Alright Defcon, we're gonna make this fast this is a short talk so I'm going to just uh get them rolling please come in and find a seat um and uh enjoy your talk without further ado this is haystack and six volts uh let's give them a round of applause. Alright go guys. Hi there I'm six volts. And I'm haystack. I'm haystack. And we're gonna be talking about cheap tools for heavy trucks. So there's a lot of differences between cars and heavy trucks and we're gonna be talking about some of those. We're also gonna be talking about the R&D problems we face and how we got around them. And uh we're also gonna do some very preliminary stuff about uh networking protocols and standards uh there's a lot to go over so we're just gonna dump it all in a white paper for you to read if you really care that much. Uh we're also gonna go over a new hardware tool that we built uh that should save you some money if you want to start getting in into truck hacking and also go over some some light truck hacking adventures uh that we've had. Some quick some quick notes we're going to assume you're familiar with basic vehicle networking if you're not Google it um we assume you're familiar with the idea that if you get on the can bus you can do bad things. We are leaving out lots of details that are gonna be in the white paper um check the get hub by the end of the week um and a safety disclaimer if you hook up to a truck and start fuzzing it while it's moving bad things could happen don't do that we're not responsible if you do. We have done that do as we say not as we do. So uh trucks as we talk about them are really any big anything with a big diesel engine in it uh the thing that most people are familiar with are semi trucks uh class 8 over the road vehicles but also dump trucks rackers um marine engines generator uh big generators uh agricultural equipment anything like that is all gonna work largely the same way and is gonna be made by the same people.  So many of the components that are in trucks uh have to be interchangeable so you can get a Peterbilt truck with uh a Pacar engine or with a Cummins engine and he used to be able to get one with a Cat engine um so that all of those parts have to work interoperably like the the brake controllers from different vendors the engines the transmissions. So they they've had to agree to this standard so that all the electronics can speak to each other and the truck can actually work. So one of the major differences with heavy trucks is uh if you do anything with passenger vehicles a big part of your job is reverse engineering the protocol because every manufacturer has their own thing uh with heavy trucks with big diesels uh that's all been decided upon by the Society of Automotive Engineers beforehand and it saves you a lot of time uh so you may have read something in Wired recently those guys just took a standard and injected traffic and sure enough they were able to cause unintended braking and acceleration. So we're gonna talk a little bit about the telematics attack surface. Most heavy trucks that are out on the road in a fleet have a dash mounted touchscreen that controls the driver's logs navigation gives them a way to communicate with the fleet uh kind of like email and in in emergencies contacts the fleet and allows the the truck driver to talk back to them. Um they use the cellular network to connect to the uh telematics provider and the fleet and these devices connect directly to the can in J 1939 bus um also the the legacy 1708 many of them run embedded versions of windows like Windows CE or XP embedded um that's kind of scary to me uh yeah we've we've had some luck with rooting them by doing things like popping an SD card out of the back uh so a big problem that we had when we started getting into this is uh trucks are expensive a uh so like a freight line or Cascadia something like that can cost over a hundred grand um ouch I do not have that kind of money uh for the expo and for the aspiring hacker even if you were rich they are big hard to store hard to drive uh I can drive a five speed a six speed a one down four up speed uh but I can't drive a 14 speed um and uh they're also expensive to operate uh so we we didn't have one and we still don't we're trying to get one uh so how do we experiment uh we built this thing we call this the truck in the box so this is a bunch of components out of a heavy truck um the engine control module the instrument cluster there's a couple other things hiding in the back there are a power distribution unit and uh national instrument C Rio we put using that but and then the knobs are a bunch of uh potentiometers for six for sensors um the first one took about six months to build and cost about ten thousand dollars but that's still thanks DARPA but that's still a lot cheaper than the cost of a truck um since then we've built over a dozen of those full sized ones for different uh trucks and engines um we later compressed the concept into the size of a circuit board but that's not pretty so we're not going to show it off uh so the concepts of the truck in a box um we wanted to recreate the vehicle networks including uh J 1939 and J 17 08 J 19 39 is built on can J 17 08 is kind of RS 485 it's similar to J 18 50 um it