Ukraine's FPV drones are getting more lethal for Russians. Ukraine is tinkering with its fleet of first-person view drones, one of the most popular drones in its battle with Russia in the air, to do more damage to Moscow's armoured vehicles as Kiev struggles with dwindling ammunition stocks from its Western allies according to Newsweek. Ukraine has said it developed armour-piercing ammunition, known as explosive-formed projectiles compatible with its fleet of FPV drones. According to Ukrainian media, it is designed for use against military vehicles with some measure of armour, including armoured personnel carriers or infantry fighting vehicles and self-propelled artillery. The ammunition can travel at 1,800 metres per second according to Ukrainian sources. Explosive-formed projectiles or penetrators are not a new technology, but a version of standard armour-piercing shaped charge rounds said military expert David Hambling. EFPs penetrate less armour than other shaped charges, which is why they are less popular, he told Newsweek. However, they provide a much longer range. The main advantage for the ammunition on Ukraine's FPV drones lies in Kiev's operators being able to trigger the round from afar. EFPs will also zip right through cages or netting, which is often used to protect vehicles from FPVs, he added. FPV drones quickly became almost emblematic of Ukraine's efforts with unmanned aerial vehicles. They can be used to record dramatic battlefield footage where the drone careened towards Russian vehicles before exploding or deployed as reconnaissance tools to guide artillery strikes. Makaylo Fedorov, Kiev's Minister of Digital Transformation, heading up Ukraine's drone efforts against Russia, told Newsweek in December that they work sometimes even more efficiently than artillery. As concern deepens over Ukraine's scarce stockpile of ammunition, the new EFP ammunition attached to FPV drones may offer some help in bridging the gap between Ukraine's ammunition stores and the reality of how many shells it needs. Belarus' Mazir oil refinery workers panicking over Ukrainian drones. The latest wave of Ukraine drone attacks on the Russian refinery system is likely to have a more meaningful impact on Russian refinery production than the ones in January and February. Since then, there has been another flurry of drone attacks across a further five refining sites, resulting in primary processing capacity outages and lower refined product exports. The recent wave of Ukraine drone attacks on Russian refinery infrastructure has been focused on primary processing capacity and is expected to have a more substantial impact than the attacks earlier this year. In this condition, Russia may use Belarus' Mazir oil refinery, but the wife of a Mazir refinery worker told Charter 97, media outlet that the plant workers are panicking about a possible drone attack on the plant. In Somnia, I've been living with these feelings for the last week. My husband works at the Mazir oil refinery. The company's workers are afraid that a drone may also fly to them. There is nowhere to leave the plant, since none of the other institutions can compete in salaries with our city-forming enterprise. At the plant, among close colleagues, everyone is just discussing this topic, what to do, how to deal with the situation, she added. I myself monitor situations through independent websites and telegram channels. Every day I ask my husband what is new, but the plant management says nothing. People go to work silently, scared. I am afraid that my children will become orphans because of political games. With the outbreak of the war, our city turned into some kind of unpredictable volcano. Either we are treating the wounded or gathering them for training camps, or there is military equipment that is scary to approach, because they will immediately mark you as a terrorist. We have actually been living in the frontline zone for two years now. And now we are still waiting for the drones to arrive. If you think about it, the Ukrainians have an absolute right to attack our plant as a source of fuel for a war against a neighbouring country, she said.


