We start the next talk. It's by Martin Vigo. He stands here. He is a product security lead and researcher. And he's responsible for mobile security, identity and authentication. So he helps people design and secure systems and applications. And he has worked on stuff like breaking password managers or exploiting Apple's FaceTime to create a spy program. So give him a warm applause for his talk. Joining me in this talk, I'm super excited to be here. It's actually my second year at the conference. So super, super excited that the first year I was sitting there and this second year I'm sitting here. This is me, but the introduction was already made just pointing out that this is me, nine years old with an Amstrad CPC 6128. Who had this machine before? I see only one hand. I think this was sold in Europe. But I was playing here Lavadia del Crimin, which is the best video game ever written. If you guys like Abandonware, you should definitely check it out. So like any good research, we have to start by looking at previous art, right? We can learn a lot from researchers that did stuff in the past. And in this case, I went all the way back to the 80s to understand how Frickers at the time, when the hacking scene started, were doing to actually hack into voicemail systems. I condensed everything I learned in five different paragraphs of five different e-sins that I actually got from FRAC website, which is an amazing resource. So here, from the hacking telephone answering machines, the paragraph that I extracted was that you can just enter all two-digit combinations until you get the right one. A more sophisticated and fast way to do this is to take advantage of the fact that such machines typically do not read two numbers at a time and discard them, but just look for the correct sequence. What is this about? In all their voicemail systems, if you will enter, like, one, two, three, four for a two-digit ping, it will not process one, two, and three, four to verify the ping, but it will also process two, three, which is very interesting. In fact, in hacking AT&T answering machines, again, this is an e-sign from the 90s or 80s, we actually get the correct sequence to cover the entire two-digit key space. So if you enter all these, you're basically brute forcing the entire key space without having to enter the entire thing that covers it. I also learned from a tutorial of fast-claim voicemail systems that in the 80s, there was default passwords, surprise, surprise, but also that as humans, we actually have patterns when we choose pins. And so we have the classics, one, one, one, one, nine, nine, nine, one, two, three, four. And another thing that I learned in hacking answering machines in the 90s was that there is also, they all changed the message secret to make it say something to the effect of this line accepts all toll charges so you can build third-party calls to that number. This is basically a trick used by inmates to get free calls. Basically, they will record in the voicemail greeting message, yes, yes, yes. So when the automated system comes in and asks, do you want to accept the toll charges from the call from the penitentiary, it will go and they will be able to do free calls. So condensing everything and summarizing what I learned from looking at what previous hackers did in the 80s, we know that the voicemail system security in the 80s looked like there was default pins, there was common pins, there was brute-forceable pins, there was efficient brute-forcing because we can enter multiple pins at the same time and then the greeting message is actually an attack vector. So let's play a game, let's do checklist and let's look at the voicemail security today. So I looked at the American carriers because I live in the U.S. but because I was invited to talk in Germany, I took some friends to give me some SIM cards and I actually wanted to put about German carriers as well. So checklist time, default pins. All American carriers do have default pins and unfortunately they are really not a secret because most of them is actually the last digits of your phone number. When it comes to the two German carriers, it's actually a much better state. For example, Vodafone is the last four digits of their client number, which you don't know. I mean, you know as the customer, not others, it's a secret. Or if it comes to the Callia, that is the car that I got is the last four digits of the book. For telecom is the last four digits of the card number, which is the car you get with the SIM card. For O2, unfortunately, there is a default pin, which is 8705, which is the only pin you can set when you choose to set one. Yeah. So voicemail security today when it comes to common pins. According to, like, a fantastic research from data genetics, this is actually about people choosing pins for their credit cards. But there was a lot of conclusions that I learned from this research. And basically, to summarize the most important regarding this work is that, for example, by trying the top 20 most common pins, you have a 22% chance of guessing the right one. What this means, in other words, is for every fourth victim that I try to brute force the pin from their voicemail system, I will get it right every fourth person. There are other conclusions that are very interesting, like the pins mostly start by 1.9. Who has an idea why is that? Birth year, right? It's very common to set as your birth year. Most of us were born in the 20th century to set it as a pin. Brute forceable pins, same thing. In Germany and the U.S., it accepts four digit pins, which we will see later. It's just not enough key space. Efficient brute forcing, all the carriers accept concatenation of payloads. So in this case, I use it to try different pins. And I don't even have to wait for error messages. I just use the pound as kind of like an enter in a voicemail system and I can try three pins at a time. Usually carriers will hang up when you enter three pins wrong for security purposes, but we will take advantage of that. So with everything that I learned from the 80s, I verify that it was still a problem today. I decided to write a tool that allows you to brute for voicemail system fast, cheap, easily, efficiently, and undetected. So fast, I use Twilio. Who is familiar with Twilio here? Some of you. So Twilio is basically an online services that allows you to programmatically interact with phone calls. You can make phone calls, interact with them, and all that. So I use it to launch hundreds and hundreds of calls at the same time in order to brute force pins. It's cheap. The entire four digit key space costs 40 dollars. So if I want to have a hundred percent chance of getting your four digit pin, I only have to pay 40 bucks. A 50 percent chance, according to the research from data genetics, it will cost me $5. So one over two victim, I will get the pin. Actually, if I want to take a different approach, and instead of just trying to brute force only yours, but I want to brute force the pin from everyone here, according to data genetics, and in this case, according to the fact that there is default pins, I'm not going to ask how many of you have an O2. Now that they know there is a default pin to their very small system, but it will be more interesting to actually try a thousand phone numbers for that default pin for O2 customers, only for $13. It's easy. Fully automated. The tool does everything for you. You just have to provide the victim number, the carrier, and a couple other parameters. Again, it's efficient. It optimizes brute forcing. I use the research from data genetics to favor the pins that are most common, and obviously it tries different pins and all that stuff. But the most important here is detection, because think about it. In order for me to interact with your voicemail system, I need to call you, and you cannot pick up, because if not, it doesn't go to the voicemail system. So I was trying to find ways, because I need to, in the end, make a lot of calls, trying different pins. How can I interact directly with your voicemail? I try call flooding, like basically doing three calls at a time, and because the line gets flooded just with three calls, it goes directly to the voicemail, but it wasn't very reliable. You can use awesome techniques. A lot of people like to tweet that they go on a trip. They are about to board a plane, so it goes into airplane mode, or you go in a remote area, or you are in a movie theater, or at night you put it at do not disturb. Those are all situations in which calls go directly to the voicemail. You can use HLR database to find out if mobile devices are disconnected, or the SIM cards have been discarded, but they are still assigned to an account. And you can use online services like realformvalidation.com, which I actually reached out, and they provide services that allow you to know if a phone is actually connected to a tower at the moment, so it's basically available, so you could use that too. You can also use Class Zero SMS, which gives you feedback, it's basically a type of SMS that it has more priority, and it will basically display on the screen, and you get the feedback if it was displayed, so that's a nice trick to find out if the phone is actually connected to a tower. But in reality I wanted a bulletproof way to do this, and in the US I found that there is this concept of backdoor voicemail systems. So instead of me calling you, I'm gonna call one of these services that you guys have listed here for every carrier, and there I entered the number, in this case the number of the victim, from the voicemail I want to interact to, and of course it allows you to access to the login prompt. Actually in Germany I found it interesting that you guys have it as a service, because in the US it's more a secret that I had to found using Google, but here basically if I dial your phone number, and when it comes to both the phone between the area code and the rest of the number, I put 55 for telecom 13, or for 0233, I directly go to the voicemail, you won't ring your phone, so I can use that. Who was aware of this that is from Germany? Okay, many of you, so that's what I thought, like here it's not really like something you guys care too much about. In the US this is actually used a lot for scammers, or to leave directly voicemail