I am Joe Grand and we are talking about smart parking meters. Just to give you a little bit of background, I'm an electrical engineer, a hardware hacker, I live and breathe electronics. I love this stuff and the reason I got into looking at parking meters is there's a lot of them in San Francisco where I live and I use them all the time and I said, hey these things are electronic, they look fun. Let's maybe do something security related. I don't know. I guess that's about it for me. I designed the Defcon badge this year. I'm interested in photography and BDSM. Chris isn't here today. He was here with us at Black Hat but for various reasons he's gone but he's an amazing hardware hacker. He's like one of the best. You want to decapitate it or dump something from it, you talk to him. Chris talked last year about silicon dyanalysis and he's one of the best smart card hackers in the world for sure. We'll make up stuff on his slides. We'll hand wave. Why parking meters? I mentioned why I was into it but why in general? Parking meters are these, they're just everywhere. They're in every city, they're in every city in the world. These things on sticks every few feet away and we just totally take them for granted. We go, we park our car, put some money in, walk away.  They're essentially individual computer systems that can now be analyzed. Think globally, hack locally. Yes. Clearly I'm the son of a hippie. And there's also big money. So anywhere there's money there's going to be fraud, there's going to be people taking advantage of the system. So the parking industry is a $28 billion industry annually, I think just in the U.S. alone.  So not only like the financial fraud of getting free parking but there's social issues and legal issues and we're going to get into all of that. So generally the thing we wanted to do was understand the current state of the unfair collection systems or fair collection systems and we wanted to be able to demonstrate some attacks. We wanted to be able to come here and show that something had been done. It's not just enough to say how some things work. We also wanted to show you how they don't work or how they work when you probably don't want them to work that way. Anyway, we also wanted to show the whole process from start to finish because for me this was my first real hardware hacking project where we took some foreign things and we basically understood them as best as we could and then using that we were able to go all the way to a full break. So this should hopefully take you from start to finish if you've never done it before, which I think it's important to bring people to the next level. Joe really thinks that so he brought us together to work on this. So it's pretty epic to be able to work with him and Chris. And of course we took on the SFMTA, but of course it's also important to say that this is not really specific to San Francisco other than our particular case study. The meters that we examine all had pretty much the same problems and we just happened to live in San Francisco so it was just kind of a no-brainer to kill that one. Yeah, so going through the process is the most important part that you should take out of this because you can apply this to other parking meter systems in your area or you can apply it to other products. Anything you're looking at sort of goes through this general process of analysis and gathering information and stuff like that so you'll see it. And then we'll hit the case study towards the end. We're going to talk about more general parking meter stuff and general process stuff and then go into specifics of San Francisco. Yeah, so there's some different things that are kind of interesting about the parking meters in San Francisco and of course generally everywhere. You've got these single space meters that are everywhere lining the streets and some cities like Oakland they've cut them down and put in multi-space meters which have really confused a lot of people but the idea with the single spaces you put in some change or you use a smart card or some like cell phone token and the multi-space you usually get like a printed paper token in some cities you tape it to your window and other ones you put it on your dash and the meters generally are sold with this idea that they'll stop people from lifting money like the meter maids from lifting money and so they have audit logs so they should know about how much the meters are used and also about how much money should be in the meters and maybe they also have role separation so the audit logs are pulled by someone other than the person that collects the money and then of course they have different ways to like repair the meter so the person that repairs the meter might not pull the audit logs they also might not pull the change and this is I think this is generally a pretty important thing to do in a security system but it's kind of ironic because the things that we found problems with would be like probably even worse if the threat model was that an insider was attacking the system so a lot of these systems were sold with the idea that you basically would want to have this so you could stop your employees from like skimming money I can in I think it was San Francisco actually someone was arrested with seven thousand coins in 2000 2007 or 1997 or something it was a news article we found online oh yeah actually no that was a different thing I think they landed on the moon right yeah yeah I'm not sure anyway so the idea though that the insider is the threat means that they probably designed this wrong because we're not insiders either but I mean it seems like there's some pretty bad design flaws so the way parking meter technology sort of started was obviously mechanical based in the early 90s these hybrid meters started coming up so it was mechanical based where you put your money in and you turn the knob in some way to feed the money through but then there was an electronic system very minimal to keep track of the timing possibly for sending out some startup messages or some administrative messages but now as I mentioned everything is just a pure electronic system you know going from the coin detection which is some inductive method using coils and some electronics and processing to figure out the coin type to microprocessor with memory and now we treat these systems as actual embedded systems and we would go about analyzing them and breaking them the same way we would any other type of hardware products so you know we've gone from mechanical to essentially solid state so here you can see some reconnaissance just kind of like accidental reconnaissance yeah I just happened to walk up right to her yeah so basically it looks like this person has like a small electronic device stuck into the key slot and it's if you look at the crash cart that you have there that's kind of crazy your meter system has a crash cart but it looks like she has a small handheld device which if you read some of the documentation for this particular meter you'll find out that they have like a super secure Windows CE device that you can plug into the serial bus that's in the coin slot or in that in the key lock but it doesn't look like the lock is open so it's as if they made the actual lock into a serial port which seems like kind of crazy right so we think that that this person this was in San Francisco and we think that this person was going around and grabbing audit logs or updating the meter in some way so she wasn't there to pull the money out so even though you know the coin the the serial interface for this PDA was through the coin lock she couldn't get access to it so that's the exact point of the the roll separation most parking meters have some sort of user interface you can pay it whether it's coin smart card credit card some now accept text messages in some form and then there's administrator interfaces some of them are the same so the coin slot the smart card interface could be used for depending on the system for administrator access through some piece of hardware usually it's some serial interface the coin slot because it has inductive it has coils so you could do some really short-range wireless then you have infrared capabilities and other wireless capabilities and then other stuff that might be completely meter specific like the serial via the key the coin lock so a lot of interfaces out there and the more interfaces that are out there per meter we can target each of those you know it's like every single interface is an attack vector the attack service for some of these meters is just ridiculous like I don't know how the designers of these systems thought they could get away with putting something like this in front of every single person all the time especially something that often makes people mad so yeah it seems like a lot of the a lot of the design work that had gone on for security is just for vandalism and they never they the designers didn't think about you know this next generation of attacks basically that if you read some of the documentation they say stuff like the smart card you know slot is modular so that it can serve as the sacrificial part so they're like ah ah is going to attack our meter ah guys tin foil ah ah guys shorted out smart card reader well we we can totally protect against ag no problem all right so we took a few pictures of some parking meters just from various cities this one has a smart card interface from Austin this is a Chicago multi space meter which will mention a few slides when we talk about some previous work and problems for those of you that know me you know that I love Canada and this meter is great it's also by the same company that designed the San Francisco meters JJ McKay and this one's interesting I didn't actually use it I didn't have a car when I was in Vancouver and apparently you call this number or you text message this number and you basically don't actually change the value on the meter but the meter may have like a log that shows which ones have paid by that way and then even though it's expired they won't give you a ticket because they know the time in which it's supposed to be up which is kind of an interesting and kind of an interesting system here so you have a completely separate system that overrides the mechanical meter so you could in theory give everyone free parking or something like that by doing that like attacking this other system so it's like who designed the systems did they know they would work together it's like that's a really interesting idea and if they haven't done some due diligence with that it could be very very bad that one's also it seems sort of labor-intensive because if you know normally a meter mate will drive by the meters and they'll look at the back sides to see if time's expired but in this case if somebody is paying online and the meter actually does stay at zero they're gonna have to stop at each one and check to see if the you know if the person had paid via phone instead yeah it's pretty rough here's a here's a parking meter from Jerusalem that was near the old city and it's just there's a few different major brands of parking meter manufacturer and we'll talk about those but this was I believe this was POM so some of the prior problems we're not the first to look at parking meters and hopefully we're not gonna be the last but there's been people messing with these things as long as they've been around New York City in 2001 when some of the early electronic parking meters came out they had infrared capability for their administrator interface and somebody figured out that they could take a universal remote control and hit some want one of the buttons to reset the value of money on the meter which which is the one of the exact social attacks that we had that we had kind of come up with so is it is Hikari here in the audience are you here David no okay but he wrote a pretty awesome paper in the uninformed journal which if you don't read done does anybody here read uninformed raise your hand wow okay you should all read uninformed it's the most hardcore technical journal that basically since frack so if you're not reading it you're probably uninformed so you should read uninformed and be informed but this is a great text file by Hikari and talks about attacking the San Diego stored value card which is pretty it's a good one yeah it's an interest it's a different completely different smart card implementation but it's almost a different type of smart card so it's worth seeing so you can kind of get a get a view of how very smart cards are used and then Chicago recently deployed a bunch of multi-space parking meters all over the city in June how many people here from Chicago have you seen these parking meters yes do you love them yeah nobody in Chicago think globally right so I mean Chicago has been notorious for disliking the parking situation there meters are always being vandalized are always being damaged and I don't know for some reason when some of these parking meters came out these multi-space meters some of them failed and they weren't working and the media said oh no hackers have taken over our parking meters and they got in touch with me and Jake politely declined to talk to them I just deleted there you