Roma wines present Suspense Roma wines made in California for enjoyment throughout the world Salute your health senor Roma wines toast the world the wine for your table is Roma wine Made in California for enjoyment throughout the world Roma wine company of Fresno, California welcomes you again to this weekly half-hour of suspense Tonight from Hollywood Roma wines bring you a star mr.  He says thank you my friend Thank you also for telling us about the perfect climate and soil of California from which we import the supremely delightful Roma wines now we can understand how such perfection is possible such a magnificent quality as we enjoy in Roma wines You will agree it is a tremendous tribute when other countries find Roma wine so superior They import them as rare and expensive delicacies Such international esteem can only mean that Roma wines are truly magnificent in quality But remember you here in the United States can enjoy these distinguished wines at almost Unbelievably low cost for you pay no high import duties no expensive shipping costs You enjoy the unique combination which makes Roma wine so superlatively fine The combination of California's perfect soil and climate and age-old winemaking skill Plus Roma's modern quality controls for only pennies a glass Discover the delightful flavor and goodness which have made Roma wines America's largest selling wines ask for Ma Roma wines made in California for enjoyment throughout the world And now with the beast must die and with the performance of Herbert Marshall as Felix Lane Who wrote a diary of death? We again hope to keep you in suspense I'm going to kill a man. I don't know his name. I don't know where he lives. I Have no idea what he looks like But I'm going to find him and kill him Well, mr. Lane, I wrote those words if that's what you're asking inspector and I meant them apparently you did Whatever possessed you to write such a document vanity for one thing I suppose a Record for posterity of the perfect crime As you know, I am a writer by profession. I think more clearly on paper By keeping this diary. I was able to plan my murder Step-by-step but you found out that a real life murder could not be carried out so easily as the murders You wrote about in your detective novels a mr. Lane. I wouldn't go so far as to say that inspector in fact Except for the ending. I think this diary is quite the best murder story. I've ever written I'm quite the most incriminating document. I've ever known a prospective murderer to leave lying around incriminating No way I suppose in another way this diary might turn out to be my best defense Well, how do you figure that mr. Lane? Well supposing I read some parts of it allowed to you and that you decide for yourself very well, mr. Lane Far away. That was my first entry June 18th Yes, I am going to kill a man It takes great singleness of purpose to commit a murder But if ever for a moment I stray from that purpose I Have only to think of Ronnie Ronnie was my son One evening two weeks ago. He was crossing the road outside our house He had gone into the village to buy some candy For him it could have been only a paralyzing blaze of headlights around the corner a moments nightmare And then the impact turning everything to darkness forever His body was hurled into the ditch He was dead at once The motorist who killed Ronnie Did not stop The police have failed to trace him They say must have been going 50 around that blind corner for the child's body to have been thrown and injured as it was The man who drove that car He is the man I have got to find and kill June 25th. I found my first clue today My mind was on Ronnie. I was driving toward a neighboring town The hills around were green the box were hedges still damp from last night's rain translucent like giant chunks of emerald Suddenly the front wheels of my car hit into a great puddle and a sheet of water Splashed up over the front of the windshield and drenched me from the side. I Pulled up at the far side of the water splash. I got out cursing myself from my preoccupation and began mopping away at the windshield a Man leaning over a farm gate addressed me What looks like you got a proper shower bath, mister Yes, I'm in pester in the county for months repair that hole in the road People always driving into it and splashing themselves all over Funny thing of all though It was about a fortnight ago when a chap tried to use it to get a free car wash Oh really? It was my wife's birthday to be exact. I'd eat a clock We was on our way to Chelanum to see the picture show just we was coming out of the gate This chap driving one of those low slung sports jobs hits the water splash. You don't say And then this fella he says something to the girl he's driving with and what do you suppose they do? Well, they backs up and runs through the splash again, and then again. They did it four times Eight o'clock Your wife's birthday It wouldn't be June 3rd, but oh Right sure, but how'd you know? Oh? Well, you see her That is a friend of mine was rather celebrating that night and driving toward Toad seven bridge. That's where this fella and his lady friend was going I remember his lady friend says George ask the man whether you turn right or left at the next four George Yes, yes George. That's right. That's my that's my pal's name and seven bridge Yeah Yes The way he drives auto brought him by here just around eight o'clock He um, he didn't have a crumpled right front fender, did he? Well that he did If that bloke was your friend, he sure is a proper nut. Well peculiarly. Yes Yes, he is peculiar Driving through that water splash all over again and again four times. He doesn't and he wasn't laughing either Didn't seem like a joke somehow Looks like he's trying to get a free car wash Funny way. I'd say to get the mud off. Yes Maybe it was tar though. Yes Oh blood July 12th at seven bridge