it also fakes passive uh sensor signals so uh usually oil pressure sensors and temperature sensors and things are just uh they just measure voltage or resistance and ECMs uh the engine control module tends to freak out if those things aren't present aren't present so we're just trying to keep it from freaking out some of the more complicated signals are things like the accelerator pedal and the uh the way the the vehicle measures its road speed this is the uh uh tone ring that's on the back of the tail shaft underneath the truck um on the left here we've got the actual sensor and that tone ring spins past that sensor generating a magnetic field so we we hooked one up in a in a vice and put the sensor next to it and then you get this kind of signal so we can re re that signal figure out characterize it and then play it back to the ECM and we can actually put miles in the truck on a bench so I already talked a little bit about the two main uh networking protocols and uh the J 17 08 like I said it's RS 485 ish 9600 BOD uh there's some slight transceiver differences and then there's also another SAE standard called J 15 87 that specifies everything all the way up to the application layer uh J 19 39 is similar but it's built on 250 K can uh if you're into this you know the passenger cars are 500 K uh we also see ISO 15 765 but only for diagnostic comms uh details in white paper like all the different protocol details if you wanted to write your own implementation uh we should be we should we should be able to give you enough information to do that so for J 17 08 the older protocol messages are timed to limited and you've got these things called mids and PIDs the mid is is uh analogous to the can ID it's the first byte and it tells you who on the network is talking and the PID uh is comes right before any data uh on the in in a message and it comes so PIDs and data come after the mid and unpacking those PIDs in the data is how you figure out what messages say uh mostly older trucks uh will have only J 17 08 uh there was a period where they they would have the both networks J 15 87 and J 19 39 at the same time uh some newer ones will have components that use it uh and then also there are these things called gliders uh if if you're a hot rod builder you know it is a rolling chassis people will will order um a truck with no motor in it and the reason is is because uh emissions regulations go by the date of manufacture of the motor and not the date of the truck so they will have everything but the motor made and these things will last for two million miles pretty easily so they'll put the older motor in it so you may see new trucks with old networks and old engines in them. So J 19 39 is the newer protocol and it's based on 250 K can it's got extended IDs that are 29 bits long instead of 11 bit long IDs like a like a run cars um sometimes they they have some basic specs for source and destination but those aren't enforced um there's address management there's a transport layer message for augmentation there's about a dozen different documents that are you can read through that are published by SAE but they're all kind of thick. There's a couple of uh parameter group numbers that's just like a message type that are reserved for proprietary communications and those are the fun ones. And then also um there's the vehicle diagnostic link connector which is called a DLC or a DLA uh this industry is tail terrible at acronyms so there's always like five acronyms for the same thing uh it's similar to an OBD two scan tool in a passenger car also it's OBD on board diagnostics like O not ODB who is a founding member of the Wu Tang clan people mess that up constantly and it drives me a little nuts um it's basically a USB uh slash serial slash slash ethernet uh to J 19 39 to J 17 await bridge these things are incredibly over priced they come at like seven or eight hundred dollars and it's seriously just like I converted one thing into another thing and it's two chips that they bought from someone else and soldered them onto a board um the uh the RP 1210 is a standard that governs functions exposed by their drivers so observing those driver calls is an excellent strategy for dynamic analysis of OEM software because they're always the same name and they always have the same arguments in the same format so you can sort of get a running analysis of what the different software packages are doing at various stages of ECM interaction so we're releasing a new tool called the truck duck it's a cape for the beagle bone it gives you two can channels and two J 17 await channels so you can do things like message filtering recording simulating an ECU uh we've also got a custom OS image with the J 19 39 kernel extensions built in uh and then he haystack wrote some stuff for uh using it in python he's also written a J 17 0 8 implementation in the beagle bones PRU which is amazing they're like little built in microcontrollers on the thing and uh this is what it looks like um over on the the right hand side I've got the diagnostic link connector that's the big DB 15 um two screw terminals as the green guys and then uh it's got the power circuitry so that you can power it from the bus so a uh another thing that that we