know but I called them back and and had to had to give give them my view which was sorry it's not hackers it's probably a firmware problem because the multi-space meters that failed and I don't exactly know how they failed I think they just didn't work we're all situated in one neighborhood of Chicago that had a different rate than the rest of the city and it was like a really expensive rate and I don't think they tested that rate so there might have been some firmware problem or some overflow or something so it was in the in the news it was all over the place and then it quietly disappeared so I don't know if anybody from Chicago knows the real result of that no are you suggesting that greed might have caused a firmware bug possibly whoops yeah they're like let's jack up the rate as much as we can that's pretty bad if you hit like an overflow condition from raising your prices right and Chicago too also has some sort of wireless communication back up to the cell phone network and then back to some mothership so they were connected and that opens up a whole new range of attacks who here thinks that just because you're using a cell phone the file layer is secure I mean how many people have you seen around here just using like cell modems like it seems like if there's some sort of cell modem back into these things you should all start hacking on CDMA and GSM stuff I mean it's not hard right I'm sure someone is right well definitely using a new radio so this is this is just the general process of how we approach the problem and how we approach sort of any hardware problem kind of think about some attacks we postulate some various attacks about what we could do you know from the most lofty goals to kind of the most maybe obvious or low hanging fruit then we gather information we will analyze hardware we analyze firmware if necessary and then we look at any external interfaces and in our case there's a smart card interface so we looked at that so no pun intended while saying this with a member of the loft on stage but the loftiest one we thought was the covert channels like imagine you know someone serial number for their smart card or you know how to pay via cell phone you could potentially set up the LCD so that it sends you know a message like oh hello Joe the crow flies at midnight modifying the firmware right and I think it was Jeff Moss he suggested well you know if you have these RF interfaces and you know the meters were exploitable why don't you just you know make some malware that spreads between meters I mean if they're a mesh then you know mesh it yeah and then denial of service are sort of these destructive attacks but depending on on the attackers goals might still be valid so setting a meter to out of order just preventing people from parking there because a lot of cities if the meter is out of order you're not allowed to park there or you're only allowed to park there for an hour which you'll get a ticket then that could also be useful if you're like well you know I got a leaf I'll set the meter to out of order and I'll come back right yeah and then of course destroying any sort of user interface smart card interface or coin processing circuitry with a little ESD pulse using a little discharge tool some of the meters are designed to be electrically isolated but you know I think that if you have a taser or stun gun you could find out how well they did that and not suggesting that I tested this but if you just look at some of the boards that you can buy or the meters on eBay you see that they very clearly take the route of oh well the smart card interface is the one that's going to get attacked but they forget about maybe like the external serial bus or something yeah and then you know possibly even if you know if you know how the system operates causing a legitimate user to be added to some fraud list if there is a fraud list implemented in in the city say based on serial number so if I know if I know Jake serial number of his prepaid card that he's using you know maybe I would clone his card and use it all over the city all the time and generate some some flag somewhere to prevent him from legitimately using his card so it's also possible that you could do some sort of immediate deduction of credit so someone walks up and they put in three hours and then they leave we mentioned this a black hat when we were talking about this and some guy from Montreal's like oh yes we love to do that in Montreal we hate those fucking parking meters and and so apparently the deal is that you you you park the car you put in the change and you are not allowed to refill it so if you put in more change the incentive system yes as that fine gentleman there it resets to zero so apparently there's like a social fad about going and dropping in coins across the whole block in order to raise doubts about the meter system and basically anyone can contest a ticket because it's so easy to break that system so in a way I mean that's great they they showed that the machine was not you know perfect which is important and and this is exactly what people in New York were doing with the infrared remote controls as well so it's a you know one of one of the favorite things which would be hey you know there's some guy that you don't like he just parked his car go remove all his credit call tow truck call the call the parking officials give him a ticket yeah there's also of course the possibility that you could change the audit log right so it doesn't look like any of the meters are actually using any sort of computational infeasibility right so it's not like there's a cryptographic problem you have to solve it's generally just do you know something like do you know how it works so that sounds a lot like security through obscurity to me which means that it's what is that secure probably not and of course if you wanted to well this you're better at this this part of the slide and I'll know about that but I'm so I'm changing the time and date could always be fun right if you you know everybody gets free parking on Sunday so what could you do you know change the date and it's like every day is Sunday Sunday Sunday they're already parking in the city you know they're already here we don't have to get their money I don't understand why you're saying that for those of you that ever watched the Simpsons was growing up thanks for you they got the reference is that the monorail episode I don't even know so I think it's the one where what's his face goes and works at the racetrack and they're built anyway so the least lofty goal just so happens to be the one that probably everybody wants which is unlimited payment via smart card and that that one is kind of incredible because you think you know you look at a smart card you're like oh that that's got to be secure it's you know it's smart it's a smart car right right so that's got to be secure because I mean even as smart in the name and it's really tiny yeah and it so it must be like you know smart be high-tech so that's that's actually what we're looking at for the case study in San Francisco is the unlimited payment via smart card not so smart card yeah so here's here's the process just on information gathering of course you do stuff like Google and browse the internet but yeah you know there's I'll talk about a little bit in the in the San Francisco case study but I mean social engineering can get you really far I mean just you know if you ask technically incorrect but really specific questions that are maybe really eager to someone who cares about their job they'll tell you the most amazing information about their system and generally speaking if they only tell you a little piece and someone else tells you another piece you now have enough to put you know something together that is really useful and combining that with say press releases where everyone's always tuning their own horn about all the details of their system and how good it is you can start to realize where they're lying before you even look at their systems too which is great like for example it's secure probably not yeah and yeah part part of the hard-working process or any sort of analysis process is just gathering clues so you do your social engineering and you might get one bit of information you find something on Google you find something in the trash all these things you might not know how they all fit together until you start your work and then you're like oh I can use that piece so another thing is we said you know globalism what does globalism have to do with you know parking meters in a city well I mean if you roll your own stuff you can control your own stuff right you can make sure no one ever sells it on eBay but if there's a meter company and they build a piece of hardware and they sell it to another city and they tested in that city and then that city buys a new implementation because they didn't like it they're gonna possibly sell that meter infrastructure online and now you can buy that and legitimately own something that's very similar to the meter that's in your city and then you can attack that and you don't need to take a meter or do something illegal you totally legally which is exactly what we did for our case study yeah eBay yeah eBay is a magical place and when we when we started looking at hardware you know in general we just want to get an idea about parking meters because it's not often that you can you know walk up to one on the street and take it away so we want to buy some and you know we did some searches on parking meters on eBay over over a span of like two months and we bought every every type that we could and there were three that was available the Duncan EMM 7700 is the oldest one the Palm APM and then the McKay Guardian which is the early revision of the McKay Guardian XLE which is used in San Francisco so we were hoping that we could get some clues about the system and being a design being a designer I know this for a fact that revisions of products typically are based on previous revisions of the design so we can learn a lot about current systems by looking at older older systems and getting an idea about how you know even from a system level how how the design is and maybe even from from a electrical level about you know what microprocessors being used what memory do they like using what's the interfaces you know what things can we look at so it gives us gives us clues and there's also actually details and similarities between competing products which is sort of interesting like most of these are low power for example and some of the things are kind of elegant and then you think like for some of the problems that they want to solve they might do something kind of I don't know a little like it's almost like a Rube Goldberg machine in some of these meters like this Duncan meter is kind of cool in that it actually is sort of like a hybrid mechanical electronic meter where they have like you can see on this slide here there's some little screws in there those are actually buttons and you put a coin in and then it weighs just a precise area out of the turning implement and turns like so and when it turns it scrapes across the heads of the screws and pushes an electronic button underneath so there's sort of this sequence of if you put a quarter in it might hit say here's a picture of the circuitry it might hit one one of the buttons like button number one button number three and then button number four but if it's a dime it might hit button number two button number three and button number four so there's a sequence to program the time corresponding to that value onto the screen there's also some so this is a circuitry this is this is the oldest one as I mentioned from 1991 there's a bunch of the buttons that are used for the coin stuff but there's also some administrator reset buttons which are cool there's infrared so people have been using infrared for a really long time and it's still in use and from what I know all of that stuff is just being sent if not in clear with some just very poor encoding anybody see the microprocessor on this board anyone know where it is it has to be there somewhere right there's something anyone take a shot at it win my shirt win my shirt wow that's pretty generous do you have another one to wear afterwards no I don't yeah so the microprocessor is actually hidden under the LCD which might not be an intentional thing to you know from a security point of view it might just be because a lot of the pinouts go to drive the LCD which is right there but it is under the LCD which means if you want to get access to it and this has a internal ROM then you need to tear the meter apart the palm APM this is a meter from Israel it takes shekels but it's made by palm in the US so there is this cross pollination of various countries sharing their devices which could be ripe for international espionage I guess yeah I don't know I mean it it seems like it's if you have someone designing the whole system in in another country there's a different set of economic and legal implications for the person that breaks that system they maybe never need to set foot in that country and they could like sell cards or something and mail them abroad and make money from it like oh broke