I've talked to any number of the town's people and I've met a number of Georges But not one of them have owned or driven a low slung sports job Not like the one I've been looking for anyway Maybe that I'll have to start all over again on some other tack July 14th, I Was returning to the Inn this afternoon when I noticed a car parked on the side of the road up ahead The girl with bright hair was working at the front wheel and a small lab beside it was doing his best to help I Pulled up a silent It was a low slung sports job. I Say, can I can I help? Well, what do you think Phil? Oh, yes, sir, please if you would lend a hand I'm afraid we're not quite heavy enough to wait this jackhandle down for another turn. Yeah, fella Let me let me have a go at it. The paint doesn't seem quite to match on the right front fender the fender Oh, that had a new fender put on a while back. It's got bummed up or something I can't tell you how awfully nice it is of you to help us out I'm not at all By the way, I wonder if you and Phil here wouldn't stop for tea with me at the Inn afterwards. It's not far, you know We're expected at home, sir. Perhaps you would come along with us What do you do, sir? Hmm? I'm a writer Phil. Oh, you really must come to see us It's Gables on Devon Road. My brother-in-law's place. The name's Rattery We'll give you a ring tomorrow and set a date. Cis will love meeting a real author and so were George Did you say your brother-in-law's name is George? July 16th, I've met him. I've spent an evening talking to him George Rattery So you're a friend of Lena's, eh? Storybook detective A writer. Easy enough to write about a dead body, but I'd like to see an author that has guts enough to look at one I have been more than a little afraid that George might turn out to be a sympathetic character That need not concern me any longer. I shall have no compunction at all about putting his light out It appears that George is the half owner of a garage down in town Man by the name of Carfex is the other partner a garage That would explain how the damaged fender got itself fixed by the police knowing How can a beast like George have a fine young son like Phil? This afternoon, I was rounding the corner of the tea house in the Rattery's garden when I heard voices It was Lena and George. I stopped in my tracks and eavesdropped shamelessly That's a neat wig you're wearing today, Lena. Is that for Felix Lane's benefit? Save your compliments for that Carfex woman. Jealous.  And since when did you get so high and mighty?  Aren't we miss snow white? Just try something and you'll find out Remember there are quite a few people whom I'd like to know about that poor little kid you ran down last June If it weren't for violence and Phil I'd stop that kind of talk. You know just remember you were with me that night, huh? August 5th Had a look around the Rattery Carfex garage this afternoon told George it might come in useful as material in my book All at once I heard a shot and there stood George blazing away over the plot in back with a rifle. I Went up to him Yeah, it's another one of those pests out of the way We've tried everything traps poison rat hunts. We can't keep them down that That's a nice rifle. Yeah, give it a Phil last birthday when he came back from school in Switzerland much too good for him Yeah, like to have a go at him I raised the rifle and sighted George's back was to me By shifting a few inches to the right the bullet should enter the base of the brain Who could prove that George hadn't suddenly stepped in my way my finger tightened on the trigger Say George, I can't find that new tin of rat poison Phil was spreading some out in the dump yesterday. I wonder where he put it Oh, hello there Lane. Hello, Carfex Watch out real point in that gun. We wouldn't want anything to happen to the senior partner Not very funny August 12th, I Am now a guest in the house of the man. I'm going to kill Violet Phil's mother suggested that I come and stay with them for a fortnight and help Phil in odd hours with his Latin George much to my surprise joined in heartily with the idea. I wonder why I Must watch him very closely because of what happened last night We were having coffee in the drawing room after dinner when the conversation took a most extraordinary turn They were talking about Violet's new rose bushes I suppose they'll be very nice But I come for the life of me see why you went to all that trouble. Well, the old ones weren't doing very well They were still alive weren't they mother? Oh, yes, dear, but I'm not one to keep something going when it's only half alive Oh, I'm glad you're talking about rose bushes. I should hate to think you felt that way about people course not But on the other hand, I do think if a person were incurably ill that they ought to Well, that is they ought to have the right to ask their doctor to put them out of their misery Don't you think so Felix? Oh Speaking of doctors reminds me George.  Well, I Well, what about your incurable social pest the person who makes life miserable for everyone else around him? I think a person would be justified in killing someone like that. I Do think you're all getting a little morbid. Well the kind of a person I described is no right to life Of course, that's and say I I would kill him if I could do it without running my neck into a noose Now in my book, I'm working on a very pretty murder Quite my masterpiece. I think where he's done close about it locked doors seal lips and all that Of course, he says he's writing a thriller, but we've no proof Have we I think he was sure it's the manuscript. Don't you leaner? I can't I'm sorry. I hate anyone to see an unfinished Manuscript of mine. I'm funny that way. Oh Felix, please get it and read some of it.  