released is uh an RP 12 10 tracer so for a while uh when we would reverse engineer with the what uh these software packages were doing and when we were trying to reverse engineer the proprietary protocols the best option was to buy a diagnostic link connector whose driver has debug logging capability so you would flip a little switch in the in the driver software and it would say you know I sent this received this received this sent this um the only no one the only one we know of cost seven hundred dollars it's like the Cadillac of DLCs uh that can be a lot of money for some people especially if you're just doing bench testing on an ECM that you've got at a junk yard someplace like us um and then I rolled a uh an RP 12 10 API tracer that logs results of RP 12 10 function calls so you're not dependent on the Cadillac of DLCs anymore and uh it works with any of them including the cheap eBay clones uh for all two weeks that they work and uh it allows you to decrypt and translate on the fly and when we get kind of into the uh what we did with this stuff section uh you'll see that a little bit um but what is it good for like all that stuff I just went through uh all that in a buck will get you a cup of coffee uh like 10 years ago so you know what what can you actually do with this um we wanted so we we wanted an attack and we wanted to have a viable attack that could actually have some conceivable impact in the real world uh but we didn't have a truck so this this presents an issue if you're not driving something it's very difficult to tell when breaks are applied when you have no actual breaks uh so we needed something that we could do in vitro and uh the solution was malicious ECM misconfiguration so reverse engineer the protocol um yeah reverse engineer the protocol and then model send messages using that protocol to uh to misconfigure the ECM um so most of the parameter configuration is done over proprietary protocol extensions um we promise not to give too many specifics out um so that you can't do very bad things to trucks that are on the road because that would be pretty dangerous um we're going to give a demonstration of what is possible with the the truck duck and the APTREI tracing so this is some proprietary traffic you can see the the messages here I'll point Utah so we can see the the the FE there in the middle that that indicates that this is a proprietary message and that that's what you really want to look for and the message down at the bottom is just uh something regular fooling across the bus so initial notes from analysis of this protocol um the same process clicking the same buttons in the software yield yielded uh different network traffic every time so this stuff was actually obfuscated slash encrypted um which which is kind of unusual a lot of the different manufacturers including uh newer ECMs this was a very old one uh they're not encrypted or or disguised in any way um messages that appear to do the same thing or the same length so it's not too obfuscated no one's like padding to a block length and then doing stuff it it's it's simpler and uh this is where I yada yada yada passed a bunch of static analysis I did with dot peak and Ida because this is Defcon and I don't want to try to teach pros how to use dot peak and Ida so after um after doing static analysis I figured out that uh what the bytes after the first three are the first three are specified by SAE uh the first byte first byte is the source the second byte says hey this is proprietary and it's interesting the third byte says this is the destination in this case this is the DLC talking to the engine this next code is proprietary and that's a security setup and then that this low nibble over here uh on both ends these are kind of degenerate keys there there's obviously not a whole lot of entropy in a four bit key but that's what they got and uh that so they they pre-share that uh in order to carry out the the rest of the protocol. So then there uh I found other command codes so this high nibble uh F was the security setup D is an encrypted write C is an encrypted read and then E is an encrypted read write response so no matter if it's responding to a write or a read it's going to be uh that that that's gonna be the format of the reply. The low nibble is the message code and then there's this little formula where you take the pre-shared four bit super high entropy key add it to the code in the message mod four and it indexes into a character array uh that's buried in a DLL someplace and then you just X sort with everything so it's X sort encryption made slightly less bad. So then uh after we decrypt it I modified the RP-1210 API tracer to decrypt all this on the fly and then the uh the pattern became a lot more uh a lot more comprehensible you can see that it's just a very standard call and response type protocol where you have a PID and then it says hey you know six zero I want to see that and then you get a bunch of ASCII characters I'd have to look up what that is honestly. And so uh what could we do with this? So now that now that we have this this degenerate encryption algorithm and we we know the PIDs and we can trace this stuff um if we get on the bus we can set parameters in the ECM. So uh the