the system so like an insider understanding how this works if it isn't something that's actually secured by some infeasibility problem that's just like a disaster waiting to happen I think yeah and some of you guys might be thinking all well you know there's no way someone's ever going to get access to a parking meter there's there's big locks on the meters that's just physical protection and if you're at DEF CON you might realize that physical protection and locks don't really stop everybody maybe Barry's here and he could tell us how good locks are mechanical I mean there's no real mechanical lock that is unbreakable right so I mean you you might need to be buried to break some of them but essentially if you are relying on physical security to ensure you don't have what amounts to a class break for your entire city you're probably doing it wrong right key diversity is something that could be really useful to you here probably both in the actual physical keying of the metering infrastructure but also in software so there's a few more I'm just going to breeze through these there's some debug ports that I thought were interesting on the palm the palms also modular so you can replace the various parts if they break easy access to the ROM here's another view easy access to the microprocessor as well there's a reset button make a guardian so this is one that was decommissioned from Tallahassee Florida that we bought on eBay oh I should mention to the prices price range was from 99 cents for meter on eBay to $500 so you know well within a budget of most curious people here's the McKay again easy access to the microprocessor in this case is a CLT 8402 3 1 G which is a custom ASIC with a Z80 core so if you were to pull off the ROM which is a an at MLW prom you could decompile that or disassemble it toss it into IDA pro and start looking around yeah another interesting thing about the Guardian is there's this cool RJ 45 connector on the lower right and reading through some of the data sheets available on their website it had made mention of some test connector some interface so we're like oh okay maybe you know it says something about having a serial port and having some I2C which is an interchip communication port so we said oh maybe we should look at that you know we have the meter it's open it works we might as well look at it so we hooked it up to to my little lab set up with the with with my digital oscilloscope and some level shifter circuitry and we're probing all the different pins trying to figure out what's what because if there's an interchip communication maybe that's something useful to drive the display but more importantly I want to see the serial interface if that was the debug port for sucking audit log information and they had infrared on this particular version and what we figured out is that on reset on power up the infrared port would spew out a bunch of stuff that also correlated to some data we were seeing over the wire so sort of infrared and serial information being set out and we tried to probe that for a while and we're just kind of playing around we didn't exactly figure out how it worked but you given time we definitely would have yeah it was only mildly interesting but just looking at the way that it was designed we realized that if this was sort of like the parent of the San Francisco meters then that's not that does not bode well for San Francisco is purchasing decision right and then firmware analysis which we did not do in our in our case but just in general if you do end up getting access to memory devices or to microprocessors the first thing you do is suck all of the data out of them suck all the program code out of them and then reverse engineer them decompile them do whatever you need to do right so I mean if you know the company that's building the system and you understand how what compiler they're using for example and you toss it into Ida Pro you can help like guide Ida Pro for example that would be pretty useful if you want to use obstump and grep I guess you could also do it that way so it would be really useful because maybe there's like some particular portion of a problem you want to solve but you can't figure out the generalized algorithm or you can't figure out like exactly what they're doing maybe they have some sort of like shift feedback register thing going on it would be useful to see the structure of the firmware so that you could better understand what's actually happening without just you know doing an intercept yeah and you can also target specific areas if you don't want to reverse engineer the whole thing because you just want to get clues or maybe figure out an access point to get to like an administrator menu but what I like to do since I'm not the greatest reverse engineer for for for for binaries and for firmware and stuff for source code I I usually run stuff through strings first to see if there's any you know information any cool constants and texts that are there and usually there are because engineers like to leave stuff in that's going to help them debug messages stuff like that and usually those are left in production products and then I'm smart card analysis again I mentioned I mentioned in this case if you have an external interface that is a smart card you would do this if you have an external interface for other things you would analyze those this is the process that we went through modern communications you might want to try to decode the protocols emulate the protocols so one thing that's really good about this is that looking at press releases can be really helpful for this especially when they're from the company they'll say something like it's secure and we use this standard so then you go and read that standard and you think to yourself this isn't secure at all right and that's really useful especially when you start to do the decoding and you want to do the emulation because you can implement part of the standard and then when you've done that you of course know that that is not true that it is secure so coffee is almost working almost a few more minutes all right so now we're going to jump into the case study of the San Francisco MTA and the city of San Francisco for a long time has sort of been grasping at straws of what parking infrastructure should we use you know should we use electronic meters single-space meter should we use multi-space meters that's made by company called Rhino the smart card that you see in the single-space meter also works in the Rhino so there is some modularity there and this system was essentially a pilot program in 2003 and it cost 30 35 million dollars which we'll get to but it's it's it's we should make a disclaimer first yeah about this yeah well yeah go ahead so first of all contrary to wired totally fucking us with the title of their story saying free parking for all which we expressly told them not to say because that we didn't want to end up like the MBTA kids we are not trying to get people to defraud the San Francisco Park meters the point here is more to undermine its authority I think that's much more important and we should all do we should all do our job to undermine authority wherever we can especially when it isn't you know necessarily duly received I mean this is San Francisco essentially wants to create revenue here I think it's good to put doubt in the perfection of the machine I think that when people get parking tickets you should be able to contest them I think that there isn't I was a god I can't do it but I'm gonna quote John Luke Picard oh this is gonna be good there can be no justice when rules are absolute okay it's true machines are not perfect and that there was a 19th century anarchist who said something along the lines of it is not that I fear that machines will begin to think like men no no it is that I fear that men will begin to think like machines and we have to fight against that I think so hopefully this is like you know chipping away at that and we're the one anarchist in the audience represent and we are both we are both San Francisco residents and we we pay a lot of tax to the city yes here and and and and it's just that it's okay for for a city to try to figure out what parking system they want and that's fine here's two other parking meters that are available in the city this one's a credit card based machine that says the smart cards don't work on them it's just our tax dollars are at work and a lot of money is being spent on systems that aren't being analyzed or if they're being analyzed the problems are just being ignored some tech somewhere in San Francisco are actually is there anyone from the city of San Francisco here not that where you work for the city of San Francisco I'm sure that there are people here do you work for the city do you work for the DPT now anybody from the DPT here you are yeah so somebody here from from the Bay Area cool yeah so so as Jake mentioned this the meter that we're looking at the McKay Guardian XLE there's 23,000 of them in the city that replaced mechanical meters in 2002 as a pilot program thirty five million dollar pilot program and to me a pilot is like a test right it's like an evaluation it's 2009 and they're still evaluating a system and for thirty five million dollars to do an attack like we did which is very very very easy as you'll see it shouldn't be possible and it blows my mind how much money they spent on this so I'm a little conflicted about I mean so in general I think that this kind of disclosure is good so we can influence social policy we hope that we can get some of these things to change San Francisco wants to install 320,000 of these meters in all of the residential areas of all of the city they think that it will improve for example the environment because people won't have to double park which sounds like a new speak to me but I think before they go and spend 320,000 dollars worth of parking meters worth of money I think that maybe we should like question that that's a good idea in the first place if they want revenue they should be upfront about it they should say this is the true cost of having a car in the city instead of actually inconveniencing everyone because what will happen is they'll become reliant on the smart card infrastructure which is thoroughly broken and I mean what are you going to do when you're at home you're going to go get a roll of quarters I mean that doesn't scale for an entire city right so they're definitely some some social problems San Francisco uses the McKay Guardian XLE meter so if you've got a like web browser in front of you and you're on the internet here you can look that up right now yeah there's plenty of information out there about about meters because manufacturers want designers and implementers to use their stuff so they make a lot of information available so the way the system works is the smart card interface the city uses a stored-value smart card they come in $20 and $50 quantities you buy them in cash at certain places around the city or you use a credit card online once you deduct credit you put the you put the card into the meter the meter displays the value remaining on the card and then after a few seconds it starts deducting units like you're putting quarters into the meter when once the values depleted on the card it's not reloadable it's a one-time thing you throw it away and the research as you'll see starting right now is it's easy to replay the smart card transaction so even without knowing anything about how it works you could replay the entire smart card transaction to the parking meter and emulate a card but then you can also modify certain data to do cooler things and we did this solely by looking at captures of an oscilloscope screen a digital oscilloscope screen and then analyzing data on a piece of paper over the course of three days basically a scope pencil and paper are all you needed to break the San Francisco smart card implementation yeah and it was interesting because I'd never worked with smart cards before I kind of dabbled with them but not really look at them in detail so it was a fun exercise to do that and and sort of we came out of it saying wow that was kind of easy and it shouldn't be that easy I worked a little bit with moxie you probably saw as SSL talk on some smart card stuff and so I had some I was a little familiar with smart cards but just in general like I hadn't gone in this deep and what actually prompted me to be interested in this is I saw this guy from the DPT who had opened up one of the rhino multi-space meters and inside of it was like a circuit board I didn't describe this a black hat but basically it's a small embedded computer and it has like an SD card in it which looks like it like has several hundred megabytes of space and I just asked him questions like wow you know I've always wanted to work with computers what's that like and the guy was like well you know it's a great job you know the city is really great and you know they treat you well we talked for a while I asked him questions like so can I like pay with my cell phone I just got one of those wireless telephones so that I can talk to my girlfriend and and he's like no no can't pay can't can't pay that way no these are all disconnected