I go get it myself and read it out loud if the blushing author is too coy Bye heaven. I'll go upstairs and get it now. You'll do nothing of the sort. I forbid it I will not have people snooping about among my manuscripts It was close After all there is no book at this diary. I must keep it well hidden in my room August 16 At last I have my plan It took a great deal of subtle taunting and persuasion, but it came off at last George is going sailing with me this afternoon and He can't swim Clowning is very painful they say in the early stages. That's good. I'm glad George's lungs bursting the top of his head shrieking with pain His hands scrabbling vainly to thrust against the giant weight of the water But if I cannot kill George today on the open sea with the wind in my favor and myself the undisputed master of the situation if I fail today Then I will know that it is not my destiny to be a murderer and I will make no further attempt on the life of George Rattery And that Inspector Brunt is the last entry in my diary But you and George did go sailing didn't you? Yes was after lunch on the same day. We walked down to the docks together George as you can imagine was rather clumsy about a boat It was only a few minutes after he clambered aboard that we were out in the main water sailing free George had his feet braced against the centerboard case and his hands grip the gun Squall was coming up that motorbodies getting pretty close, isn't it? Oh, they're depending of room George power vessels have to give way to saving vessels, you know give way How do you think about that size is gonna give away to a crate like this? What are you up to? You can't do that.  I'm bloody willing I'll be a leg and do it both down. Perfect miss safe. Perfectly safe that barge didn't miss us by a yard. The same thing happened the other day when I was out with Phil He didn't lose his nerve. Oh, he didn't eh? By the way, you'd better not stand up on the boat again That's one thing that's not safe. Very well my friend I shouldn't fire any of those funny tricks you've been planning. Tricks what tricks?  I searched your room just before lunch.  So you see it'll be most unfortunate for you if you let me drown Well, what's the matter? Must your lying tongue have you?   She was with you that night the police could get a confession out of her in no time.  I guess we've both been a little too clever. It looks like a stalemate George stormed off the minute we landed I came straight here to the end. Yes, I know Perhaps it's just as well. I didn't succeed going back to writing detective stories after committing the perfect crime would be like Going back to playing with tinned soldiers after winning the battle of Waterloo You seem to be awfully sure of your alibi Well after all there's no crime in planning a murder is there providing nobody is hurt Unfortunately, somebody has been hurt. What do you mean? What are you trying to tell me George Ratry died yesterday evening of the effects of strictening poisoning George dead strictening poisoning all My planning all my high and tragic purpose The beast ends by taking his own life Poison I remember now. Yes. He used to talk about suicide quite a lot But I thought he only did it because the subject was so upsetting to his wife. I never dreamed How did he take it with his tonic? But he couldn't possibly have been suicide. Mr. Lane, but who? What else could have been it could have been murder Unfortunately, we have no evidence except this diary of yours of the bottle the tonic George Ratry died almost Instantly after taking his tonic at dinner But before the doctor arrived that bottle disappeared Well, any suspects every person closely associated with George Ratry had enough motive to murder him But you have the strongest motive after all George Ratry did kill your son Am I under arrest? Not officially as yet, but naturally I have posted a guard outside your room in the meantime Go in there. It's all Please mother I say it's no good Why couldn't you stay at home? Let him let them come in Good afternoon, Mrs. Ratry Phil Phil Phil Felix, please please. I can't stand it any longer. They're accusing Felix here of murdering my husband He had nothing to do with it. He doesn't know what she's saying. Heaven's sakes Phil will you be quiet? It was I who killed George. He treated me very badly. He was unspeakable to Phil. There was another one Oh, I can't go on.  Where did you get the poison Mrs. Ratry? Well, I bought it at the chemist shop what chemist shop the one on Abbey Lane Near the corner of high towers. That's it. Mm-hmm What became of the bottle of tonic after your husband's death? I broke it. I buried it. I'm sorry, Mrs. Ratry the police have checked You didn't buy any poison at the chemist. Mother. I told you it was no good Sir mother is trying to save me. It was I sir. I killed him. What fill me don't leave him Don't believe him.  He doesn't know what it's saying go on Phil Well, you see sir, I left a note. I was running away, but mother found the note before I quite got out the door Boys get such strange ideas. He couldn't have done it. He's just a boy. You know he couldn't you see sir When they accused Felix here, I couldn't stand it any longer That's why I wrote you the note but mother found it first She said if she confessed they wouldn't do much to her the police would understand Felix make them believe me. I can prove I did it on tell you you say you can prove it now What do you mean? I have it in my pocket, sir. I've had it here ever since see here it is It's still half full. It's bad bottle of tonic. Oh, where did you get that? I took it off the buffet after the doctor said dad was dead. This is very serious Phil. You know that He's lying. He couldn't have he's just a little boy. He's all of you. I have a favorite to ask Let me talk to Phil alone for a few minutes. It won't hurt anything. I think I may be able to help solve this whole thing Phil didn't do it while it's right. Yes, but the bottle just give Phil and me 10 minutes alone Very well, we will wait outside Come here Phil, I'm a murderer Felix. You're not a murderer Phil No one could ever tell me that I left and no we've gone all over that I Killed him. He beat mother. I killed him. I know better They thought you did it Felix. I heard them talking about your diary You wanted to kill him. You said so in your diary. Maybe I did but they'd hang you Felix So that's why you wrote the note and pretended you did it Yes, I saw you in the pantry with that bottle of tonic before you went for the sale with them.  