messages from spammers as well. So, voicemail cracker actually takes advantage of backdoor numbers, so it allows you to be undetected. I don't need to call you, I don't need to wait till you are offline, I can do that, and for example for the US, it's great because when I launch in that many calls, the line gets flooded even if you are offline, but when I use these backdoor voicemail systems, because they are meant to be used by everyone, those don't get flooded, so I literally make hundreds and hundreds of calls, and it never fails. So, but you know, like carrier, some of them add brute force protections, right, so that you can't actually launch brute forcing attacks, and I looked at the German carriers, and for example with a phone, I saw that it resets the six digit ping and sends it over SMS, so I guess I can flat your phone with text, but who cares, that's not a big deal, but I think it's actually a pretty effective measure against voicemail, against brute forcing. Telecom blocks the caller ID from accessing the mailbox, or even leaving messages. I tried, and after six times that it's wrong, every time I call it says hey, you can't do anything, and it tanks up, and for 02, it connects directly to the customer headline, someone started talking German, and my German is not that good. So, brute force, I wanted to be able to bypass this, right, and so if you look at Telecom, I mentioned that it blocks the caller ID, but it turns out that Twilio, you can actually buy caller IDs, well, you can buy phone numbers, right, and they are really cheap. So, it's very easy for me to do randomization of caller IDs for very, very cheap, and bypass Telecom's brute force protection. So, Voicemail Cracker also supports that, it supports caller ID randomization. So, let's make the first demo. So, as you can see here on the left is the victim's mobile device, and on the right is the tool, and in this case, I'm gonna use the brute force option. The brute force option allows me to basically brute force the ping. It makes hundreds, of course, as I explained, and you'll try to guess it, and there is a number of parameters, like the victim number, the carrier, the carrier is important because I put there a specific payloads for every single carrier because all the Voicemail systems are different, how you interact with them, and in this case, I'm using a backdoor number because it's more efficient, and then there is no detection, and in this case, I did the option of top ping. So, this is basically trying the top 20 pings according to the research for four digits. So, as you can see, it's trying actually three pings at a time, as I mentioned before, rather than one, so we have to do a third of the calls, right? And how do you think that I am detecting if the ping was correct or not? Any ideas? Okay, so the disconnect and hang up, that's what I heard, and that's exactly right. If you think about it, I can look at the call duration because when I try three pings and it hangs up, it's always the same call duration. For T-Mobile, in this case, it's like 18 seconds. So, I instruct Twilio to after dialing and putting the payload to interact with the Voicemail system, trying the pins to wait 10 extra seconds. So, all I gotta do, I don't need any sound processing to try to guess what the Voicemail voice is telling me if it's correct or not. I just use the call duration. So, if the call duration is 10 times longer, then I know that's the right pin because it locked in. So, as you can see, it found that one of those three is actually the correct one. In this case, it's 983. So, in order to give you the exact one, because at that time, it tried the three of them, now it's trying one by one. And it may look like it's taking longer than it should for only 20 pins, but remember, failing pings is very, very quick. It's just that because in the top 20, it found already the right ping, it takes longer than it should. And there you go, we got that it's a 983. Awesome. So, what is the impact really? Why am I here talking to you at CCC that has such amazing talks, right? And this is really the thing about this. No one cares about the voicemail. Probably if I ask here, who knows his own voicemail ping? Nice. That's what I was expecting. Probably less hands, even. So, some of them are lying. But that's the thing, right? We don't care about the voicemail. We don't even use it, which is the crazy thing here. We have an open door for the discussing an issue that we don't even know about or we don't even remember. So, many people is not familiar with the fact that you can recent passwords over phone call. We are familiar with the resetting passwords over email. You get a unique link, maybe over SMS. You get a code that you then have to enter in the UI, but a lot of people cannot receive SMS or that's what services claim. So, they allow you to provide that temporary code over a phone call. And that's exactly what we take advantage of because I ask you what happens if you don't pick up the phone? If basically I go to a service, enter your email or your phone number and reset a password, everyone can do that. Anyone can initiate the recent password process. And I know that you are not gonna pick up the phone. And I know that thanks to my tool, I got access to your voicemail system. So, basically the voicemail system will pick up the call and it will start recording. So, it will record the voice spelling out the code that I need to basically reset your account and get access to it. So, oops, let me press play here. Okay, so, what does the attack vector look like? You brute force the voicemail system using the tool, ideally using backdoor numbers. For that particular call that is the call that the victim will receive once you initiate the password reset, that one, it kind of goes through the backdoor number, right? Because it's gonna, PayPal is gonna directly call the victim. So, for that one, you need to make sure that the victim is not connected to a tower through all the methods that I showed before. You start the password reset process using the call me feature, you listen to the recorded message, secret code, and profit, you hijack that account. And voicemail cracker can do all that for you. Let's compromise what's up. So, on the left, you see my number, right? With a secret lover group, and a secret group, and all that stuff. On the right, notice that I'm not even using an actual device, it's an Android emulator that I installed the APK, and there is some sound to this. And you are gonna see, so again, on your left, it's the victim's number, on the right is an emulator of the attacker. So, you'll see that I'm gonna use my tool with the message payload, with the message option. So, in this case, what I'm doing is, I'm setting the victim's phone to airplane mode, simulating that it's now offline for some reason, and I detected that. So, if you see what's up, it sends you a text to actually register as WhatsApp group, right, as a WhatsApp user. But if you don't reply in a minute, it allows you, it gives you an option to call me, right? And that's exactly what I click. So now, what's up is basically calling the victim, which is again in airplane mode, because it went on a remote trip or on a plane. And so, I'm using voicemail cracker with the option message to automatically retrieve that newest message. So, the tool is gonna provide me, as you can see, the last option is the PIN, because I brute-forced it before. So, it's gonna give me a URL with the recording of the newest message, which hopefully, it's a recorded demo, hopefully contains actually the code. So, let's see, I got the URL. It's interacting with the voicemail system. Your graphic code is 365915. Your graphic code is 365915. And that's simple, we just hijacked the person's WhatsApp. And here, I'm fast-forwarding just to show you that you got a call back. Thank you. I do wanna point out that WhatsApp is super secure, like end-to-end encryption and all that, and there is a number of things that you can notice this attack. For example, you wouldn't be able to see the previous messages that were there, but you can just hold on, and as people write, the groups will pop up. So, you hijacked that WhatsApp account. There is also a fingerprinting, but who really pays attention to the fingerprinting when someone changes the device, right? So, are we done? Not yet, because the truth is, some researchers talked about this in the past, and actually, services try to slowly pick up.  So, when you receive that phone call that provides you with the temporary code, in reality, it's not giving it away. You have to press a key. It comes in three different flavors from what I found from my test. Please press any key to hear the call, so when you get the call, you have to press, and then it will tell you the code. Please press a random key, so specifically, please press one, please press two, or please enter the code. PayPal does that. Instead of you having to press a key to hear the code, when you reset the password, you will see a four-digits code that you have to enter when you receive the call, and then it will reset the password. So, I'm gonna get the help from all of you guys. Can we be discurrently recommend the protection? What is nowadays recommended to prevent this kind of attacks? And we're gonna play a game. I'm gonna give you two hints. This is the first one. So, you probably guys are familiar with this, but kept in crunch. Again, we go back to the eighties. We can learn so much from them. Use this to generate specific sounds at a specific frequency to basically, you can go and read it to get free international calls, so we will create that sound and the system will process it on the line. And the second one is that I cheated. When we did the checklist, I actually skipped one, which was the greeting message is an attack vector. So, I ask you guys, how can we bypass the protection that requires user interaction in order to get the code recorded on the voicemail system? What was that? Exactly, record DTMF tones as the greeting message. We own the voicemail system so we can alter the greeting message. So, this is exactly how it works. We just alter the greeting message, record the DTMF tones that the system is expecting, and it works every single time. The best thing of this is what really is so awesome