so like just in the course of like a five minute conversation where I'm holding my backpack over my 2600 shirt you know the guy like explained to me everything I needed to know is an offline stored payment system and it's not hooked up to the internet they don't do any verification they probably don't do any fraud detection if they do they probably do it badly in a way where you can frame someone they don't have any actual cryptographic solutions that you'd need to solve it probably replay it etc and the guy didn't realize he was telling me that but he was also giving me a job offer at the same time which is hilarious because they're trying to protect against insider attacks so I'm gonna I'm just gonna jump back for one second we mentioned this already you know the goals of this work weren't to slam San Francisco and and get free parking we really want to share the process with everybody we are we have released code but the code is essentially a template for how our smart card emulator worked I removed all of the bytes of data that you could use to get free parking in San Francisco so anybody who's in the media who's writing about this the code is essentially useless unless you're curious about how smart card emulators work I changed all the bytes to ff it's you know purely for educational purposes and that's why we're here right so some other things with with information gathering the internet was sort of useful sometimes a useful tool yeah I really recommend the airplane method of reconnaissance which is that you set up you get to run and then you get on an airplane and then you just come back and read it later that's all that matters if you do that you'll be good you'll be totally good surprisingly yeah the one kind of fun thing here is you know you would obviously search for product specs and and press releases but you might also want to think about discussion forums maybe the company is having technical troubles with a certain portion of their design do you think they have technical troubles Joe I'm just not I think they do yeah or at least they did and this was a post that we found on a sigwin mailing list about some technical problems that the that one of the software designers were having with it with his implementation of CVS you should definitely read that is a little small maybe okay yeah it's a little small so it says it's 2001 it says I'm learning how to use CVS and as part of this process I set up a test repository I almost said suppository to play with tests repository to play with it's it's great it's it's so it's 2001 and he's learning CVS ouch so but there's some interesting clues here if you you maybe can't really see the past but there's some stuff in there JJ McKay so it's obviously a McKay designer met talk is an interface that's used and in described in in some of the some of their doc some of the case documentation about some communications interface there's the gem plus lib path so now we know they're using some gem plus base smart card and we realized they're using GDB and GCC so that gives us clues maybe before if we need to reverse engineer firmware or try to disassemble stuff so here's here's the here's here's Chris Tarnofsky's few slides hi my name is Chris Tarnofsky I reverse engineer silicon dies what we did is I'm the other Chris so no what we did we have to go really fast now yeah we have to go really really fast I bought 20 or 10 stored value $20 smart cards and went to send them to Chris to do some diagnosis on and when I went into the store I go to the same place all the time when I go and buy my parking cards so when I had to buy 10 I was like I don't know a little bit paranoid decided to go somewhere else and I walk in with my $200 in cash and I go up to the guy I'm like yeah I want to buy 10 smart cards and he looks at me is like why do you need 10 I said I'm a sales guy I use the car a lot I drive around a lot he's like oh yeah okay and then he gives me the smart card so and of course one of the things to note is sequential serial numbers on the back of the car yeah they were all sequenced sequential serial numbers which is useful for analysis but I felt pretty good about myself for that quick little like social engineering thing your regular Kevin because I as you probably noticed I smile a lot so I don't know if he was like I don't know he believed me though it's kind of cool I'm no Kevin Mitnick but so Chris Chris is totally badass at hardware hacking and he you know just you know decapped all the chips and then image them for us basically oh yeah I just realized we have like 10 minutes so okay so he decapped the cards with this process that he would discuss if he was here it turns out that there's two different types of smart cards that's indistinguishable to the end user but one of them is the basic gem plus gem club memo card so it's a fixed ASIC ROM that can't be changed and then future versions of the card were or are in 8051 microcontroller emulating the gem club memo stuff which was cool because now those cards could be reprogrammed we didn't do that but they're they're more general purpose so they could be changed and not have to create an entirely new die so general purpose one of course is nice because that means it has some firmware and you could potentially dump the firmware so in theory even if they outlawed the rest of the smart card industry their own system itself can probably be used against itself and these are the die so on the on the left is the ASIC on the right is the general purpose one yeah yeah so so I'm going to skip some of this the the card is based on the ISO 7816 standard which means a lot of the electrical interfaces are are known there's two different types of transmission protocols for 7816 one is asynchronous one is synchronous the card we're looking at is asynchronous there's no external clock needed so the data transfer is on one one line and we can capture that and we did and the way we did it is we used a smart card shim so we had a circuit board that we purchased from one of one of the many kind of satellite TV smart card hacking sites that are out there that we plug the smart card in on one side have a bunch of test points that we could connect to our oscilloscope and then there is a smart card pad on the other side of the of the shim that plugs into the meter so now we can monitor the communications while the communications are actually happening and there's a kind of funny story here so you'll note that that's a shim that's an SFMTA card if you're ever going to break a law or do anything kind of weird or even something kind of sketchy in San Francisco there's one excuse that you can always use they'll get you away with everything which is this for your art project yeah so you know you can so this are our projects you can you can walk to show you our project you can walk up to a parking meter and you can do anything in San Francisco pretty much anyway but you can walk up to a parking meter with whatever tools you need and no one's going to care at all so you know it's a parking meter also so you can park in front of your target and run a wire like with your say AC inverter from your car to your oscilloscope and then just go on up with your art project and you're just making art so and I can document the whole process with my camera because it's art right which I did I did not do I don't have pictures for anybody who's considering rating us anyway so here please don't rate us yeah we don't have anything interesting we're telling you everything yeah except the actual details which we're going to tell the city so this is a screenshot of the digital oscilloscope the first thing we did is just see if we could monitor communications and we we know that smart cards always respond after reset with an ATR a four byte ATR so that's how we could figure out we could just guess on the on the bar rate and on the various configuration settings until we got a clean serial data that was decoded by the oscilloscope we got to roll yeah I know we got to get to the money shot so once we once we we could monitor monitor the communications what we did is we captured a bunch of different transactions we had a lot of different cards with different values to capture a bunch of data and then we brought all that data back to my house and sat there offline and just analyzed all the different data figured out what changed based on different values figured out the initialization and how the how everything worked and it was all done by hand no computer needed so here's the deal watch this set watch this setup what's wrong with this right here right you you spot the protocol bug where it might be a bad thing password okay maybe and then what what's that you you read the balance yeah well here right we'll go quick here so there's some initialization stuff that always happens when you put the card in it sends some stuff serial number which could be useful some unknown value sent by the card to the meter that the meter then processes in some way and sends back and says here's the password to you smart card and the smart card says yes that's my password you can work with me now and does that sound like a good idea it's kind of sounds like a good idea to me if I'm not building these we have we capture one set and we have it we're fine but the way that the meter figures out the balance is it reads this value that I call balance to from the smart card and that's a fixed value based on the value of the card so a twenty dollar card is is f zero a f and f one two seven for a fifty dollar card when you deduct a single unit what happens is there's just this transaction that happens it doesn't affect the actual balance to which stays the same it just does sort of a null transaction which increments this thing called a transaction counter in the transaction counter is the only thing that changes on the smart card during the entire process and that's what's used to count how many units have been deducted it's how many units have been used so that value of the maximum balance to minus ninety five decimals the maximum card value and then you would subtract the transaction counter to figure out how much money you have left survey who thinks this is a good idea I'm not not just the okay part but the stored value where it's what would happen if you were to change those values though yeah let's try to change the balance to say it has more money than it does so once we capture all the data the first thing we did was okay let's just do a standard replay attack you know we'll use a legitimate car that we bought let's use that so we did that I built up some circuitry with a microchip pick and we'll show you some pictures of the progress in a few slides but I use a microchip pick wrote the stuff and see there's a little bit of code on there but you go to the website and get the rest of it so once we knew the replay attack worked we said okay let's change the values let's change the balance let's see what happens could it really have 4,000 units sure why not them not that they sell a 4,000 unit card yeah but let's try yeah sure and then we also modified the code so the transaction counter would never increment so your value would always stay at the maximum so this is a automatically refilling itself for every time you take it out right because it resets because it resets itself right and then unbeknownst to me until when I was close to being done is that satellite TV hackers who have existed for a long time decades or at least over 10 years like using microchip pick devices so it just happened that the microchip pick device I used existed in a smart card form already so I could get blank smart cards program them with my code and it would work so the first one you see the shim you see the evolution okay first one on the sketch if you think about like a threshold a sketch hold right you could you got a sketch hold of really sketch where you have Joe's actual last name logo for the board and then you go all the way to the right where you just have a normal smart card looks like everything else and here so here's what happens here's the results and for those that can't see for those that can't see the meter the meter has just read the value of the smart card and thinks it has nine hundred ninety nine dollars and ninety nine cents we removed the card before it started deducting value the city of San Francisco yes if you're interested in projects like this and you live in San Francisco you should come down to the hack lab noise bridge noise bridge net and we work on some stuff like this and we do we do need to mention that we intentionally did not contact the city before this research first of all because we didn't want to encounter the same problem that the MBTA guys did last year but also because we intentionally didn't release the information that could cause them harm but we're reaching out to them now and we're trying to try to give them all the information so here's some some fixes that you could have really good luck with that it's very hard on stand alone systems it's very hard to do any proper cryptographic communications but you can look through these the slides are on the on the def con CDs you can browse through them but it's a very hard to the problem to solve yeah I mean to just to be like real quick because we have basically one minute these meter companies have basically created an e-cash system but they didn't do it right they didn't take into account the privacy implications and they didn't take into account the fraud issues Dr. David Chum actually solves basically all of these problems like over a decade ago working on anonymous e-cash so really they should be thinking about Chum's work and they should be re-implementing that so that's it these are our final thoughts you can read you can really ride a bicycle I guess to avoid this yeah also before you go we'd really like to emphasize that people should join the EFF Jennifer Granik really helped us out and gave us advice that made us feel safe about giving this talk and if you're not a member you should join yes and we're going to be dragged off to some extra room if you get dragged off thanks guys