You mean I'm not going to hang you Felix They're not going to hang me. You won't let them do anything to you. Will you know? I won't let them do anything to me But Phil There are other things for you to think about now now that your father's gone. You are head of the house That's a man's job Phil There's a lot you've learned about courage these last few days Living takes a lot of courage This is pretty grown-up talk Phil Do you understand me? I'm trying Felix You remind me a lot of my own son. You mean the boy my father, right? That's right Phil Yes, you're a lot like him. Would he have gone sailing with us? Yes Yes, I think Ronnie would have been quite a sailor. Can we go sailing tomorrow Felix? Not tomorrow Are you going away? Yes, Phil But not as far as most people might think you sound very strange Felix. I have a note to write Got to make everything ship shape You go on out to your mother and tell them they may join me in a few minutes God, I wait no Phil go ahead now. Those are orders Skippers orders. Aye aye, sir Goodbye, son. I thought I had made the last entry in this diary But there will have to be one more This diary was kept for one purpose To make George and the police believe that I plan to kill the beast by drowning him Death was already waiting for George Rattery at home in the bottle of his tonic Where I had placed three pellets of rat poison taken by me from the garage my pan was almost perfect The only thing I didn't expect was that someone loved me enough to try to destroy the evidence I had so carefully planted in an effort to help me and even to confess to my crime in order to save my skin I know now that my life ended with the death of my son Ronnie It seems that I must have just come back to life for a few weeks to save Phil Yes, I killed George Rattery. I have no regrets. I Might have known that the matter would be taken care of fittingly It says in the Bible The beast must die But the man died also Yay, they both must die George was right about that tonic of his It is very bitter And So closes the beast must die starring Herbert Marshall tonight's tale of suspense Suspense is produced and directed by William Spear Have you discovered the age-old secret of famous chefs and lovers of fine food? Namely how good wine makes even the simplest most inexpensive meals really exciting events How Roma wines perform flavor miracles in bringing out rich new savoriness Well the next time you cook any of the red meats stews fish or poultry add a generous portion of any Roma, California Table wine delicious sautern hearty burgundy or tasty claret then put the same bottle well chilled on the table with your meal You will be amazed at the wonders Roma wine performs in bringing out all the appetizing goodness of even the simplest foods Remember Roma wines these marvelous aids to greater enjoyment of daily meals cost only pennies a glass full So any home can afford the pleasure they give to everyday living Ask for our OMA Roma wines America's largest selling wines made in California for enjoyment throughout the world This is Herbert Marshall and of the request of the United States Army. I'm addressing this to every soldier listening Volunteers are once more being accepted for immediate training by the parachute troops Paratroopers received $50 extra per month in base pay officers get $100 extra per month If you think you can qualify for the paratroops Apply to your company commander Mr. Marshall appeared through the courtesy of Metro Golden mayor produces of white cliffs of Dover Next Monday same time you will hear mr. Peter Lore with Richard Conte as stars of suspense Presented by Roma wines our OMA made in California for enjoyment throughout the world This is CBS the Columbia broadcasting system


Is it time to repeal the Second Amendment? Hello everyone, Dylan Schumacher, Citadel of Defense, and there's been some talk recently, or at least I've seen a couple articles about people coming out more and more to say, hey, it's just time to repeal the Second Amendment. Week or two, maybe even up to three now ago, I saw some article in the USA Today. I would go find it and link it, but honestly, it's all the same stuff you've heard before, there's really nothing new or interesting in this discussion from the other side. In addition to that, I saw that Michael Moore, again, I think it was maybe two-ish weeks ago now, released his replacement for the Second Amendment. I think it was the 28th, I think is what we're on now, maybe a different number, I can't quite remember, but basically, again, all the same stuff, background checks, these guns are banned, you have no right to guns, whatever, whatever, et cetera, et cetera. And right now, in the house, it's in committee, they are debating a full-on assault weapons ban, which I've seen some clips from that the past couple days, and that one's a doozy. I rise in opposition to the amendment. What this stabilizing brace, which is depicted here, when attached here, it turns this weapon into an automatic weapon, it becomes a bump stock, and so it will allow that to essentially be fired like an automatic weapon, that's the danger, and so I have to very strongly oppose the amendment. So this discussion keeps coming up from the other side, at least it is being more honest at this point, and just saying, should we repeal the