one that we chose was uh hard vehicle speed limit so uh the governors in heavy trucks are just a bite that you that you write and so we thought hey wouldn't it be cool if you just like froze a semi truck at only being able to go 30 miles an hour. But that's that's still kind of boring because if you can get on the bus physically if you can get physical access you can just cut the break lines. Um you you could compromise a telematics unit and then have it send these uh these messages during a key on engine off condition but we wanted we wanted to do a little bit more. So then uh hijacking OEM software uh software is used in day to day operations of the fleet um all that we've talked about fleets being data hungry before uh and as a result they are pulling data off these ECMs after every trip in in many cases and uh that data uh or when so they're always pulling this data and so unlike where your passenger car or unless you're throwing a check engine light and the dealerships putting it on a scanner um these things are interacting with software all the time and so there are a lot of uh opportunities for things to change. So I repurposed the API tracer um so instead of just decrypting and logging things on the fly uh modifying re-encrypting and writing so let's see what that looks like. Um this is a screencast because showing the full ECM would give away the brand and I'm really bad at video editing also I'm very sorry about the free version trademark this stuff is expensive and this is on my own dime. Okay so at the beginning I started the kind of degenerate truck root kit. I very artfully blacked out the manufacturer uh logo. This protocol is very slow so I'm gonna try to patter a little bit while while it's getting set up. So here you can see that the uh the vehicle speed was at fifty five miles an hour our hypothetical technician knows his drivers can't drive fifty five so he decides to bump it up to seventy and as far as anyone can tell uh that that went fine it was set to seventy miles an hour and then after disconnecting we go and check and make sure that uh that the truck mangler program is dead and then so we actually see what happened and again we wait for the slowest vehicle protocol in the world. For those who didn't hear the joke he made Lin is in fact very slow but there so you know we can see that in fact it was actually set to thirty miles an hour and this guy would have gotten about a mile down the road and uh and and then would have had to realize that he had to turn back and if you if you manage to keep this running and get persistence um there would be no way to tell so they would be checking mechanical issues over and over so I think this is a very viable uh attack with real impact. So for future work we're gonna work on writing an rp 1210 driver for the truck duck to allow easier traffic modification it's even cheaper than some of the ebay adapter clones that you can get um we also wanna work on making the PC side attack a little more interesting so that the technician doesn't have to actually modify a parameter it can just do it once they connect to the truck um we would really love to do some deeper firmware analysis on ECMs you know pull some chips read some data and do some static analysis um we'll be in the harbor hacking village and car hacking village if you have any questions um we'll also have an ECM and a bunch of live demos of this stuff so it's not just a stupid screen cast with a watermark on it you can actually play with with uh with this technology. Thank you very much.


So, hi everyone, so I'm going to present a general proposal with Ardun Kulman. So you all know the blockchain, you all know the proof of work and there's an ongoing concern about the fact that proof of work are difficult to produce and you're going to solve a challenge that's more or less useless in the sense that finding a nonce so that for a fixed prefix the hash of the nonce and the prefix is going to have enough zero that's not really helpful and so that's a waste of time and energy and also what you do is reference only the previous block so if for some reason this block is dropped all your work is for nothing so what we are proposing is proof of ability. So proof of ability the interesting idea is that the challenge is going to be any open cryptographic problem so that if you solve it in some way you are contributing to science that's great you don't want we don't want to have a linear flow you are going to reference several previous blocks so that's even if one of those block fails you're still going to exist and that's going to end when there are no new crypto problems so hopefully not soon and that's nice every time you solve a problem you are going to create one or more new problems so normally it's never going to end so how are we going to do that in fact the solution already exists so proof of ability is going to be something that can fit into roughly 30 pages you can use unlimited data appendices that nobody is going to read and you can in fact ignore them then those proofs you're going to bundle them together because that's nice and you are going to want to proceed them so that you're going to go that some proceedings and you want to publish them so we're going