While the main purpose of prayer may be to help others, it never demonstrably does that. Prayer's benefit only those believers who say or hear them. Prayer gives them comfort. It lets them think they have some control over a situation that may be out of their hands. It's the last resort of people who have run out of ideas and the first resort of people who never bothered to think about how they could actually fix the problem at hand. This is not harmless. There's a very real downside to praying. It lulls believers into a false sense of accomplishment. We cannot solve our problems, much less the world's, through prayer. We often see people with good intentions praying for victims in the wake of a tragedy. But prayer is useless without action, and those actions make the prayers irrelevant. To paraphrase the great Robert Green Ingersoll, hands that help are far better than lips that pray. I have no problem with prayer as an act of meditation. In fact, many atheists can tell you the benefit of silent self-reflection. The delusion occurs when you think someone else is hearing your thoughts and acting on them. When it comes down to it, prayer is a logical, even in religious terms. If God has a plan, why try to thwart it? If God can be swayed by prayers, what kind of God would allow the horrors we see in the world? And if two devout believers pray for different things, how does God choose the winner? I'm sure the San Antonio Spurs would love to know the answer to that.  We'd all be better off accepting that. Thanks for watching.


Hey y'all, what's up? My name is Sonali. Welcome to my channel if y'all are new. Today I'm filming my top picks for the Sephora Vib sale. The Sephora sale happens a couple times a year.   And then an insider gets 10% off, which means you haven't really gotten a lot of points. You're just a member in their system. You gave them your information and all that. Either way, you could still save a good amount of money if you are having to refill a couple of products or just want to purchase some new products and try them out. In college, I was obsessed with going to Sephora and would literally blow all of my money on all these products. But now I've kind of slowed down because I don't really need that money anymore. The last couple of things I bought from Sephora are skincare related because I feel like this is like one of the best places to buy really good skincare. So that's what we're going to start off with today. If you guys are interested in any of these products, learning more about them or just adding them straight to your cart, you can click the links in the description below. This will take you directly to the product so you can add them to your cart and get your savings. I will warn you guys, my products are super dirty. I don't know why I just can't keep them like they came, but they're just not as pretty as they once were. And it's just sad. But we're going to start off with my favorite skincare product that I've repurchased. And it is the Cora Organics Tumoric Brightening and Exploiting Mask. I am obsessed with this product. I recently refilled it because my sister gave me a Sephora gift card for my birthday. And I just decided to refill this because it is just my tried and true. Like I said, I was obsessed with going to Sephora in college and just like wasting time learning about new skincare products. So I would literally go and ask the skincare representatives like, oh, like, do you have anything for this problem? Or what do you recommend for like dark spots or something like that? I would just like always love to just hear their opinions and their thoughts about different products. It was a long time ago, but I'm guessing somebody recommended me this. And I have a really bad problem with just like whiteheads around my nose. They will not go away. I always have to like scrape my nose and just like pimple pop my nose. And it's definitely not the best feeling, but this really helps with that. I feel like it just like minimizes all that whitehead sebum oil. This says that it brightens and promotes skin cell renewal. Another problem I do have with my skin is that it's not always even. So I really feel like turmeric helps to even that skin tone out. So I really, really like this product, highly recommend it. I used to go to spa bar in Orlando to get a facial once a month because I had all that whitehead stuff and I actually had really bad, like deep whiteheads in this area. I will actually link that blog down below that talks about that issue. If you guys want to hear about it, but getting these facials really helped to just get all that gunk out. And she did really great extractions. And then she always used this mask. This is the Dermalogica sebum clearing mask. She never tried to sell it to me or anything, but I was really intrigued on like what this mask actually was. So I finally bought it and I love using it. Before I get in the shower, I'll just like put it on with like my mask brush. And then I will let the steam kind of just do its thing. And then I'll just wash it off in the shower like right before I get out. Another thing I learned from my ascetician at spa bar, her name is Molly Mann. Shout out to you, Molly. She said something about like a mask really just working as long as it's in the form that it comes in. So like once it dries, it doesn't really work as well. So that's why I use this product in the shower so that the steam can really just like soften it up and not let it dry out. The last product I have for skincare is really dirty. I don't know how this happened. I think I just like threw it in my beach bag and something got all over it. But it is the Unseen Sunscreen by Supergoo. I'm really bad at incorporating sunscreen into my daily makeup routine, which I know I need to start doing. And I keep saying this, I really just need to like put it on my makeup vanity and just be like, use this, like put a sign. But I do always use this when I'm going to go swimming or like go into the beach or something like that. This is really great to put under your makeup. It's kind of like a primer texture, like you won't really feel it. It's weightless, it's colorless, scentless, oil free formula. This brand also has a lot of other cool sunscreens. They have like a powder that you can put over your makeup that works. And it's just crazy how that works. But I guess it does. The next we're going to move into hair care. And the first thing I want to talk about is this way texturizing hairspray. I have been obsessed with this. I think I bought this my senior year of college, if I'm not mistaken. When I had like short hair and I thought it gave me the most beautiful, like beachy waves because I do kind of curl my hair like tighter. So I'll just spray some of this like up in the roots and then just like brush it out with my fingers, kind of like toss it. It just loosens my curls to give it a more carefree look. And then the next product is this Playa New Day Mist. And I use this like on the second slash third day of like having styled hair, which is not often, honestly, especially because we are in quarantine right now. This product is made to like smooth any creases. So it's just really great to use it on the second day or third day or honestly, fourth day. One thing I always recommend buying during these Sephora sales are beauty blenders because I'm pretty sure they are only sold at Sephora because I think Ulta sells like the what's it called real technique beauty blenders. And I swear they're just not the same. So I highly recommend picking up like one or two beauty blenders. I know all of mine are really, really dirty and I've been using them for like over a year now. So maybe it is time to pick up some new ones for me. I recently posted my updated makeup routine. So if you guys are interested in seeing what exact products I use, then I'll definitely link it down below in the description box. A lot of the products aren't sold at Sephora. So if you guys wanted to see some more affordable products, definitely go head over there. But this product right here is one of my favorite things to do in my makeup routine. This is the Huda Beauty Tantour Contour and Bronzer Cream. Pretty much it's like a cream that blends out into a powder and I feel like it just snatches my cheekbones so beautifully. Mine is in the color tan and it is perfect. It's like dark, but obviously you can blend it out and it's like that cool tone. So it's not too orange or red or anything like that. I definitely think that using a cream bronzer will help make it last all day because whenever I use a powdered bronzer, it just like fades like a couple of hours later. This next product is the Hourglass Ambient Lighting Powder. I'm not the biggest fan of a highlight, but I love this powder because it just gives you that glow from within. I definitely recommend this product if you guys don't love cream products because I know it is easier to have a heavier hand with cream products and powder products are just easier to blend out. Sometimes when I'm not in the mood for a super glowy look, I'll just pop some right on the tip of my nose and it gives a really nice nose highlight. So the past couple of months, I haven't really been going to crazy with my eye shadow and I've been using like the same two matte colors. And then whenever I do feel a little bit crazier, I will use this beautiful baked eye shadow from Laura Mercier. This is in the color terracotta and I feel like it is just perfect for my skin tone. And it kind of has like a rose gold brown tone. I really like this because it still allows my makeup to look a little bit more natural because it is kind of like more of a shimmer and not like a heavy glitter. So it doesn't give me like that full glam effect, but it still gives a little bit of pop to my eyes. If you guys are looking for a foundation recommendation, I really recommend anything from NARS. I love the sheer glow. I haven't used it in a while, but I know that when I did use it, I was obsessed with it. Now I'm using the Natural Radiant Longwear Foundation. I've really just been using this because this is like my palest color that I have. I usually use the L'Oreal Pro Glow Foundation, but that's just a little bit darker right now. And I didn't want to have to buy like a lighter color if I already had another foundation. I started using this foundation just because I wanted to like finish it off and get rid of it. But I'm kind of liking it now. Like I've actually been getting a lot of compliments on my IG stories asking like what foundation I'm wearing because it looks so good. So this foundation is what I've been using recently. I have two mascara recommendations for y'all. I'm going to start off with the Roller Lash from Benefit.  And the other mascara that I've been loving is this one from Tarte. I am so sorry. I did not realize this was only sold at Ulta, but I'm still going to be telling y'all about it because I really like it. So here we go. It is the Man Eater Mascara. I actually never bought this mascara. It was actually a free birthday gift. I think it was at Ulta. But I've been loving this mascara, especially in combination with the Roller Lash. This one has a straight brush, so I feel like it gives a lot of volume. To end the video, I wanted to show y'all my favorite lip product. So this one is from Fenty Beauty. This is the Fenty Glow Gloss Bomb and it is painfully empty. So I think I'm going to repurchase this gloss, even though I've been using the Glossier lip gloss. I love that gloss, but something about this gloss, I just feel so cool wearing it. And I just really like the formula when it goes onto my lips. The last products I have is the Laneige Lip Glowy Bomb. It is amazing. I think I had the peach one. I for some reason can't find it, but I know it's somewhere in my house. And I love it because it's very moisturizing. If you guys haven't tried any of the Laneige products, definitely get your hands on some during this sale. I also use the lip mask pretty regularly and I love that product too. That wraps up this video. If you guys are interested in any of these products, the direct links will be in the description below. Let me know what other products y'all are buying during this sale because I'm always trying to look for new products to try out. So I will see y'all in my next video. Bye!