about all of us that really care about technology and we want to have a deep understanding because when I was asking people when I wanted to show them this, I was asking them, how does this protection really work? And they will say, well, you have to press a key and then it will give you the code. But that's not really true. What you have to do is to provide a specific sound that the system is expecting. That is different than saying you have to press a key because I have to press a key that requires physical access. If you say I have to provide a sound, now we know it doesn't require physical access. That is why hackers are so cool because we really want to understand what is happening backstage and we take advantage of that. So, how does the attack vector look like? Group force and voicemail systems are before. So, basically we have an extra step which is update the greeting message according to the account to be hacked and voicemail cracker can do this for you. Let's compromise PayPal. So, on the left side, you saw, you see that as before I brute force the ping of the voicemail. And in this case, on the right side, I'm gonna start the password research for that account. So, I do that. And I choose please call me with a temporary code. But in this case, PayPal works differently because it will show me a four digits code that I need to enter when I receive the call in order to reset the password. So, you see that here I'm using the greeting option. So, the greeting is gonna allow me to enter a payload that I want to record it as the greeting message. In this case, it's 6353. So, I made it very verbose for this demo. So, you see the last option is PayPal code. And I enter 6353. And now the tool is going to use the ping to log into the voicemail system, interact with it, change the greeting message, record the DTMF tones according to 6353, and then it should be able to fool the call. In this case, I'm asking to call again because it didn't have enough time to do that. And in three, two, one, we should get that we actually compromise PayPal's account. And there we go. We can now set our own password. Thank you. So, I showed you some vulnerable service. Let's go very quick about it because I'm concerned I'm running out of time. So, I'm just mentioning Alexa top 100 types of services. No favoring anything. But, so for password reset, that supports over phone called PayPal, Instagram. No, is that? No, Snapchat, Netflix, eBay, LinkedIn. I'm still on Facebook, what can I say? 2FA for all the major fours. So, 2FA over phone call for Apple, Google, Microsoft, Yahoo, verification. So, basically you don't register with the username and password on WhatsApp or Signal. You actually use directly the phone number, right? As we saw before and you register through a phone call or SMS. So, you can compromise these two. Twilio, the own service that I use for this is actually really cool because you can own a caller ID by verifying it by getting a phone call. So, I can actually own your caller ID and make calls on your behalf, send texts, and these all legitimately, right? Because you pressed one. And Google Voice is actually another interesting service because it's used a lot by scammers, right? And this is the same thing. You have to verify ownership so you can do those phone calls and you can fool it as well with this. But then I found, I was looking like, what other services really take advantage of this? And this is super common in San Francisco where I live. You can bus in people like when they wanna enter, right? They enter your house number and your phone rings and you press any key to open the door. So, we are talking about physical security now and I've seen this in offices as well. They all work this way. They basically, because they wanna be able for tenants that come and go, be able to switch that very quickly. So, it works just through the phone that you bus people in. But my favorite is consent. Because when we think about consent, we think about lawyers and we think about signing papers and we think about all these difficult things. And I found out about this location smart service that is not anymore there and you will see why. But this was recently in the news because basically, Brian Krebs wrote a really great article about it. But I'm gonna let you hear then their YouTube channel, how Location Smart works. The screen that you're showing, that you're seeing right now is a demo that we have on our website. It's at locationsmart.com, slice try. And I've entered my name, my email, my mobile phone number. And it's gonna, it's again going to get my permission by calling my phone and then it'll locate. So, let's go ahead and I click the box to say yes, I agree, click to locate. And the screen now shows that it's going to call my device to get my permission. That's a nice ringtone. No, it's not. Yes. So, as you see, this service, this website had a free demo. Had a free demo that allowed you to put a phone number, yours of course, and you will get a phone call and then you will give permission by pressing one so someone could locate you and keep tracking. I mean, I checked with them for up to 30 days real time. So now you know why they don't exist anymore. Open source, open source. So, and this was with the permission of the carriers. This is now some fishy thing. This was actually a service. So, I wanted to release code because I want you guys to verify that what I mentioned is true and have code to hopefully help push the industry forward to make voicemail systems more secure, right? We wanna push carriers to do so. But I didn't want it to provide a tool that works off the box and anyone can very easily, as we saw, like just start to brute force pins specially because I saw that there is so many people with the default pins out there. So, I just removed the brute forcing. So, the tool allows you to test it on your own. You can test, you know, you can test the greeting message, you can test the retrieving messages, compromising the services and all that. So, the tool allows you to test on your own device. I won't give you code to brute force on someone else's device. And feel free to go to my GitHub repo. So, now, like all the talks comes the recommendations. But I know what you guys are thinking, right?  I don't have anything to hide or anything like that. So, I wanted to give you reasons why you should still care about this and why we need to do better. Because, do carriers set default pins? Yes, we saw that. It's testing for the default pins, cheap, fast, undetected, and automatable. Yes, it is. Is updating greeting the message automatable? Yes, it is. Is retrieving the newest message automatable? Yes, it is. Is there a speech to text description so that I can get the sound that I played before with the code and get it in text? Yeah, Twilio gives you that as well. So, can the account compromise process be automatable? Of course, you can use Selenium if you want to automate the UI or you can just use a web proxy and look at the APIs and do it yourself. So, it is only a matter of time that someone actually does all these steps that I show you step by step and just makes it all straight and starts to go over phone numbers, trying the default pins, and just automatically compromising services like WhatsApp, like PayPal, and all that. You can do basically not a worm, but you know, you can compromise a lot of devices without doing anything. Recommendations for online services. Don't use automated calls for security purposes. If not possible, detect answering machines and fail.  I just show you how to bypass that, but that's with the whole da-carriers-bang DTMF tones from the greeting message. I don't see why that should be supported, right? Recommendations for carriers, the most important thing, ban DTMF tones from the greeting message, eliminate backdoor mobile services, or at least give no access to the login prompt, right? There is no reason why I should be able to access your voicemail directly to leave a message, but then I can access the login prompt by pressing start. Voicemail disabled by default, this is very important and can only be activated from the actual phone or online, maybe with a special code. Oh, great, so I have time for questions. No default pins, learn from the German carriers, don't allow common pins, detect and prevent brute force attempts, don't process multiple pins at once. Recommendations for you, which is in the end very important here, disable the voicemail if you don't use it.  So I guess use the longest possible random ping. Don't provide phone numbers to online services and lines required, or it's the only way to get to a fade, to a fade is more important. Use a virtual number to prevent us in like a Google voice number, so no one can learn about your phone number digits by resetting the password, or do same swapping, use 2FA apps only, and I always like to finish my talk with one slide that kinda summarizes everything. Automated phone calls are a common solution for password research, 2FA verification and other services. This can be compromised by leveraging all weaknesses in current technology to exploit the weakest link voicemail systems. Thank you so much. Thank you, Sharon. See, see, see. Thank you. Thank you, Martin. We have time for questions. So if you have any questions, or if someone in the internet has questions, just go to these microphones. Where is the microphone? You've got it. Yes, you wear black in the microphone too. So maybe you start and we take the question from the internet. Yes, I have a question. You mentioned that the phone needed to be offline. Would a call, like a simultaneous call to the phone that would be in what's called English, beset, like occupied? So let's say I already called the victim. So the caller gets, yeah, the line is occupied. It would then go to voicemail, wouldn't it? So that's a great question. I think the question is, if you are on a call and someone else calls you, so your attack will be I somehow make up a story to keep the person on the phone call while I launch other calls, that will work. I tried that, but the problem is usually two calls. I mean, that wouldn't be too big of a deal, I guess. But it supports two calls, right? It will warn you, oh, there is another incoming call. But I guess you could keep doing more. So that's what