to use a deputy publisher so if you that's an authority so if you translate it into German you're going to end up on Springer Ferdag and now that we've gone paperless for the proceeding we can produce light written odyssey of cryptography solutions so the famous LNCS series so that's quite nice you produce one new block every year but you are going to be able to run several blockchain concurrently so you can do cross-reference between the block and the blockchain so that's quite a neat feature so however that's still a work in progress so there are still many improvements that we can do so in the crude models there's no really direct reward for the block reviewers and in fact it's only the publishers that's getting all the credit and literally the credit behind the payroll the variability sometimes should be improved because some of the block and are going to be dropped and one of the main question is how many blocks should we wait before considering that the block is going to be secure and one of the work that's still going to be that's can still be debated is are the program committees like proof of cryptographic stake and which community is going to win the next conference so I hope you paid attention during the revisions there has been some reference from new block generation and don't forget to submit and contribute to the great crypto blockchain thank you


Hello everyone. In the last two videos we have discussed about the definitions and some examples. In this video also we will consider few more examples. The learning outcome of this lesson is at the end of this session students will be able to verify CR equations and analyticity of a given complex valued function. Consider the example. Verify f of z equal to e raised to z is analytic or not. Solution. Write the given function f of z as u plus i v and it is given as e raised to z and we know that z equal to x plus i y. Therefore replacing this z by the expression x plus i y we get it as e raised to x plus i y. That is u plus i v equal to again we are knowing the property of the exponential that e raised to a plus b can be written as e raised to a into e raised to b. After using this identity here we get e raised to x plus i y as e raised to x into e raised to i y. Again we are knowing that e raised to i theta can be written in the complex number form cos of theta plus i sin theta. Applying this result for this e raised to i y we get e raised to x into cos y plus i sin y. Let us multiply by e raised to x to this bracket we get it as e raised to x into cos y plus i into e raised to x into sin y. Now let us equate real and imaginary parts from the both sides we get u equal to e raised to x into cos y and v equal to e raised to x into sin y. Now this is the u and v. Now in order to check whether the given function is analytic or not we will discuss the sufficient condition for the analyticity. The first condition is Cauchy-Riemann equations. Now in order to have the Cauchy-Riemann equations let us differentiate this u partially with respect to x and y. Now we will denote in short the partial derivative of u with respect to x as the symbol u x. Now here while differentiating partially with respect to x we have to treat y constant for this cos y is constant and the derivative of e raised to x is e raised to x itself. Again differentiating u partially with respect to y we get as we are differentiating with respect to y x we have to treat constant. So e raised to x as it is and the derivative of cos y is minus sin y and the final answer is minus e raised to x into sin y. Similarly the partial derivative of v with respect to x that is vx is equal to e raised to x into sin y and the partial derivative of v with respect to y is obtained as e raised to x into cos y. Now here we can see that ux and vy are having the same expression e raised to x into cos y. Therefore we can write ux equal to vy and it is equal to e raised to x into cos y. Again we can see that uy and vx both are equal there is difference between the sin only.  Now from these two equalities we can say that the given function satisfies CR equations. Now let us consider the second condition that is the continuity of these four partial derivatives. Now these are the partial derivatives. Now we can see that exponential cos and sin are continuous functions. And again we know that the product of continuous functions is again a continuous function. By using this property here we can see that all these four derivatives are obtained in terms of the product of the continuous functions. So obviously all the partial derivatives are continuous conditions of sufficient one are satisfied. Therefore we can say that the given function f of z equal to e raised to z is analytic everywhere. That is we can say that it is the entire function. Now pause this video and verify the analyticity of the function f of z equal to mod z square. I hope all of you have written an answer. Now the problem is to check the function mod z square is analytic or not. Let us denote this function by f of z which has the expression u plus iv. And we know that z is a complex number and it has the form x plus iv. And the meaning of this symbol is the modulus of z. And it is defined as under root of x square plus