So we're going to talk about unit conversions. And the first thing is just what do we mean by unit conversions? It's when you can convert from metric to metric, US to US, or you could also convert back and forth between metric and US. And there are two methods that I'm going to show you, proportions and also unit canceling, which is known more commonly as dimensional analysis. So in the first example, we're being asked to convert 150 milliliters to liters. Now I have already given you here the conversion factor, but this is something that you would have to come up with that 1,000 milliliters is equal to one liter. So starting with doing this using a proportion, I'm going to start with the question, which is we're trying to go from 150 milliliters to liters. So 150 milliliters. And then I'm trying to find liters. So I'm just going to call that x, what I'm searching for. And then we're going to set that equal to the conversion factor. Well, the conversion factor is 1,000 milliliters equals one liter. So remembering with proportions, it's really important that the units batch up. I'm going to make sure that the 1,000 milliliters is on the top, because on the left-hand side, 150 was milliliters. And in the bottom, I'm simply going to put the one liter. So again, what's in black here is simply the conversion factor. And then we're just going to cross-multiply. So 150 milliliters times one liter. And then we're going to set that equal to x times 1,000 milliliters. And then to solve for x, very simply, we're just going to divide both sides by 1,000 milliliters. And I'm going to look first off for units that will cancel out. I see I have milliliters on top and milliliters on the bottom. So on the left-hand side, I know that the unit, the only unit I'm left with is liters. And then let's multiply the top part. So 150 times one is 150. And in the denominator, I'm simply left with 1,000. And we'll come back in just a minute and simplify that further. On the right-hand side, 1,000 milliliters will cancel top and bottom. And I'm left with x, which was what I was trying to solve for. So grab in my calculator. Or you can do it in your head. 150 divided by 1,000 will give you 0.15. So I know that x is equal to 0.15. And I already have my units in place, so liters. So I know that 150 milliliters is equal to 0.15 liters. Now I'm also going to show you how to do this using dimensional analysis. So using dimensional analysis, what you do is you start with what's given, which is 150 milliliters. And basically, you're going to be multiplying that by something to get what you're looking for, which is liters. So the first thing you have to do is figure out is there a relationship between milliliters and liters, which I've already written here for you. So 1,000 milliliters is equal to one liter. Well, in dimensional analysis, your goal is to get the units to cancel. So again, I'm going to use this conversion factor, but I'm going to use it in a different way than I did with proportions. With proportions, if I had milliliters here, I had to have milliliters here. With dimensional analysis, you want your units to cancel out. So I have 1,000 milliliters. I don't want that in the numerator. I want that in the denominator. And my reason for that is I want these milliliters to cancel. There's one in the top and one in the bottom they will cancel. So that will leave me with the one liter in the numerator. So multiplying and canceling here. So first off, what can I cancel? I have milliliters in top. That will cancel with the milliliters in the bottom. And then we can just multiply straight across. If you need to, you can put the 150 milliliters over 1. But 150 times 1 liter will just give me 150 liters. And in the denominator, 1 times 1,000 is simply 1,000. And you see we're ending up in exactly the same spot we did in the last problem. And we know that 150 divided by 1,000 is going to give us 0.15 liters. So same exact scenario. Now in the next couple problems, I'll do some proportions and some dimensional analysis. So example two, we're going to do this one using a proportion. So convert five yards to feet. All right, so using a proportion, just start with initially what you have. So I have five yards. And I don't know how many feet. So yards on top, feet on the bottom. And then we're going to set that equal to the conversion factor. Well, this conversion factor is something that you should know. I already have it up here. But you should know that three feet will equal one yard. So three feet, one yard. One of them is going to go in the top, one in the bottom. With proportions, whatever is in the top has to be the same across. So I have yards in the top here. So I'm going to take that one yard and bring that with me. And then the three feet would have to go in the denominator. It would definitely not work if you flipped it. So we're going to cross multiply. So five yards times three feet equals x times one yard. And then again, to solve for x, you're simply going to divide those sides by the one yard. And when you do that, you'll have some things that will cancel. Here, the yard on the top will cancel with the one on the bottom. And you're left with, in the numerator, you're left with five times three, which is courses 15. When you divide that by one, you're still left with 15. So I'm going to go ahead and write 15. And our unit is feet. And then on the right-hand side, both of the one yards will cancel, because I have one top and bottom and I have x. So I have found that five yards is going to be the same thing as 15 feet. And again, we solved this using a proportion. Now, the third example, we'll do this one with dimensional analysis. So convert 13 miles to kilometers. And I have given you this conversion factor between miles and kilometers. You always want to start these problems by finding the factor that puts these two pieces together. I mean, that's where you need to start always. So doing this with dimensional analysis, you're going to start with what you're given, which is the 13 miles. And then you're going to be multiplying by something. And your goal here is to make sure that units will cancel top and bottom. Basically, I'm wanting miles to go away and I'm wanting the kilometers to stay. So how can I do that? Again, I'm going to use that conversion factor always. And that conversion factor have 0.62 miles equals one kilometer. If I'm trying to get rid of miles, I want miles on top and miles in the bottom. So I'm going to put the 0.62 miles in the bottom. And I'm going to put the one kilometer in the top. Again, the reason for that is to make sure that things will cancel. So if you will notice, I have miles on the bottom and top that will cancel out. And then I can simply multiply straight across. Again, if you want to, you could put this 13 over 1. So 13 times 1 kilometer is just going to be 13 kilometers. In the denominator, 1 times 0.62, of course, will give us 0.62. And then using my calculator, 13 divided by 0.62 will give me approximately 20.97 kilometers. So I know that 13 miles is approximately 20.97 kilometers. So example four, we're going to also do this one with dimensional analysis. And it has two parts to it. So we're trying to convert three feet to centimeters. So we could use a conversion that went straight from feet to centimeters. But what I'm going to do is go from feet to inches and then inches to centimeters. So you can see how to work when that requires two steps in it. So first off, I'm going to take the feet and try to convert them to inches. So I have three feet that I'm starting with. And I know with dimensional analysis that I need those units to cancel out, I'm going to use this first conversion factor, 1 foot equals 12 inches, to help me. So I know that the feet must go on the bottom because they must cancel out. The 12 inches is going to have to go in the top. So let's look at what will cancel. I know the feet in the top will cancel with the feet in the bottom. And then multiplying straight across, 3 times 12 will give me 36 inches. Dividing that by 1 doesn't change anything. So I'm going to leave that just as 36 inches. So my goal was not to find inches. My goal was to find centimeters. So I'm going to start with my 36 inches. And I'm going to see now if I can change inches into centimeters. So using my dimensional analysis, and I'm going to multiply by something, I know that I want my units to cancel. Using the second conversion factor, which says one inch is equal to 2.54 centimeters, that can possibly help me to finish the problem. So the one inch must go in the denominator so that the inches will cancel. The 2.54 centimeters will go in the numerator or the top. So what will cancel, the inches will cancel. And I'm left with centimeters, which was the whole purpose of the problem. If we multiply straight across, 36 times 2.54 will give us 91.44 centimeters. So I now know that three feet is the same thing as 91.44. And that sums up unit conversions.