I meant partly with the call flooding. In the case where I tried was just launching all of them at the same time. And if the person picks up, I don't care. But it's someone related to what you mentioned and that's definitely possible. Okay, thank you. Yeah. Question from the internet, please. Don't ask where is the phone call start talking immediately. Would the new code be recorded then? If I understood the question correctly, is that when the voicemail picks up, like basically the automated system that spills out the code already started to talk. I believe that's the question. We don't know, it's from the internet. Oh, okay. So if that is the question, I found actually that because usually greeting messages last like 15 seconds. So by the time it starts recording, you already finished the recording that gives you the code. But you own the greeting message, so you make it as short as one second. And I never found a problem with that. You actually record the DTMF tones for like two seconds. Ladies first, so we take your question. You talked about how you learned all of that through reading it easy and how are they called and how do I find them? That's the best question I've ever heard in the search and applause. Seriously. I like that because you also wanna learn about it. So that's really fantastic. So the FRAC website is the best resource you can get. I guess everyone will agree here. So just look up Google for FRAC magazine and there is a lot, a lot of interesting stuff that we can learn there still today. Are there any others? Yeah, I mean, you can then follow the classic. I mean, I like Twitter to get my security news because it's very concise. So I kinda get like, you know, the 140 characters version if I'm interested, then I will read it. So I think you can Google for like top security people to follow, Brian Krabs is great. It depends also on your technical depth. There is different people for that. And if not just, you know, specialized blogs and magazines. All right, thanks. Thank you. And your question please. Hi, so for me, the solution is obvious. I just turned off my voicemail but thinking about some relatives which are maybe too lazy or don't really care and still used to factor out the indication. I was thinking about, could I easily adapt your script to automatically turn off voice boxes or generate random pins? You can automate it to turn off the ping. Like for example, on Vodafone, I don't know why it allows you to turn off the thing. To turn off the voicemail, I haven't tested that. I think you may have to call the IT department but you know what, it would be really great to do that. It would be really awesome, great question. I guess if you can turn it off, then you can turn it on as well, but yeah. Your question please. Did Twilio ban you or did they find out what you did? What did they do? I got some emails. I got some emails but they were really cool. I have to say that. I explained to them where I was coming from. I gave them my identity. I wasn't hiding anything. Actually, I had to pay quite some money because of all the calls that I was doing while I was doing the research. So I didn't hide my identity at all. So they did detect that I was doing many calls and stuff like that. So there is I guess at the high volumes, there is some detection, but Twilio is not the only services. So again, you can switch between services, space it out, change color IDs, a number of things. And one more question here. You talked about being undetected when making all these calls by going directly to these direct access numbers. Well in Germany it's very common that if someone calls your voicemail, you get an SMS text even if they don't leave a message. But I suspect there's some kind of undocumented API to actually turn that off through the menus. Have you looked into that? No, I haven't looked into that specifically. The question is that usually in Germany for the carriers, you get an SMS when you get a call. I wonder what the test that I did on the German carriers, I was getting a text if I was leaving a message, not if someone was calling there. I guess you are talking about a missed call kind of notification. I'm not sure about it. What I do want to point out is remember that you can do this while the person is offline maybe on a long trip. So you can time it. That will be a good probation I guess to just not launch it at any point in time, but you can just always time it and by the time the person gets a million texts it's too late. Thanks. Yeah. One more question over here please. Thank you. On Apple phones, can you activate with some carrier the what they call visual voicemail? Would that prevent your attack to work or? No, there is actually, I believe he was an Australian researcher that looked into the visual voicemail and he was able to find that in reality uses the IMAP if I remember correctly protocol and for some carriers, he was able to launch brute force attacks because the authentication wasn't with the same ping as you get when you dial in, but he found at least one carrier in Australia I believe that was vulnerable through the visual voicemail. And I checked for German carriers. I did that I actually follow the steps that he did to see if that was worth mentioning here. I didn't find it to be vulnerable, but that doesn't mean that that's not the case. Thank you. One more last question. I thank you for the talk. What is your recommendation to American carriers to protect themselves against this attack? I put a slide there like for me, I guess the most important is really look at what some German carriers are doing. I really like that the recent password is sensitive to you over SMS as soon as it detects that someone dialed, tried six times the wrong ping. I mean, if you have physical access to a locked device, you could claim that if someone has the preview turned on on the device, you can still see the ping when you get it, but then it wouldn't be like a remote attack anymore. So definitely detect brute force and shut down. I mean, we know that with the color ID is not working so well for telecom because I was able to bypass it, but I know that because I did some tests with HLR records that you can actually tell the type of device as it is, if it's a virtual number. So if carriers could actually look at the type of phone that is trying to call in, if it's a virtual number, you know, red flag, if it's not, I don't think someone's gonna have, I guess a government could like, you know, have 3,333 devices because you try one ping for the 10,000 key space, you know, you try three pins at a time and just have 3,333 SIM cards and so it will come from real devices, but then at least it will quite significantly mitigate it. And then like, again, like if you ban the TMF tones from the greeting message, that will help as well. Thank you, Martin. I've never provided any telephone number to any platform and now thanks to you, I know why. One plus for Martin Weigel, please. Thank you.


To move up to this ridge line where they're going to send an ORP, they're going to put a leader's recon up here to check out what's going on across the low ground, and they're going to get on line at this point. Try them. There's drawbacks to both. Eyes on, if not, they don't see an LPOP, right? They won't fucking... Guys, these are from the count of fours. As far as we've got. One. Come on, go down. Good luck.


All right, we're going to take off and descend into the stratosphere and ultrasound and come back down again I hope. So when I was an intern a long time ago, this is what we had for imaging. So we literally didn't have CTs MRI, so you get a plain film x-ray, and if you're lucky it showed something good for bone, but anything soft tissue, except for the orbit, it just weren't going to see much. Early generation CT scan, just really, you know, better than x-rays, but still really hard to tell detail, just not that refined. Ultrasound at that time was kind of a standard of care, certainly for the globe still is, but the orbit too, it was really best we had to look at orbital soft tissue, especially the hands here two-thirds of the orbit, but then this came along. So modern generation CT MRI scanning, the detail, incredible muscles, nerves, everything. So who needs ultrasound, I took the orbit, but there still is a place for it, which I'll try to show you. So basically I used two modalities, one's the V-stand, which you're kind of familiar with, and it makes sense, it looks like shapes of things, if you take a cross-section of the eye, a thermal detachment with the T-sign here, with the retina here, and fibrous membranes connecting the leaves together anteriorly, or a big melanoma mushrooming, so really very good, and we still use that all the time for ocular processes. But the orbit is a different area, and the A-scan is where I really use that a lot, and evenly, you know, nothing about A-scan, you can see the difference, you can look at the normal orbit pattern here with the A-scan, and hemangioma, lymphoma, meningioma. So not too much what they actually represent right now, but it's more the difference, you can see the distinction between the different tissues, and there's a very direct tissue correlation between A-scan and pathology, so, and that still is a case of orbit illusions and also ocular illusions, so there's still a very important role for that. So basic principles, sound reflection from interfaces, so sound goes out, hits things, and bounces back again. We're not the first to think about this a long time ago when their nature did, with bats, and that's how they fly around, so they emit sound at high frequency, get even small insects, and they can localize them and attack them and eat them, so ultrasound is a very old technology. Ultrasound is defined as sound above the range of human hearing, so we can hear in this range about the 20-deal hole killer range that our ability to hear things, dogs can hear up to 40, whales, dolphins, 70, and bats, 150, so we're still far below what we use for a diagnostic ultrasound, or in the megahertz level, the standard probes that I use are the 8 to 10, we go up to 50 or 60 with UBM, so high frequency, so medical ultrasound, abdominal, in this range of frequency here, up down like up to 60 as I mentioned, and we can do that because of the eye, the way it's