y square. That is under root of square of the real part plus square of the imaginary part. Now we can insert a bracket and square and the definition of mod z is root of x square plus y square. And square of a square root is this expression itself x square plus y square. Now here we can see that this f of z here we have obtained as a real valued function. And we know that every real valued function can be written as a complex valued function by writing plus i into 0 as the imaginary part. Now it will look like a complex valued function. Now let us compare the real and imaginary parts from the both sides. We get the real part u equal to x square plus y square and the imaginary part v equal to 0. In order to check the analyticity of given function, let us use the sufficient condition. The first condition is of CR equations. Now let us differentiate this u partially with respect to x treating y constant. We get it as ux equal to the derivative of x square is 2x and as y constant its derivative is 0. Again differentiating this u partially with respect to y treating x constant. Now the derivative of x is 0 and the derivative of y square is 2y. As v is 0 so obviously the partial derivative of this v with respect to x as well as y both are 0. Now here we can see that this ux and vy, ux is 2x and vy is 0 and uy is 2y and vx is 0. They are not equal. As the CR equations are not satisfied but for the analyticity of any function CR equation is the necessary one. Therefore as the necessary condition fails here we can say that f of z is not analytic at any point in a given complex plane. And those functions which are not analytic at a single point in a complex plane such functions are called as nowhere analytic. Therefore the given function f of z is nowhere analytic. Let us consider one more example. Determine whether 1 upon z is analytic or not. Let us denote the given function by f of z which has the form u plus iv and it is equal to 1 upon z. Now it will implies that u plus iv equal to we know that z is nothing but x plus iv. Now this is not looks like in a complex function form. So we will convert it to a complex function form by multiplying and dividing by the conjugate of this denominator complex form. The conjugate of this denominator is x minus iv. Let us multiply by x minus iv and divide by this x minus iv. We get it as x minus iv upon. Again we know that the product of a complex number and its conjugate is nothing but the sum of the square of its real part and the imaginary part. That is we get it as x square plus y square. Let us separate it from the numerator.  Let us equate the real and imaginary part. We get u equal to x upon x square plus y square. We equal to minus y upon x square plus y square. Again to check the analyticity we are first of all checking the CR equations. To check the CR equations let us differentiate this u partially with respect to x. We get dou u by dou x and it is equal to. Now here we can see that u is we have obtained in terms of a rational function. And this rational function can be differentiated by using quotient rule as x is involved in the numerator and denominator. So, writing denominator as it is and differentiating numerator partially with respect to x. We get it as 1 minus numerator x as it is and the derivative of denominator is 2x divided by square of the denominator. That is x square plus y square whole square. And after simplifying we get it as y square minus x square upon x square plus y square bracket square. Again differentiating the same u partially with respect to y treating x constant that is dou by dou y of. Here u is x upon x square plus y square now y is involved in the denominator. So, we can directly differentiate it and as x is constant we can write it as x outside the operator x into dou by dou y of 1 upon x square plus y square. And its derivative is given by x as it is and the derivative of 1 upon x square plus y square is minus 1 upon x square plus y square bracket square. Into partial derivative of this x square plus y square with respect to y is 2y and finally we get it as minus 2xy upon x square plus y square bracket square. Similarly differentiating v partially with respect to x we get it as 2xy upon x square plus y square bracket square and dou v by dou y as y square minus x square upon x square plus y square bracket square. Now here we can see that from 1 and 4 dou u by dou x is exactly equal to dou v by dou y and from 2 and 3 dou u by dou y is equal to minus of dou v by dou x. That is it implies that the Cauchy-Riemann equations are satisfied. And again we can see that all these four derivatives are obtained in terms of the polynomials in the numerator and denominator and we know that the polynomials are continuous functions. But as the denominator contains x square plus y square only and each and every derivative at point 0 comma 0 these functions are not defined therefore they are not continuous at that point. It says that except at point 0 0 all the four partial derivatives are continuous everywhere. Therefore the condition 1 and 2 is satisfied except at point z equal to 0. Therefore we can say that the given function f of z equal to 1 upon z is analytic everywhere in the complex plane except at point z equal to 0.