Second Amendment? Well, there's a very, very significant problem with that that I know the other side doesn't care about, however, it's worth mentioning anyway. And that is that the Second Amendment doesn't guarantee you anything. The Second Amendment recognizes a pre-existing right. That that's what we believe about American government, that's what the founding fathers who wrote the amendments believed. The Constitution is not a document that grants you certain rights, that can just be arbitrarily moved around or changed or whatever. The Constitution is rather a document that exists to restrict the powers of government and thereby empower and protect the people. That's the purpose of the American Constitution. It's why it's one of the most radically different government documents in the history of mankind ever. And that's a fairly easy thing to say because in history of governments in mankind ever, no government was ever established with the explicit purpose of protecting people's rights. That was never a thing until America showed up. And so in that case, we are unique among the nations throughout all history. And wonder of wonders that this system has led to the most prosperous, powerful nation in history ever. I've made a video about this before, but again, it's worth reiterating, our rights do not come from the government. It's not as if the Constitution lists our rights and those are the only rights we have. And then the government can, at its own whim or at its own discretion, decide to remove or exchange or add or whatever rights to that document. That is not how rights work. Rights rather are inherent in mankind and the government recognizes those and respects those. That's it. It's really that simple. Rights do not come from government. They come from God. And when you lose sight of that, it's very easy to get into this thinking of, well, all we gotta do is just repeal the Second Amendment or pass some weapon bans or whatever and that will fix the problem. Now you and I know that that would get nowhere near to fixing the problem and the people who are passing those laws know that would not fix the problem. They're obviously interested in disarmament, not in actual safety or anything of that matter. However, as the common argument goes among the normies, right? The idea is, well, the government can just change the law. That's what we do, right? That's why we elect people to Congress. That's why we have presidents and judges and all these things to change laws when we need to. You know, look, we've just outgrown the law of the Second Amendment, so we need to change it. Rights are not up for vote. It really comes down to being that simple. Rights are not up for vote. Now, I can hear the cries of Roe v. Wade right now.  Well, unfortunately for you, murder isn't a right. So I want you to remember, laws come and go and whether or not they ever repeal the Second Amendment or pass a ban on these types of weapons or these types of magazines or whatever, rights are immutable. The right to self-defense never changes. Most governments throughout all history have recognized the right to self-defense. Rights are immutable and the nations who have ignored the right to self-defense in history have done so at their own peril. So laws may come and change. They might ban these weapons or change this or change that or repeal the Second Amendment but at the end of the day, the facts of the case are never going to change because rights are inherent to human beings and come from God, not government. The government can pass laws and deny reality but at the end of the day, reality always wins and you're gonna have to come home and deal with the consequences of whether or not you choose to respect reality. Think about it. Do brave deeds and endure.


The aim is to evaluate the shear bond strength of stainless steel brackets attached to aged composite restorations following various surface treatments. This article was authored by Islamian laden, Borsabadi Farahani Ali, Musavi Nasin, and others.


Well good morning my beautiful friends! We are going to do something slightly different today yet again because I feel like it's important. Something has happened and I wanted to let you guys know.  When I initially went through my surgery, so many people commented on my Instagram, hey you need to follow Amy Purdy, have you heard of Amy Purdy? A lot of you commented on Instagram and at that point I'll be honest, I hadn't. I hadn't done a ton of research into public fellow amputees. When I did look into Amy Purdy, she is amazing and really inspired me. I don't use the word inspired very often, I feel like it's thrown around too much but this is someone who really, really has brought a lot of inspiration and motivation to my life. I feel like the easiest way to describe Amy is that she's just a genuine badass. She lost both of her legs below the knee due to meningitis. I think that's how you say it when she was 19. She also lost her kidney function and lost a spleen. In the aftermath of that she went on to actually win the 2014 Sochi Paralympics in snowboarding because she designed her own snowboarding legs. Designing her own legs is one of the coolest things I can think to do. Now the reason I'm bringing Amy up today, though any day would be a good day to bring her up because she's freaking awesome, is that she's in the hospital right now. Back on February 24th, she posted this. She was asking for prayers because she developed a serious flood clot from her knee to her hip. That's a really, really big and dangerous deal, especially when you don't have super well functioning kidneys. She did receive a kidney transplant from her dad, which is really, really amazing. Dad was a perfect match and the week of my 21st birthday, we underwent the first laparoscopic kidney transplant in Nevada. When most people are celebrating their 21st with shots of tequila, I was celebrating mine with shots of immune suppressive medication and morphine. But with the kind of surgery she was facing, it was basically choose your leg, the rest of your leg, the leg you have remaining, or choose sacrificing the kidney that your dad gave you.  