structured, first of all it's kind of a thin wall, the wall of the square is not very thick, so you can penetrate rather easily compared to the abdominal tissue, other parts of the body which are thicker, and also the eye is full of fluid, so ultrasound travels rather way through fluid-filled structures, so you can use that in the eye and get away with real high frequencies. The higher the frequency you get, the better resolution you get, but also the less penetration you get, so to go already deeply in tissues, you really can't use these high frequencies, that's why UBM can use real high frequencies, if you don't go very far back in the eye, you get the initial anterior few millimeters of the eye before you lose sound energy. Sound weight velocities, how fast does ultrasound travel? Well with Dempster, the media, the faster it travels, so going through water, it's about 1480, aqueous vitreous, 1532, and that's where the standard velocity is set on our biometrics and instruments we use for ultrasound, soft tissue, crystalline land and bone, so the denser the tissue, the faster the sound velocity. I did a study a couple years ago on a thousand patients just to look at clinical correlation and these are the results of the study which I'll address a little bit further, but basically the impression of the referring doctor, he said this is probably a tumor, probably that NUVIS or melanoma was confirmed in about 400 of these patients, no findings in 279, clinical impression, halted or clarified in about a third of them, an incorrect diagnosis in five, so that's the results of a study that I did. So the basic principles again, sound reflection, traditional interfaces, B scan, brightness amplitude, A scan is time amplitude, I'll explain what that means a bit more, then UBM ultrasound biomarkeroscopy with high frequency immersion ultrasound. So the one equation for physics on the early Monday morning while you still have to sleep, acoustic impedance is equal to sound velocity times density, and this is the basic principle behind ultrasound. So the greater the difference of things between two media, the higher the A scan spike or the brighter the B scan image, so this is important, so ultrasound works by reflection from tissue interfaces, and the greater the difference between those interfaces, the sound velocity and density, the higher the spike on the A scan or the brighter the B scan pixel. An example here, this is a cordial hemangiooma, so there's the tissue region here, and this is a clinical photo of it, but these are very high reflective because of a lot of interfaces, it's kind of like a honeycomb, as the sound beam goes through this, it hits a septa, spikes up, it's a blood like, it goes down, septa up, down, so this constant interface sound velocity difference. So as you see going through the eye here, here's the A scan, so here's the vitreous. The vitreous is homogeneous, usually it's just a consistent media, so the sound just goes through it without much reflection, a little blip here or something, but as you hit the fundage, you suddenly change this impedance quality. You go from a sound velocity or one velocity to another, and you get a high spike from that retina, and once you're in the orbit, you get a lot of spikes because there's a lot of stuff in the orbit, you get blood vessels, muscles, septa, bat, so you get a lot of interfaces to reflect sound. The core led to the B scan is darkness, so again, there's not much reflection inside the eye, so it's dark, here's the vitreous cavity, corresponding to a flat line on the A scan, and once you hit something, you start getting reflection of sound. So the A scan displays that as spikes, the B scan has bright dots. So this Emanjohoma is quite hard to reflect it because there's a lot of interfaces, you get a bright lesion on the B scan and a high reflective on the A scan, so the actual lesion is from there to there. So that's all inside the lesion, and it's quite hard to reflect it because of the reflection of the tissue. And this is important because this is really very diagnostic, I can look at this until almost all the time, that's what it is, it's an Emanjohoma and not a melanoma, not something else, so there's a real good correlation to pathology. So B scan brightness amplitude, so the B scan probe looks like this, and there's a marker on it, and that marker is important because that tells you which way the transducer is oscillating, so it kind of oscillates in one plane, and that where you point the marker tells you which way it's oscillating, and that's important for localization of structures, and I'll discuss that a bit more. So for B scan, if you take off the tip, you see this transducer, and this is going to go back and forth about 15 to 20 seconds times a second, so you get this scanning of the eye, and as you point, you go across the eye, you look at different quadrants of it, each scan gets about 60 degrees of the surface of the inside of the eye, so you can go around the eye and look at the entire eye in about six different sections to get through the 60 degrees, and this is what a B scan picture looks like. Here's an axial scan going with the probe out against the cornea, and this is called the dead zone. When you put the probe against the eye, you lose information right in this area here because that's kind of where the sound is reflecting and being picked up by the same transducer who picks it up and sends the sound, so it's called the dead zone, so you really can't get much information there. Let's go and use immersion techniques to back the probe off to be able to see structures in that dead zone area, so when you're right against the eye, right in here is the cornea somewhere, the entire chamber is in there, front of the lens, so you really don't get much information. Once you get past that, then you're inside the eye here, so here's iris, here's the bacterial lens here, and going through the eye here, here's the optic nerve, so this is a B scan picture. Examination techniques, as I mentioned, the marker on the probe is important, and that tells you this way that the beam is rotating, the transducer is rotating, so by definition, when you have the marker this way, it's kind of in the plane of the slide here, this is parallel to the limbus, so here's a limbus here, and you're going back and forth in the plane of the picture, that's called a transversed position, so when you're parallel to the limbus wherever you are in the limbus, if you're parallel to it, that's called transverse. If you're perpendicular, so if you rotate it this way, so here's a marker up here, and you're going this way with the transducer, that's called a longitudinal position, so here's a limbus here, and you're perpendicular to it, so longitudinal transverse are two major probe positions that we use. And that's important because when you look at tumors and things, you want to be able to characterize the different dimensions of the tumor, and that really translates clinically to practical use, because we do plaques all the time, we plaque radioactive plaques right by the iodine for melanomas, you want to be able to tell the maker of the plaque what size to make the plaque when you put it on the eye to kill the tumor, so those dimensions are important, that's the ones that I do, and I measure these for the retina guys. Here's an axial scan right against the cornea, you're going through the eye here, axial scan, I don't like quite as much, because a couple reasons, first of all, patients are more skrimmished to put the fur right directly on the eye, they're more comfortable putting off to the side, and also you lose information as you go through the lens, you get some sound absorption, you don't get as much information from the sound by going directly, except by bypassing the lens, so that's why I prefer other positions besides axial, but I use this occasionally for certain things. So here's an example again, so putting the probe here, this is an axial view, going through the eye here, again, here's the back of the lens, close to your lens, you're losing information up in this area of the cornea, enter your chamber, and here's a small tumor, as you can see this, this would be superior to the optic nerve, or the optic nerve shadow, and here's a lesion just above that you're capturing, but it's kind of attenuated, you're losing information from the sound, because it's being absorbed by the lens, so that's why axial isn't the perfect view for this. Again, so transverse, so again, you're parallel to the limbus, going this way with the beam, so sweeping across the eye in this direction, kind of an anterior-posture direction, and here's the longitudinal view, you're going superior to the inferior, so you've got a lesion in this area, you're going to scan it in both directions, this way here, and this way here, the two major ways, you can also do obliquely in different views, but these are the two major that we use to characterize lesions to tell you information for the plaque making. So here's a transverse view, again, so you're sweeping the plane of the slide, here's the lesion here, so you go across the lesion this way, and then it displays it on this way. And the way the software is made of these machines, it always displays where the marker is on the probe, that's displayed as up on the screen. So wherever you point your marker, that will just slide us up, so if you're, in this case, the marker is towards us here, and so the lesion is here, so this is, it just rotates it, and you have to kind of think three-dimensionally when it shows that the lesion is always up, so you can turn the marker, and thoroughly, you're going to see the lesion on the screen as it's being up. So you have to think in those terms. Longitude will be scanned, again, here you're going perpendicular to the limb, so you're right here, and you're sweeping across the lesion this way, showing the lesion in this direction here. So those two views, the lesion, you get a transverse view, and a perpendicular view, longitudinal view, and it shows it here clinically. So this will be what kind of a scan here, with the probe here, markers up here, longitudinal or transverse, transverse goes parallel to the limb, right. And here's the lesion here, we're showing this lesion at three o'clock, so you're going across