If you thought the two lost episodes of Teletubbies were bad enough, guess again. I was in a second-hand shop with my mom, and I went to the kid's DVD section. As I was looking on the shelves, I found a very familiar DVD, Teletubbies. I was surprised and happy I found such a rare find. This DVD's title was, Teletubbies, Obstacle Course and Other Stories. The cover depicted the Teletubbies in a pink background with dipsy clothes to the cover, while the other Teletubbies are inches away from him. I then went to find my mom to show her. Once I found her, I showed her the DVD. It was only $8 and I had enough money to get it. As I got home, my mom told me that she will be at work until 7 PM. Just then, I realized I should watch my new DVD. Before I watched the DVD, I looked at the episode list on the back cover. The episodes were, Obstacle Course, The Lay Rhymes, Jack in the Box, Blackberry Picking, The Very Proud Crown, and a very unusual title for a Teletubbies episode, Dreams. An episode about Dreams? I thought, sounds interesting, to be honest. I inserted the disc in the DVD player. It opened with the warning screen, the regular ABC DVD logo and ABC 4Kids logo as usual. It then took me to the DVD menu. The menu featured the Teletubbies outside of Teletubbies land from the episode Blackberry Picking, with texts in their television screens. On lalas, it said Play All. On Gypsies, it said Episode Selection. On Tinky Winkies, it featured the ABC Lisa Jusperve with web link under it. And on Posts, it featured subtitles. I thought that menu was really creative. I am impressed. I spoke. I pressed Play All, and I watched through the first four episodes. However, the last episode was very messed up. The intro was normal, but when the voice trumpet appeared after the Teletubbies ran away, it said, Sweet dreams are made of this, but nightmares also made of this too. What was that? I questioned myself. It was rather weird of the voice trumpet to say that. The first segment started, and it featured Gypsy sitting at the table. His face was planted on the table, and he was looking away. At that moment, he lifted his head up and began to sob quietly. His sots didn't sound very cartoony, instead, they sounded realistic. As Gypsy cried, the noonoo watched him, not even caring about what's happening and looking at the camera. Gypsy began sobbing louder, and tears began coming out of his eyes. I never saw a Teletubbie cry like that or shed a realistic tear before. However, I felt a bit bad for Gypsy. As Gypsy continued crying, the narrator said, One day, in Teletubbie land, Gypsy was depressed. Gypsy then finally stopped crying and said, Gypsy, depressed. However, he started crying again. Even though I felt bad for Gypsy in this scene, his crying was getting very annoying. At that moment, the windmill began spinning. Gypsy stopped crying and said, Uh-oh! In his happy tone and ran out of the house. The Teletubbies caught up for a TV event and Poe was chosen for the TV event. The TV event was about two twin girls named Kayla and Lyrissa, who are about six to seven years old. Kayla, the younger twin, did a drawing of what her dream looked like, which is about going to the beach with her family. And Lyrissa, the older twin, did a drawing too. But instead of a dream, it was a nightmare she had. The drawing consisted of a plane crash. She even stated that she was in that plane. What? Why would she mention that in a preschooler's show? I asked in shock. Then, the girls went to bed and fell asleep. Lyrissa hoped for a better dream when she slept tonight. The TV event ended, but played for a second time. It then cut to the second segment. It showed a shot of the house. Inside of the house, Gypsy was walking to his bed and yawned. One day, in Teletubbies land, Gypsy is tired and is going to have a dream. Gypsy tired of a dream. Gypsy responded. He then got in his bed and fell fast asleep. Good night, Gypsy. The narrator said, as Gypsy fell asleep, he started dreaming. At first, a shadow then cast through the window and into the house, and the entire house glowed dark red. The shadow was in the shape of a ritual, and some very familiar shadowy figures emerged out of it. After 40 seconds, Gypsy woke up. Gypsy yawned and noticed that the house is dark red. Why house red? Gypsy asked in a worried tone. Gypsy went to look all over Teletubbies land to see what was going on. The narrator ordered. Gypsy complied and exited the house. As he went outside, he noticed the sky was mixed with black and red, and he heard faint laughter. Gypsy began to get scared, but he put on a brave face to look for the other Teletubbies. Searching all over Teletubbies land, Gypsy found Tinky Winky who was facing away, sitting next to a bush. Gypsy found Tinky Winky. The narrator said. Gypsy walked up towards Tinky Winky and reached out his hand to touch him if he was okay. Tinky Winky was crying, but refused to turn around. Tinky Winky? Okay. Gypsy asked Tinky Winky as he slowly held his hand towards his back. Once Gypsy touched Tinky Winky, the ladder turned around, and he looked really messed up.  