What's going on everyone? Sam here with late sports cards. We've been 22, Peninimo's a football, no huddle, five box break, number 13, random team style. There's a look again at your random results. As always, you can find these on the website, under the results tab, as well as the link in chat. Good luck here, everybody. Let me take a look really quick, Jeff. I may miss that, give me one sec here. If I did, I do apologize, Jeff. Oh, I did Jeff T instead of Jeff B, that's why. My bad, Jeff. Yeah, there's only one Jeff in here, and it's Jeff B, and I did Jeff T accidentally, so I apologize on that one, Jeff. So you've got the Falcons, got the Falcons. So again, I'll come over here, I will go and edit that. There you go, Jeff B with the Falcons.  Let me go and edit the results really quick. You might have to reprint that, I apologize. Sorry about that, Jeff. They are now updated, so you have Jeff B with the Falcons. So good luck, let's do it, guys. I mean, yeah, you could write it down there if you want. Why are we doing the video? All right, because I like seeing, I like just watching the world burn, that's why. I like watching the world burn, darling. Sorry about that, Jeff, again, my bad. That'll happen when you type in a bunch of randoms every now and then, you'll miss a... No excuses. No, you'll just, you'll miss it sometimes. You guys. Don't even have mosaic. Don't do that to yourself, it's a bearer, though. You'll miss a letter here and there happens.   Contrary to the beliefs of what people say about us. There's Silver, is Cooper Cup, and Disco, Deck Prescott. I thought your low oil light might have been on. Yeah, no, that's probably what it was. Yeah, Rich didn't program me to correctly do the random, unfortunately. Mar... DeMonte Adams, Disco. Disco, David and Jokey. Blue Tom Brady, 59 out of 75. There you go, congrats on that Tampa. John S, nice one there, buddy. Obviously hurts your MVP. I can see it. Might be my home, so. Yeah, my home's as well. Let somebody else win it. There's going to the Falcons, it's a 75. There you go, Jeff, that is AJ Turrell. Lockdown corner, so good. Got a John, no problem there. Jahan Dotson. Silver, Triple Hubbard. And Christian Kirk, Mosaic. Or not, Disco, not Mosaic. Disco. So we can recap it, yes sir, Steelman, there you go. David Bell on the purple, the 50, nice one there. We're affecting the chat, oh no. Yep, yeah, we are Donald. Yes we are, Daniel.  I'll throw a top loader at you. There's Elijah Moore, nice one there. They got a lot of ammunition over here, Sam. Two top ratings, one up 10, there you go, that's not bad at all, Manny. Really guilless, debut rookie. Silver Drake London, he got London on the track right there. And AOPR, you want to come out here? Pierre Strong Jr., back-to-back producer. Rookie's there, it's like we do have our auto coming up now. What's up, Frederick? That's going to be Wes Welker for the Patriots. There's no huddle-auto, nice one there, Pats. New England is going to be Paul N., there you go Paul, congrats buddy. Mosaic, sauce gardener on the back, Rookie for the Jets. Appreciate you fresh, yeah, it's going well man, no complaints here, no complaints here at all. Purple Tyler Lockett, nice one there too, 50 for the Seahawks. Right there, right there. Bree Saul, variation, yep, variation Rookie Disco and Disco, Travis E.T. on the second year. You know, the bad thing is Chat's going to supply you with more that you probably don't think of.  Chat's not going to help the pause here. Yeah, Donnie, what Marie column did you have for dinner tonight? I don't have a Marie column there, and that's forever, because you know. So what happened with that?  Really, that's the reason you stopped eating that? No, I just got tired of it. Also, I don't gross your shop like I should. With you on that one, buddy. Can I pick it, Rookie? Disco Derek Henry, Disco DJ more? Wawa has, yeah, I contributed a lot of my paychecks to the Wawa lately. I don't see that ending anytime soon. They got you in a choke hold right now, Kyle Pitt Silver, and there's a Herschel Walker Disco. They really do, like it's one of the things like us working at night, like once we get off work, nothing's open, so we can't go grocery shopping or anything, and then. Like Willis, Rookie? Like, I don't know about Sam. There's blue slant man to 75, 59 out of 75. I don't know about Sam, but like, I don't want to go grocery shopping before work. Like, when I leave my house, I'm going to work.  So like. There's blue, Justin Herbert, nice one there for the Charger, 72 out of 75. You got, yeah, he did get a call. Donnie's moved on to a straight extra ranch only diet. Ooh, Honeycomb coming up, good luck everybody. Means there might be a case hit in this box then. We've got Honeycomb, Robert Quinn, going to the Bears, nice one there on the case hits. Congrats on that Bears, nice one there. Richard W on the Honeycomb. Probably, yeah, steel man, that's probably a fake. Either fake or they just don't understand cards. Yeah, could be that too. I can't imagine someone who owns a Josh Allen Kaboom Gold to 10 that's gonna not know cards though. Yeah, true. Silver Matt Corral, Devante Adams, Disco. They could be looking like in a Beckett Price Guide from like 2010 or 2000 when Josh Allen wasn't even. Kenny Pickett Blue Chips, there's a Tyler Algier Purple, nice one there, 12 out of 50. Grats on that Falcons. That's solid, congrats on that Jeff. There you go, buddy. Yeah, I didn't need it, true. True, got some Ritter introductions. There's a Howie Long Pink, 20 of 20, nice one there for the Raiders. George Y on the combo spot. Man, Lakers are choking, they have a lead now he's choking a little bit. There's a little Ron shoot on me. That is Shraylon Burks, there's a Danny Gray, Variation Disco, Jair Alexander Disco. Alger is ripped, dude. You can throw that Honeycomb in the recap. I meant to tell you that, I forgot all about it. Silver, Jay Jedis, and Josh Pascal, Disco, Rookie. Tommy, Sam, we're gonna be better. Yeah, man. Good Fredericks. What did Fredericks say? Don, I just wanted to tell you that I really appreciate your sub on my channel. Oh, no problem, man. Yeah, sorry, I didn't come through on Restream, sorry, Frederick. I haven't got a chance to look at the content yet, but I'll get there. Darnell Mooney, nice one there, no huddle auto for the Bears, Bears doing well now. Mosaic, Justin Fields, add that in as well. Yeah, maybe not, honestly, maybe he's the old man. Ugh, Barry Sanders. Rajmonte, there's a Chris O'Lave, Mosaic, Rookie for the Saints. This one there. A little detail, I was expecting it. Shit, someone asked to analyze that guy. There it is. Someone needs to do something, man. I don't like what I'm seeing. There's Purple, Hunter Henry, 250. Derek Stingley, Jr., variation, nice one there, and Kyle Pitts, disco. Is it easy for people to duplicate cards? I'm sure it is, I'm sure it can't be that hard. Yeah, probably. Kind of hard, I imagine. There's Johan Dotson, remember class that we said about projection. There's Pink, Khalil Mack, three of 20, nice one there for the Chargers. Yeah, you got the top loaders that break every time you try to slide a card. Classic, classic top loader. Just want to slow me down. Yep, they don't want to see you cook, Donnie. Silver Chase Claypool, Logan Hall, disco, Rookie for the Bucks. No, Purdy is in this set, yeah. Purdy's got autos and he is in this set. You guys are watching a funny Purdy skit or video. Check out our TikTok. True, yeah. Cam Taylor Britt, there's a Isaiah Spiller, going, no, how to auto, go to the Chargers, nice one there, Matthew M. Stavon Diggs, that's best in the world thing. If you could make an AI that's best in the world at one thing, what would it be? Probably something to do with money, getting money, a lot of money very quickly. There is Silver Chuba Hubbard and Christian Kirk on the disco. He might not have autos in this, like he's in this set, he's in a base set. But yeah, he might be right for it, he might not have autos in this. Can he pick it debut? There's Blue, Jalen Hertz, nice one there. Three out of 75. Save those broken toppers and put them in the IOU rich box. Yeah, every top holder you break, you have to replace. You know that, right? Silver Trent Williams, nice one there. They read that one kind of drive. There's Drew Brees, an AI that's making good at making Burger King jingle remixes. We already have that apparently. Yes, we do. Someone may have beat you to that already, poorest. That's Davis Mills to 75 for the taxons. I would just make Jarvis, essentially. Metamastry Russell Wilson, disco, Hock, The Lines. Hock and Tox. What is that? Hock and Tox. That's Cameron Hayward, disco for the Steelers. Would you rank Burger King fries out of? Hmm, that's a good question, Manny. They're not the worst, but they're thick. Burger King's got some thick fries. They do, yeah. They're not bad, actually. My experience of Burger King fries, like they're never really crispy. No, they really aren't, unless you get them like right off the fryer. Yeah, yeah, so I don't remember. There's Blue, Xavier McKinney, nice one there. Two, 75. Who would definitely rank them below the D's and McDonald's? Blue, John L.A., nice one there. Two, 75 for the Broncos. Donnie said if the