the eye, so here's the probes over here, going through the vitreous, the lesion is here nasally, so you display it here as the lesion. It's pretty single, it's right almost directly at three o'clock, so the lesion just pops up there right in the plane of the probe, and this is longitudinal, because again, you're perpendicular, the marker is this way, you're perpendicular to the limb, showing the lesion in this direction. So those two views of the lesion, this is at three o'clock, and you kind of put those together, so again, you've done your transverse view here, sweeping this way across the lesion, you've done longitudinal this way, this way across the lesion, and you show those two views of lesion, and you kind of get a good characterization of the base of the lesion, how white it is. For thickness measurements, you can use B-scan for that, but as always, it's not real accurate, because you try to measure from the tip there, so where is this coroid in there, you kind of get this shadowing effect from lesions, so A-scan is actually more accurate to measure, so I usually use both, I'll do an A-scan thickness measurement, and I'll do a B-scan dimensional measurement, so those are the ones that I usually do. And I mentioned A-scan, so again, the probe is here against the sclera, the dead zone here just like the B-scan, this information here is lost, because you're right against the eye, so about three to five millimeters here, you're in the sclera here, you're in the harsh plana and vitreous area, so you look at the information, doesn't really show you anything. You go across the vitreous cavity, and the vitreous is low baseline, because there's no reflection inside vitreous normally unless you have something in the vitreous. You hit the lesion, you get a difference in impedance going across the sample loss of the changes, you get a high spike from the surface of the tumor, and once you're inside, it depends on the structure of the lesion, so based on pathology, it's with a lot of interfaces, how dense they are, what side, portion of the size they are, all that information is inside, so that really helps characterize lesions. When you hit the back of the eye here, the sclera, you're back in the orbit, so the actual lesion is from there to there. It shows the distinction here.  This is quite low, here's the sclera, here's the tumor, so there's a lesion from there to there, you're back in the orbit over here, but that reflectivity is usually quite low, because these are really homogeneous dense lesions. Most melanomas are in this range from about here up to about here, and that really helps. That reflectivity height tells you a lot about the lesion, also regularity, how regular the structure is, and also vascularity, which I'll show you in a couple minutes, a picture of that or of the view.  And the A scan probe looks like this, kind of like a pencil thinner than the B scan probe, and there's no mark on this probe, it doesn't really matter, the sound beam is generated by the transducer in all directions, it doesn't sweep like the B scan probe does, so there's no marker of this orientation, it's just a single sound beam coming out in a way. Now there's often a source of confusion about A scan, this is often even the reps, if you go to the academy or through the displays, they often will tell you our instrument has a B scan too. Well in their mind, A scan is the same as biometry, biometry probes are an A scan modality, but I use a separate dedicated diagnostic A scan probe, and it's really important because you can't do what I do with tumors and things with a biometry A scan probe, it doesn't work. I can do biometry with this probe, I can do it all the time, I do convergent technique, or I can use this A scan to actually measure the length of the eyes, I do that, but you can't go the other way and take a biometry A scan probe, which most machines come with, and do tumor work and things like that for quantitation, so it's different reflection of sound, it's different lens imaging, focusing things like that, so that's the difference, so it's important to know that, so if you have a biomachine and trying to get an A scan, reps often confuse that. It's a separate probe and there's also a lot of B scan units have called a vector A scan, if you look at turn the B scan on, at the bottom there's kind of this A scan signal, I rarely ever use that, sometimes I use it for like a staff aloma, trying to line up the vector with the staff aloma to do a measurement, but really otherwise it's not useful. The information from there just doesn't correlate to what we get with standardized A scans, so it's got to be a separate A scan probe, a separate software, and that adds cost, that's more expensive, but really to do complete ultrasound, that's what I need to do. We have those machines here at Marana, so we use it all the time, we're trying to get one for the VA on these days. So returning echoes, so what influences what the ultrasound looks like on the display, absorption of sound, we talked about that, so I go through the lens, that's again the way axials seem to be good, they can be absorbed by the blood of tissue, reflection of sounds, just like light, the same optic equations apply to sound waves, so snails, a lot of things like that, reflection, angle of incidence, angle of direction, interfaces, size, smoothness, these all influence what the sound wave looks like when you get reflections on the B scan. Being perpendicular is really important when you do biometry, again we're doing more and more IOL masters, so probably don't think about these things, but you're still going to have occasions to do ultrasound, like the techs here, the LASA hers about 10% or so, probably a little better with modern units, but they still need to do immersion and A scan on cataract patients, real dense cataracts, dense PSEs, IOL masters just doesn't work as well, they can't get readings, so we still use ultrasound a lot, and being perpendicular is really important to do biometry, but also to measure lesions also, so here's a lesion, you're going through the vitreous here, here's the first surface of the lesion, here's a flare, also the actual lesion is right in there, and if you're not perpendicular, this is the same lesion just by angling the probes, I wasn't perpendicular, I get this, so here's the surface of the lesion, but inside reflectivity patterns are different, you hear you call this kind of a medium to low reflection, here it looks like it's higher, so that can deceive you, so by not being perpendicular, you can get spurious both measurements of things, and also internal structure is skewed by that, so really being perpendicular is important, how do you know you're perpendicular, well you get a real high spike, when it's real high and tall like that, as tall as the initial spike, that means you're perpendicular by definition, you start to angle the probe away from that, this kind of drops off, so you're less perpendicular, you don't get as high as a nice rising spike there, so that's the difference. So indications for ultrasound, opaque media, obviously you can't see inside the eye, that's the reason to do ultrasound, medical legally, there's been a number of cases of dense cataract removed, and they found a tumor hiding behind the cataract, that's not good to have that happen, in a sense the patient's not happy because they don't have great vision, there's also probably some risk of doing surgery in an eye with a tumor, that you might disseminate tumors, so you need to know beforehand what's behind the cataract, so opaque media, visible fundus lesions, you can see the lesion, accuracy rate, to know what they actually are, even with pretty good people that do a lot of this, it's probably 80% in that range to actually tell what it is by looking at it, so ultrasound really enhances that ability to diagnose, biometry, mentioned axolength, measurement of structures inside the eye, tumors and things, which are run in pathology and optical abnormalities, it's kind of the major things that I think ultrasound is useful for, and again there's a niche here with with retina issues and things like that, with the MRI CT scanning, you still can do a lot with ultrasound to fill those gaps in them, so opaque media, so again the dense cataracts, one of the studies years ago stated that patients with a blind painful eye, for whatever reason, about 10% will harbor unsuspected melanomas, so it's pretty high, so you have to always be thinking about, now if you follow the patient, so you're a patient, you watched him as a cataract developed and grew, the odds of that are pretty small, but have a patient walk in the clinic the first time, no history, no old trauma, whatever's gone on, and their eye hurts and is opaque, that has a pretty good chance of having something behind that, so definitely ultrasound's indicated, so the patients that I saw in the study that I mentioned, about a third have pathology not suspected by the doctor, so they sent me with the dense cataract or robotic hornea, whatever, I found something inside the eye that had a real life with there, so whether it's vitric tamarace, detach retina, whether it's a tumor, those things, so I guess important, at least a third of patients are going to have something unsuspected when they walk in the door, have opaque media, visible fundus lesions, differentiation, so to look at something to tell what it is, really even if you're good and do a lot of this, you can still be deceived by these lesions, and there were two large past studies, one back in the 60s by Fond and Ferry out of AFIP, they looked at all the eye-submitted that nucleated, in those days nucleation was really more common, I trained at UCLA, patients walked in the door with a suspected melanoma, even a small one, they were often nucleated within the same week, almost like a commercial procedure, and unfortunately about a fifth of these had the nine lesions, they had 20-20 visions, and I'm not great to have that kind of result, so this past study verified that, the AFIP looked at all these eyes and nucleated in the 60s, and that was with techniques of examination at that time, indirect tophthalmoscopy, fluorescent angiography, and they found that about a fifth had faults positive, and that was repeated in the 70s, the same study looked