Tinky Winky snarled loudly at Gypsy. Gypsy let out a yelling horror and fell back in shock and ran away. Gypsy found Lala and warned her that Tinky Winky is supposedly possessed. However, Lala was also crying, leaning against her ball. Gypsy felt touched seeing her sobbing. He then reached his hand out towards her. Lala, okay. Gypsy asked in concern.  She hissed at Gypsy in a sinister way. Gypsy fell back in shock again, letting out a scared yell. He got back on his feet and ran away to look for Po. Gypsy found Po, sitting beside a rabbit burrow. Like earlier before, Po was facing away and crying. He warned Po that Tinky Winky and Lala were supposedly possessed. Oh, Tinky Winky and Lala possessed. Po didn't listen and continued crying. Okay. Gypsy asked in concern. He reached his hand out towards Po's shoulder, but she was also demonic. Po's appearance was messed up, her fur was in a darker red, her eyes were glowing red and her circular antenna was even in the shape of a ritual. Oh no. Gypsy shouted in horror. Oh no. Tinky Winky, Lala and Po are possessed. The narrator said in shock, with actual emotion. Run away! Gypsy shouted. Gypsy then ran all over Teletubbyland to find the house. At that moment, two familiar faces ran in front of him. In front of him, the scary line and Darth Tubby from Galactic Battles were blocking his way. Greeny greeny greeny.  When you had your friends' war to sleep, we poured this potion into their mouths, but we forgot to pour it into you. The scary line said, Darth Tubby held up a blood-red potion. This is the potion I created. Now, they are bloodthirsty demons. What? Gypsy explained. Darth Tubby then said, We are going to finish your Teletubby life, slowly and clean. Gypsy then ran towards the house to hide. Behind him, Tinky Winky, Lala and Po chased him. Once Gypsy got into the house, he realized the Noona was possessed too. The Noona was now a giant, monstrous robot with realistic skin. His eyes were bloodshot and he had small patches of blood around him. Oh no. Gypsy yelled. Gypsy then ran to the back doors, but once he was about to take the last step outside, the Noona extended his nozzle and grabbed Gypsy by the ankle. Gypsy screamed as the Noona pulled him towards him. Behind the Noona, the other Teletubbies walked up. Darth Tubby and the scary line did too. Gypsy looked at the group, his vision blurred from tears. Ah! Oh! Gypsy moaned weakly. Darth Tubby then said, Are you ready to become a demon green Teletubbie? No! Gypsy wheezed, sobbing for a bit. Gypsy sobbed, wishing for mercy. His Teletubbie days were coming to an end. Teletubbie land was currently being ran by two psychopaths and there is nothing he can do about it. Darth Tubby then poured the potion into the scary line's throat. The scary line grinned sinisterly with his teeth. Through his teeth, he said, It's time to turn Teletubbie land into Teletubbie land. The line then bit Gypsy's leg and the potion started absorbing into his skin, As if it were a needle injecting into somebody's body. Darth Tubby laughed like crazy as the scary line kept biting into his leg. Gypsy let out a blood curdling scream as the line was grinding his teeth into his leg. He continued screaming and screaming and screaming as more of the potion started flowing through his body. At that moment, the line then pulled his teeth away from his victim's leg. At that moment, Gypsy started having a headache. He realized his hands were glowing dark green, and he realized he was being mutated. Gypsy's body began forming into a thin and bony figure. His skin became gray, his eyes started glowing red, He grew thousands of teeth and his fur started to grow scales. Gypsy was shocked to see his mutated build. He looked at his mutated friends, Tinky Winky, Lala and Poe, And realized if his friends were mutated, he had to be part of them. Darth Tubby and the scary line laughed evilly as the now called teledemons formed a group. At that moment, Gypsy, looking normal, woke up in bed, screaming. He darted his eyes back and forth and realized this entire ordeal was just a nightmare he had. Gypsy sighed in relief and went back to sleep. The segment ended, and the Tubby bye-bye scene looked normal. However, instead of the usual ending theme, a lullaby with a creepy filter played throughout the entire scene. Once it showed the ragdoll and BBC logos after the credits played, the former was in a mix of red and black, while the latter had blood dripping under it. And the same red tinted ABC DVD logo appeared, but it was more messed up. It showed the teletubbies' faces, faintly seen through the background. It took me back to the main menu, and at the right time, my mom and dad came home. I ran outside and told my parents about the episode on the DVD. I showed them the footage, and they believed me. The only evidence I could show you is some photos I managed to capture before my mom burnt the entire DVD. I couldn't sleep for the entire night, the episode keeps going back to haunt me all night. Who makes episodes of preschoolers shows with such mature and unusual titles? Who knows?