She said in this post that she was more scared that she's ever been, that she's cried from the depths of her soul, that her husband seeing signs of her that he never has before. And I can't imagine the kind of fear, I mean, I can to some extent. The kind of fear you must be facing in that kind of situation. On February 26th, she posted that surgery had really gone well. They chose to focus on saving her leg, you know, focusing on that blood clot and everything went generally okay with the kidney. But then two days ago, Amy posted that she found out that things actually didn't go so well. Blood flow to her lower leg is currently blocked. So she said that they met with a new surgeon, he has some hope, he wants to try a new procedure, and they're gonna try that on Monday. Now today is Friday and I wanted to get this information out to you guys. If anyone is a praying person or wants to send good vibes her way or send her a positive message on Instagram, I will link her information down in the description down below. Please do so. She really is an amazing person. It's been funny to me this morning, the more that I have immersed myself in learning about her and learning about her life and listening to more of her talks, how similar we are. Quick note from editing, Joe. I'm going through this footage and I realized I did not- I made it sound like we're like the same person. No, I mean that I look up to her. Like I aspire to be in so many ways who she is because our interests are like in the same place. I didn't mean like we're the same person. You know what I mean? Like she's not the finished version but she's way further along a very similar path that I desire to be on, if that makes sense. A lot of our aspirations and our inspirations are in the same places. She's big into public speaking. I love public speaking. That is what I aspire to be, aspire to do. That's what I've wanted to do for a very long time. She's super athletic. I am super athletic. I can't wait to dig my teeth into Jitsu and hiking and just the gym in general and the part of her story that really really connected with me in a video that I found of her a little while ago that just unbelievably cool for me to see is that she dances. I didn't know if I would be able to ever dance again and let me clarify I am not a talented dancer. I've never taken a dancing class past the age of like five but I love it. It just brings me so much joy and I was actually wondering the other week. I was like I wonder if that's something that I could ever do again and like look okay doing or would I just be super awkward? I wonder if you can ever like actually get graceful or anything with it and then I found this video. She was actually on Dancing with the Stars and looked amazing. Like seriously just gorgeous and then this was I believe the semi-final round where she used her running blades as her feet for dancing and looked perfect. I love that she talks about the ups and the downs. I don't think she's a very rose-colored picture kind of speaker. You know those inspirational speakers that never talk about the actual bad sides of anything and make it sound like everything was basically easy. They were so painful and so confining that day I went home I crawled into bed and this is what my life looked like for the next few months. Me passed out escaping from reality with my legs resting by my side. I was absolutely physically and emotionally broke. In order to move forward I had to let go of the old Amy and learn to embrace the new Amy. She talks about the rough sides and I appreciate that in so many ways. She is what I aspire to be and holds the attitude that I want to hold on to that I want to be and so I really feel for her during this time and I will be thinking of her and praying for her and I wanted to ask you guys to do the same like I said if you're a praying person or if you just want to send good vibes her way or comment on of her posts that you're thinking of her wishing her well in her surgery I think that that would be awesome if we can just send some love her way that would be great. I also just wanted to kind of tell you about Amy because I think she's great. I think she's really cool. I'm looking forward to reading her book. I think it's called On My Own Two Feet which is funny. I know that a lot of people who listen to me might be interested in listening to her so I've linked some of her speeches below some of her talks. I really liked when she sat down with Lewis Howes of School of Greatness. That was an awesome hour and 17-minute conversation. I think we all want to make a difference in the world somehow like we all have a drive to actually just to do something and live a fulfilling life and hopefully positively affect people and now I'm doing that because of what I went through. In response to that clip you definitely have positively affected people. You've positively affected me Amy and I wanted to thank you for everything you have done and I have not even tapped the surface of it but you've definitely given me hope and inspiration and helped me keep my head on the right way on days where it wants to fall off. So check that out. Check her stuff out.  Let's let her know that she's definitely not alone. We have our fingers crossed for you Amy. I hope everything goes well on Monday and to all of you listening I hope you have a wonderful start to your weekend. I'll talk to you guys soon. Bye guys. What inspires and motivates you? Seeing people live their purpose. Seeing people who are passionate about what they do live their purpose because that feels like you can do it as well.