at, again, eyes of AFIP, they found the same result, 20%, so ultrasound radius changed that equation, we're up in the 99.7% accuracy rate with the collaborative octamermal study that was done a few years ago, so it's changed that, so to look at a lesion, you know, is that a nevus, is that a melanoma, you know, what's what, you really just by looking it's really hard to tell, unless you do ultrasound, so biometry, axolength, I mentioned, we use immersion techniques where we put a shell between the lips and stand the probe back, and that way you don't have this dead zone I mentioned, so here's actually the dead zone here, from the probe itself, the physics of the probe, reverberation, you get this dead zone, but then once you're past that, you're going through the shell here, hitting the cornea, so here's the cornea spike, you're going through the entry chamber here, here's enter, lands, posterior, lands, vitrious, and rett, as you can separate out the different tissues and distinguish them, begin with immersion, ultrasound, majoring lesions, here's a lesion I saw years ago, there's a B scan of those little lip right here, this will look like a probably nevus, nevoma sort of thing, and over time it didn't seem to change that much, it looked about the same as far as the height, and the A scan right here looked about the same as far as the thickness, but you actually see change of reflectivity, you can see it pretty high here, see how it's starting to get lower here, it will change to getting lower, it usually means it's getting more homogeneous, it's going from a nevus, nevoma situation to more of a melanoma, as they get more homogeneous, denser cells, reflectivity starts to just get lower, like we talked about before, the denser the restructure is, the more homogeneous the more the flatter the ultrasound is or the lower it is, so it really helped us in this case to know it was actually, it looked like about the same size, it was actually changing pathology characteristics and getting more aggressive, so we watched them more carefully and actually grew more, had to have the inuclated after, I mean not inuclated, but plaque, radiation plaque. Dermatopathology, so classic funnel detachment, seropidinous structure, where it can be fixed folds or more fluid folds, and then the A scan shows a real high spike, and sometimes it's hard to tell on B scan, you see these membranes, especially on vitreous hemorrhage, diabetics, trauma, there's a lot going on inside the eye, you know, is it retina, is it not, but the A scan can be helpful, because if you see a real high spike on A scan, it usually is retina, and even though it's a dense vitreous membrane, you won't get that high, as you scan the eye, look at different membranes, you'll see membranes in this area here, but to get that real high spike, that's very suggestive of retina, so if I see that, I lean more to work retina compared to a vitreous membrane, so it can be helpful to do the A scan, in those cases we're not sure, shows different configurations of detached retinas, there's kind of a shallow one, but it attaches the optic nerve, you always look for that, you find upon the optic nerve shadow, and then you look and see if there's an attachment of the membrane there, again that's more suspicious for retinas, not diagnostic, you can have a dense vitreous membrane that still attaches at the optic disc, but it's still, you see that with a high A scan spike, that's almost always going to be retina, there's kind of an interesting affinity pattern on the long-standing detachment with cysts inside the retinal cyst, there's kind of an interesting pattern there and this is supposed to play, but it just somehow never works on my, you know, what I'll do is I'll hook up my laptop after this and show you some of the kinetics, have it on that, it will play and then I show this, it'll actually show the movement of these different membranes, this is case of a vitreous hemorrhage and you'll see the kinetics of it versus retina detachment and other things, there's a small melanoma right here with an overlined retinal detachment and it shows the top membrane versus the more fluid membrane of a vitreous membrane and here's a melanoma, here's a retinal detachment over it and here's a vitreous hemorrhage, it's kind of fluid flow as the eye moves, I'll try to show all those to you with my laptop, and the A scan shows a high spike here and it can actually have movement of the A scan, there's a little wiggle of the A scan that goes along with the membrane versus a solid lesion, so indication, vitro and pathology, optic disandermalities, so this is a very common thing we see in clinic, you know, headaches, especially the younger person and women, teenage years, headachey and have these funny looking discs, everybody gets nervous and sends them to the neurologist, MRI, CTs, angiograms, whatever else, 25,000 over a workout, you do this in about five seconds to see the drusen popping out at you there, and sometimes it's obvious that you see the drusen just looking at the disc, you'll see these, but in fact all bodies on the surface of the disc which go on with the dense disc drusen, sometimes you're not so obvious, sometimes you're more buried, they actually look like pathodema, they can look pretty scary sometimes, but again by doing the ultrasound you can see the bright refraction from the drusen, everyone here varies looking like pathodema, but again the bright refraction, now sometimes it's not drusen, this is exactly where the A scan can be helpful, here's a swollen looking nerve here, but the B scan doesn't show any bright, in fact all bodies, you see just a normal optic disc appearance here, but you see a little bulge of it there, so this is an elevated disc, but the A scan actually quantitated it, so here is the left eye, so this was the normal eye, so right here is the surface of the optic nerve, here's the other side, so the actual nerve thickness is right there which is pretty normal, like two and a half or something, but here's a thickened optic nerve from there to there, so rather thick, as you have the patient look to the side three degrees, it actually thins out, it's called the 30 degree test, you may hear that neuro ophthalmology to go through it, and as the patient looks straight ahead you measure the nerve and you have to look 30 degrees to the side, optic the eye, and actually thin the nerve out, as the theory is as you stretch the nerve the fluid kind of distributes and thins the nerve out, watch this thing just kind of thin down as they look to the side, so it can be helpful to distinguish a swollen nerve from a pseudo pathodema situation, here is a case, so Reese, what is this, look at this patient walks in, sudden loss of vision, just right first, you got a reaction, pattern recognition, what's that? Think of an artery? Yeah, central retinal artery, check that red spot, and actually it just stands out because it's the edema around it and just makes it look more prominent, and this is a boxcarine, if he's lucky to see this fast enough, he'll see the red cells actually get this, kind of move along, just like little boxcars, just like a train going by, they're all clumped together, there's a fluorescent, the same thing, this shows a difference, so this case, I looked with the v-scan, and there was a embolus right, the optic nerve, right the central retinal artery, and this is the reason, you see the difference, the reason is more anterior, the anterior to the lamina crevosa, where this is posterior to it, so these are more posterior, so about a third of the time, one of the studies by Sear got out of wills, then about a third of these patients, the central retinal artery occlusion, blocks can have the demonstrable embolus on v-scan, so it's worth doing that, from the five o'clock Friday night situation, you're on call, you've got a v-scan handy, just look for that, if you see that, right away you know what it is, it's an embolus, causing that, this patient went on to have a CTN geography, and join the blockage here, and also right this area here, so color doppler, I do some of this, we don't really have a capacity here, it's over in the main hospital, but that's kind of our goal, these are doppler units, which is used for general ophthalmology, I mean general ultrasound, licking its vascular occlusions and things, being the thrombosis, crotted arteries, things like that, but also it can be adapted for the orbit, so the doppler effect, change in frequency of the sound wave caused by movement of the reflector, kind of stand on the train tracks, and the train comes towards you here, blows the whistle, and goes past you, you hear a different change in the pitch of the whistle, that's a doppler effect, same thing used in astronomy for the big bang theory about the blue red ship, anyway a color doppler in the orbit can be helpful for blood flow, so here's a normal color doppler, so the eyeballs up here, your optic nerves down in this area here, and this shows red is arterial flow, blue is venous flow, this is a normal looking doppler, here's the central artery over here, I'll mention the ophthalmic artery, central artery here, carotid vessels here, as you can see this distribution of blood flow, just nice and healthy looking, here's a hemorrhage inclusion, because the half is just wiped out, so here's the half is normal, this half is gone, so the blood flow is blocked by a small embolus sitting up there, here's the giant solar doritis, these just wiped out the orbit, it's just like a dead orbit, they really, every blood flow blocks, these are really just kind of, that's why they lose vision so rapidly and so profoundly, because they just have total occlusion of the blood flow to the orbit, from the giant cell, that's why they're so dangerous, you gotta read them right away, say the other time, I've not mentioned the embolus before, so here's an embolic plaque here, again behind the lamina, we're also up here, right there, over with venous flow, here's the normal subterraphthalmic vein, kind of a nice venous pattern right there as it looks apparently, here's a patient with fistula, the arterialization of the venous flow, it comes red, blueish, kind of makes this very high flow situation, we can actually measure flow with color Doppler and get the flow rate, it's a lot faster