stream gets 100 likes, he'll buy into the Super Bowl mixer. I'll try, but it's not the worst. There's John Doxon variation. And Anquan Bolden, disco. I would have described PK fries as stale. Caleb said he's buying into the Super Bowl mixer. Silver, Ryan Tanehill. Damien Pierce, disco. Doesn't KFC have wedges? Like they're not really fries, what do they have wedges? They used to, they don't anymore, though. That's one of the biggest downgrades in fast food dishes. I haven't been to the KFC in a bit. They're not horrible or just not good. The wedge is cleared. I like Popeyes. David Bell on the No Huddle Auto for the Browns, nice one there. You got to cleave one. No, I want Popeyes. Same, dude. Transward, Mosaic. They're closed. Yeah, they are. They've been closed. They're closed, too. I'll do that? Yeah, I think so. That's Harrison Smith, Mosaic. God, support the team. Just appreciate it, it's dropping that sub. Wow, who's? Silver, Josh Allen. Radiant Charizard. I don't know how the end of the year went. I don't know how the end of the year went. You're like more, whoo, whoo, whoo, whoo, whoo. There's Derek Hart. I got a good giggle to it. There's Jared Goff as well. Interview for gaming and just do that. Josh, Josh Allen, 11 out of 20. Nice one there. They'll be like, sure, you're hired. Welcome aboard on the board. Welcome aboard is right. I'll have a great resume if I can do this. You're hired. Purple, Damien Pierce. Nice one there, 18 out of 50, going to the Texans.  Like one of the Boston Celtic players like do a step back and just shove the lake around the ground. Oh, another honeycomb. Can I pick it? Another honeycomb, Patriot honeycomb. Brady. Could be. Well, basically is Bailey Zappy on the honeycomb. Going to the Patriots. Paul N, congrats, buddy. You can recap eat a Zappy, baby. There we go. Nice Zappy. Congrats on that, Paul. We'll get that into a Mac for you, buddy. That was a good cereal, honeycomb. So what happened to those? They're still around. Are they? Yeah. I might get some next time. There is Silver Darius Slech and Trevor Lawrence. Honeycombs is in a cereal where I could have it all the time, but it is good from like. Yeah, I feel like from time to time, yeah. It's not like something I'm going to have to get every week and religiously eat, but it's like a good little change of pace. Right. Like Cocoa Pasta, like Cinnamon Toast Crunch, I can eat every day. Oh, 100%. That's great. But honeycombs like, that's good. Honeycombs are your regular von, really? That's. That's a little strange. Nice. Now with Tom Brady Purple Jersey number 12 of 50. Going to Paul with the Patriots. Congrats, buddy. That's nasty, dude. Nice Brady, 12 of 50. Two big Jersey numbers today. We'll mag that up for you. Congrats on that, Paul. Paul doing well with that Pat spot, man. eBay one of one. eBay one of one. That is. Oh, it's Patriot Unity. Yeah, Patriot Unity, exactly. Jermaine Johnson variation for the Jets as well as the Dawson Knox. The other Brady wasn't Patriot, was it? No, it was Bucks. Okay. I don't like the cereals that are too sweet or have too much flavor. Good God. Is that the point of cereal? That guy needs help. T Higgins, cold now. That's 10 of 10 going to the bangles. Nice one there. Oh, 100%. Jersey numbers matters to anyone. It's Tom Brady collectors for sure. Von needs help, dude. My name's Von and I enjoy, I enjoy kick cereal from time to time. Hi, Von. There's Silver, Kyle Hamilton for the Ravens. Lamar Jackson, National Pride Ravens again. Corn bran crunch. Bonnie's oat bran in water. Oh, God. That sounds gross. Brock Purdy rookie, there he is. Silver, Samir White rookie. Well, you guys ever have pops? And Erica Zupkanma, yeah. Corn pops. I don't like it. They're actually pretty decent. They're like no flavor to me. Like it's like, okay, I don't... Same with Cheerios, get your Cheerios. Yeah, they're just, they don't really taste like anything. Jerry Rice, and Jonathan Greenert, Disco. Rice Krispies, Cheerios, Honey Combs, they're nice. Yeah, yeah, that's not a bad line up of cereals, to be honest, though. I like Honey Combs. I do really like, do like Honey Combs. There's Kenny Pickett. I'm gonna get something. Next time I have to store, I'm getting Honey Combs. I think Von just likes the yellow cereal. I guess so. Now, Bailey Zappy Blue, 58 out of 75. What a break right now for the Patriots, man. Dude, Golden Grams, maybe the worst cereal of all time. I actually don't like it. Golden Grams do not clear. Golden Grams stink. I don't like it. They stink. They stink. And anybody who likes them also stinks. Robbie Anderson, Panthers look. Marquez Valdes, Scantling, Disco. Raisin' Bran, above all others. No, another one right there. I've tried it. You can send that half-accurate request to refund. There's a Blue, 11 out of 75, Hunter Henry. Dude, Golden Grams are not good. They're not bad. I don't, I don't like, they're not good. Like, that is not a good cereal. They're not that bad, though. I think you're overdoing it. They stink, dude. They stink. You stink, Sam. You shouldn't really stink. You stink. Leonard Fournette on the Disco. They stink. No, they stink. They're bad and they stink.  That's fine. I stand behind that one. TJ Hawkinson on the auto. Nice one there for the Lions. There's Jamal Adams. No, she does not. No, she does not, manny. And Chips Ahoy cookies are great. Don't care. Stand behind it. See, I can agree with that. They're good, but. See, Donnie likes, Donnie likes Chips Ahoy. There you go. But, okay, so. That's a respectable take. Mitchell Trebisky, nice one there. I got the gold ring. All right, I take it back about Golden Grand. Donnie will defend me with, what's it called, with Chips Ahoy, then I will ease it, ease it back on Golden Grand. The legal, I got your back, man. Honeycomb, Robert Quinn. TJ Hawkinson, Lions. David Bell, Browns. Isaiah Spillard, Chargers. Darnell Mooney, Bears. Wes Welker, Patriots. We had a Honeycomb Bailey, Zappy. Nice one there. And Tom Brady, purple 12 out of 50 jersey number. That will do it for the break. Thank you guys again for the fill. Next up, another one.


Okay. And now very, very briefly, I want to talk a little bit about Anatorias. So, Bernard and I, we've been working with each other for a couple of years now. And without going into the details of sort of the history of those two projects, everything started in a research project funded by the EU, and that was sort of the common source for both MAPUP and the other project called Anatorias. So, this is basically what we salvaged from the prototype that we built then.  So, that was the idea behind Anatorias as a second spin-off of this original open source tool that we built as part of the European Connect project. So, as I said, it's not a tool, it's a library. So, it adds annotation functionality to existing pages, and it's an ongoing open source project. It's on GitHub. I'm going to show the URL in the end. It's LGPL licensed, so that means it's also safe to use for commercial projects, non-commercial projects, whatever. And it doesn't really have that many features attached to it, but the focus was here to make it simple to include it in a web page. So, basically what you need to do is... Oh, sorry. Basically what you need to do is you just add a style sheet, you add the JavaScript file, and then you don't even need to write your own JavaScript code to make images annotatable, but you just use... So, there's a shortcut. You add a custom CSS class, and when the page loads, Anatorias itself scans the page for pages that were sort of annotated with this class and makes them annotatable. And what happens then is you get a little drawing tool, and I have a short screencast. So, as I said, nothing too fancy, but with minimum effort, you get a little drawing tool. You get a pop-up box. You can start to write your free text annotations and save it.  You can edit an existing annotation. You can delete it. So, that's bare minimum thing with minimum effort from the side of the developer. Also, as you saw in Map-Up, you can also do polygon selections. That's a bit of an alpha feature, and you don't really find documentation on that yet, so it's not 100% ready for primetime. But, again, it's going to be one of the next releases. Simple polygon drawing tool. And, again, you don't need to actually write your own JavaScript on your own page to do it.  Yeah, so in one of the next releases, not necessarily the next release. Because the next one is probably going to be focused on zoomable images, which is also a key feature for maps. So, you can have those zoomable images, and the annotation attaches to the zoomable image. So, what else is in there? As I said, it has a JavaScript API to build your own mashups. It has a plug-in framework so you can extend Annotorious. Of course, being a library, it's by definition embeddable. So, there's also things like code that embeds Annotorious seamlessly into Annotator, for example. Also, there's a WordPress plug-in coming up really soon. And also, we're looking into extending it to support other media types, as I said, zoomable images, but potentially also audio would be interesting. Yeah, so that's it. By all means, visit us. We are both on GitHub with MapHub as well as Annotorious. And, yeah, that's it.