected. This thing has been in deployment since 2013. Uh, this vulnerability is in all those devices. So, if anyone finds any code, uh, any kind of code execution in any part of that, that attack surface, uh, there is a chance that this is not only has affected your router but is persistent, uh, to the point where, in order for you to get rid of it, you probably will literally have to desolder a chip, right, from your router or your switch in order to test, even to see if you've been exploited or not. Um, okay, so, uh, as you can see, this is a mojo board, uh, and yeah, can you put the light on it? Yeah. So, this is a mojo board. You will Google it. And, uh, what matters is like those four lights, right? And, uh, those four lights are representing one on those pins. And we're gonna go ahead, run our tool, which I'm gonna run again.  So, uh, what it's doing right now here is that we, uh, took the tool, we disabled the pin and I'm uploading it right now, the repack binary, which our tool did, uh, the GitHub link. And, uh, it's gonna go ahead and we wanna go, can you reboot the router? So, let's look at what was the integrity status. Again, this is on pre-RAM on. We have full access now, FPGA cannot do anything and here it is. We have updated the FPGA. It's still booted. You cannot apply any more patch. I have 20 SPI flashes right now on my, so I have to like literally take it out, update it. Uh, like this is where you have that. That's very good. Come on, guys. Like this is really cool though. Right? So, now we've left the output, right, of this thing saying that something is wrong, right, in Raman so we can demonstrate, prove that, okay, so the FPGA is doing its job, it just physically can't reset that processor. And now we can actually patch Raman and pre-Raman to make this little message go away, right? So, but for the purpose of the demo, you know, we're showing that this thing is trying to cry out for help, but no one is coming. And we're gonna wait 100 seconds also while they show the other demo. Uh, so as you can see, uh, there were four lights before and we have disabled the one light which was on the, uh, at the end. So again, try it out, play with it and, uh, what we wanted to talk about.  So, uh, if you take a look at our tool, right, you should be able to, you know, modify this yourself and play with all of the different options of taking, you know, pin-high, pin-low, input to output and all of that good stuff. So, you know, I think we're, uh, about out of time. Yeah, this is the impact. Well, right. Cisco routers are used a lot in a lot of places. Um, but so we do make a lot of recommendations, uh, and a lot more detail on the technical side of all of this and the implications of other things that's not just a Cisco router, right, in our, in our paper, which is coming out in, in a day, I think, or two days, uh, at Usenix Woot. So, you know, we don't have time to talk about all of our recommendations that we have for, uh, you know, improving FPGA security, right, making it as, as good as it can because fundamentally this is something that is stuck in hardware and I don't believe that this is something that can actually be fixed via a software patch.  And, um, they got 20 more slides you guys can look at it later. I don't know, I think we're gonna get kicked out. Oh, in order to reward you guys for, for coming to the right talk, I'm gonna throw out some t-shirts. I mean, who else is doing that, right? There you go. You guys made the right decision in life and you get awarded for it. Yay! So, all right. Well, anyway, thank you very much. Uh, that's our talk.


The All Progressive's Congress APC campaign counsel in Kogi, Cossack, has accused the People's Democratic Party PDP for hiring people from seven neighboring states for its campaign rally on Saturday in Kogi. Kingsley Farmwall, the director of media and publicity Cossack, stated these at a press conference on Monday in Lokoja, tagged the many lies of PDP and its traditional illusions in Kogi state. Farmwall also said the PDP was dismayed by the poor turnout and resorted to theatrics of rolling out expired individuals who had been expunged from the ranks of the APC to their party. Left reinforced in their disdain for people whose tints in government brought their state near country to their knees.  The rest of our people went about their normal businesses utterly disinterested in the hollow antics of a party that once wasted 13 precious years for them. Dismayed by the poor turnout, the PDP resorted to theatrics. It rolled out expired individuals who had been expunged from the ranks of the APC for their unsavory deeds and characters and proceeded to canonize them. The rally turned into a fuss when people like the former deputy governor of the state, Heather Saimeon-Achuba and the former speaker of the state assembly, Rai Torrebu Alpha Imam, were repackaged for a tiku as Kogi APC stalwarts who were the campaign to the PDP at the rally. What a tiku and his entourage might not have known is that this is the Saimeon-Achuba who was unceremoniously impeached from office with ignominy by the state assembly for gross misconduct during the first term of the administration.


Hi there and welcome, I am The Technician Projects and today's tutorial is going to show you how to crop three different video files into one file using Final Cut Pro X. Once Final Cut is loaded and you have your files inserted in, as you can see I have a large editing file here of three cameras and one large audio file. I am going to zoom in on my cross section here and I am going to play it back from camera one and as it plays it will jump into camera two. Now if you click on camera two and go to the top right hand corner of the settings for that image and you can see that my crop section is trimmed to the bottom. Now if I go back to the original clip I will take the bottom bit off and go back to my original clip and press play again and as you can see it will now jump to camera three. So if I click back onto camera two and crop the bottom it will show that it is cropping into the second camera angle instead of the third and then you go and crop back into the original angle. If you enjoyed the video today please leave a like rating and subscribe for more. Thank you for watching and see you next time.