than these, tumor vascular cure, you can use this to look at tumors and look at blood flow in sight, but I don't usually do that, I just look with the A and the B scan, I can usually see kinetics with that, UBM, this is my days at UCLA, we used to do it this way, it's a different form of torture, we graved the whole phase, fill it full of water, and the patients love that, it's like they were scuba diving, put the probe in sight, some things were left, I'm working now with these little shells, I think we use covers on the tip, high immersion, you can go again, the standard probe is 10 megahertz, this is a 20 megahertz, so here's a, here's kind of a peripheral view of a tumor with the B scan, if you put immersion shell on and look at it here, you can see the tumor much better, this is aditinoma, good to make a urge to get these beautiful pictures, corn is up here, here's the iris, there's a silver body, there's the lens, you see some zonials down here, it's really eye make, pictures of the front of the eye, there's iris cis, we see these, not uncommonly, you see this multiple cis pushing the iris forward, here's a case we had years ago with Albatali, this kind of a chronic endophthalitis after a cataract surgery, several years out, kind of a chronic inflammation, kept coming back, it's about a treatment, and we looked at the UVM, and here's the IOL, you see a plaque stuck right to the IOL, this is p-acne, plaque growing there, on the surface of the limb, and here's a case of an oxyndrome, UV-itis, hythema, glaucoma, chronic inflammation after cataract surgery, here's a haptic here, if you get closer, if you follow it, it actually touches the iris and rubs on the iris and causes this chronic inflammation, so nice way to demonstrate that, case I saw not too long ago of a, during the cataract surgery, probably the tip of the fecotip, hits an instrument inside the eye, a little burst of particles blow up, when I've got stuck to the lens, right there, you see that, causing kind of a chronic inflammation, and here's a case of a cyclobalysis patient had a trauma, so their body was just detached completely and causing hypotomy, here is, here's a neurodotalysis again, showing just the breakthrough here for the eye were separated, this shows a different, same lesion here, this is a cystic lesion with a 10 megahertz standard ultrasound with immersion, here's a 20 megahertz in terms of 50, just showing the resolution we can get with these higher frequencies, studied by Shields, I copied this out of one of the journals, interesting showing the versus OCT versus UBM, OCT is great in the answer chamber, you just get great resolution, you start getting behind the iris though, you really can't see, behind the iris that's a problem with the light based technology like OCT versus ultrasound, so you see that bulge in the iris here, but here's the actual lesion behind it, here's the bulge, here's the lesion, bulge, lesion, so you just can't see these unless you do the UBM, you can see the iris bulging forward on the front surface, but you can't see what's behind it, again a number of cases, again the same thing, large lesion here, so you can just see how much you can miss without doing the UBM, so it really is important, and I thought about iris pathology, so everybody you have to do these, so we're descending now, so hopefully I can get this video to play to show you how to do kinetics. Alright, so here's a attached retina, some vitreous hemorrhage, and you can see as the eye moves, see again that stiff movement, just a stiff, it doesn't really flow freely like a vitreous membrane would, see again the stiffness of that membrane versus the fluid nature of the vitreous, you can see the difference, it attaches there at the optic disc, again here's that tumor, but this is the vitreous, this is the attached retina over it, you can see as the eye moves it just kind of that taut, like you tighten a rope or a string and twang it, whereas the vitreous stuff really is just moving very fluidly, now there here's a tumor, but there's the attached retina over it, just very stiff, just not fluid moving, here's a PVD, you can see the fluid movement of the vitreous, the posterior highlight phase, put some vitreous hemorrhage, just kind of that very flowing motion, compare that stiff movement of a retina, so kinetics are helpful, so when I see a membrane like this, and you're not sure if it's retina versus vitreous, I do a number of things, I look at reflectivity on both A and B scam, I look at movements, kinetics, I try to follow it out, because often vitreous membranes will not, they kind of disappear, as you follow them peripherally they get weaker and weaker, whereas retina detachments stay strong all the way they're periphery, so those are things that I kind of watch, the vitreous hemorrhage again, this is a dense membrane here, but it's again very fluid as the eye moves, it just kind of flows, it's not that stiff movement like a detached retina, so a posterior highlight phase can be rather dense, so they give blood deposits on them over time, it'll get kind of dense and B scam look like a detached retina, but again by the movement of the B scam kinetics, and also the A scam reflectivity, you can rule out detached retina versus vitreous hemorrhage here, this is actually a tumor, but there's blood over it, you can see the blood is kind of flowing, it kind of moves, it just kind of flows under the retina, under the detached highlight phase, I'm sorry the retina's not detached, so again kinetics are helpful, I do this a lot, look at these membranes that are deceiving, you can also actually see blood flow on the, I'll discuss this a bit more tomorrow, talking a bit more about tumors, but you can show what I've got here quickly, so the A scam I look internally, there's a lot of movement going on here, this is really this rapid flicker inside, this has to be rapid spontaneous flicker, consistent with blood flow, I'll show you one more here of the B scam, this rapid little internal flicker to see inside the lesion is this flickering, it looks like starry night, stars in the sky at night is kind of flickering, so again it's very helpful to see that with real time because not many things do that except melanomas, it's that rapid flicker inside the lesion, okay, so that's it, it's kind of an overview of what we can do with ultrasound, A B scan, Doppler, UBM, so there you go, see you tomorrow


Sometimes we need to consider the negation of a conjunction. We have cookies and cream. We do not have cookies and cream. Or we might need to consider the negation of a disjunction. You can have ice cream or cake. You cannot have ice cream or cake. Let's consider what these statements might be logically equivalent to. To begin with, let's see if we can find a statement logically equivalent to the negation of the disjunction a or b. And so let's construct our truth table. And let's think about this a little. We see that most of the time the negation of a or b is false. And this occurs a lot of times with conjunctions. In most cases conjunctions will be false. Now in order for our conjunction to be true, both statements have to be true. And so here we see that if this is going to correspond to some sort of conjunction, the only time it's true is here. And in order for both of the statements to be true, the two statements have to be not a and not b. So if we negate a and b, we see that not a and not b will be true when a and b are false. And so the negation of a disjunction looks to be the conjunction of the negations. Let's verify that by filling out the rest of the truth table. And so we see that the negation of the disjunction does have the same truth values as the conjunction of the negations. And this leads to a very important equivalence that's usually known as de Morgan's law or at least de Morgan's law part one. The negation of a disjunction is the conjunction of the negations. Not a or b is the same as not a and not b. So for example, we do not have cookies or cream. Well, we can rewrite it. This is the negation of the statement, we have cookies or we have cream. This is actually the disjunction a or b. And de Morgan says that when we negate a disjunction, we get a conjunction of the negations. And so this will become not a and not b. We do not have cookies and we do not have cream. How about the negation of a conjunction? Well, let's construct our truth table. So the negation of a conjunction appears to be true in most cases.  Now remember, the only time a disjunction is false is when both of its component statements are false, which suggests we might want to look at not a and not b and the disjunction not a or not b. And we'll complete the rest of our truth table to verify their equivalence. And so it appears that the negation of the conjunction is the same as the disjunction of the negations. If one of them is false, so is the other. And if one of them is true, so is the other. And so we would say they are logically equivalent. And this gives us the second of De Morgan's rules. The negation of a conjunction is the disjunction of the negations. So if we may rewrite the statement, you may not have cake and ice cream. And this appears to be the negation of you may have cake and you may have ice cream. And that is a conjunction. You may have cake and you may have ice cream. And so De Morgan says that the negation of a conjunction is the disjunction of the negations. And so this will become not a or not b. You may not have cake or you may not have ice cream.


This study examined a new method for predicting the resultant force caused by ballistic impacts. It focused on testing whether this method could accurately estimate the force when the impactor did not penetrate the target. This method was designed to be used for the assessment of military aircrafts with integrated ballistic protection systems. The results showed that the method was effective in predicting the forces generated by different types of ammunition as long as the conditions were consistent with the bullet splash hypothesis. Therefore, it can be concluded that the load history approach should only be applied after thorough experimental investigations into the specific impactor-target interaction. This article was authored by Ricardo Andriotti, Andrea Cazzaroli, Ivan Colomartino, and others.