Hi everyone, my name is Max Bazali and today we'll talk about jailbreaking Apple Watch. Okay. Let me fix it. Oh yeah, should be better. So once again yeah, I'm Max Bazali and I'll talk about jailbreaking Apple Watch. I work as security researcher at Lookout when I focus it on malware detection. Last year I was a lead researcher on a Pegasus exploit chain and currently focused on advanced exploitation techniques for software, hardware. I co-founded Friday Apple team and I'm after various jailbreaks for iOS, TVS and now for WatchOS. So what is Apple Watch? It's a smartwatch device that was released in 2015 and it's used Apple S1 or S2 processor. It's basically 32-bit architecture processor called the RM7K which is derived from RM7A. It uses a Tapticad engine for user notifications. It has a 512 megabytes of RAM and it's running the WatchOS which is derived from iOS. So I hear a question a few times why we even need to jailbreak a watch? Well, I have a few watches at home and so it should be pretty interesting from a security researcher point of view. Why not give it a try? Why not try to jailbreak it? Because it's, if I can jailbreak it, I have access to file system so I can like check the WatchOS internals. And it should be just fun to run a debugger like Redar or Frida on this teeny Apple Watch screen or use it as iPhone attack vector to send some more format data to the iPhone. So before jumping to jailbreak internals, let's make a quick overview of the Apple Watch security which starts from a secure boot chain where the each element in the boot chain is checked to be properly signed by Apple and it basically stops boot if it's not. The next thing is mandatory code signing so all code that is running on the WatchOS should be signed by a trusted party. The sandbox which is limiting application access to other applications data and limiting application access to critical system APIs. Exploit mitigations like address space layout randomization on user mode and the kernel mode, heap and stack cookies and of course the data execution prevention. Starting from second generation of Apple Watch, there is a hardware baked secure enclave processor that's used for safe crypto operations. And the data protection. So all user data is encrypted when device is locked. So after thinking about the possible attack vectors on a watch and the first idea was why not try to send some more format payload or even like fast USB descriptors because there is a teeny port, the debug port on a watch if we detach some of the things we see like this small port. The problem here, the cables from this debug port to USB, they are not public. So I don't want to mess with all the non-public hardware so I decided to switch for other way. The other way will be send a malformant emails or messages or photos from a phone to a watch and try to basically attack the parser. Well, this will be still limited by a sandbox, the parsers. So I need additional out of sandbox bug to continue the jailbreak. Well, starting from WatchOS 2, Apple added the support for user defined application extensions which is basically the native code that's running on a WatchOS. So I decided to stay on this one. It looks pretty good and I have a freedom on a bug choice. So to choose one of the unfixed bugs and use it for a jailbreak. So this is how the jailbreak may look like. So first of all, we need to locate a kernel in memory. All the security measurements are in a kernel so we need to patch a kernel to disable them. For this one, we need to break a Kaisalar and find a kernel base, then read the whole kernel to user mode, start analyzing it, look for gadgets, set up primitives like read write, then finally patch a kernel to disable security restrictions and run the SSH client on a watch. Well, looks doable. So as I say, I have a few versions of WatchOS at home, like WatchOS 2 and WatchOS 3, and I start looking for a good bug. For WatchOS 2, there is a pretty good bug, the CV4656, which is user to free in a kernel. And this bug is famous because it's a part of the Pegasus exploit chain. So this may be a pretty good candidate. As alternative way, it's CV4669, which is a Mac port register. It can be exploited in 32 bits as a free in the run zone. But I decide to stay with OSNs relies because it's more stable. As for WatchOS 3, there are two bugs, CV7644, set DP control, which was discovered and exploited by IonBear in a Mac portal jailbreak, and CV2370, which is heap overflow in voucher extractor site. It was used later by Luca Todesco in Yalu 10.2. So I decide to stay with CV2370 or WatchOS 3. Okay. We now know a bugs, how to get the kernel level code execution. Let's start from leaking a kernel base. There are a few good CVs, CV4655 and CV4680. They both share the same problem. So because during the parsing in a kernel, one of the objects, which is like OS number object, it's basically object constructor missing the bound check-in, which leads it attacker can create OS number with a height number of bits. And later on, this height number of bits will be used as an object length. And the object length will be used to copy how many bytes we need to copy from a kernel stack to a kernel heap and return to user length. So that leads that kernel stack memory will be leaked and we can determine a kernel base. And this bug can be triggered from a sandbox. I will check more detailed. So the bug is in iOS and Serlase binary, which is a method to handle binary Serlase data. It converts a binary format to a basic kernel data objects like arrays, strings, booleans, numbers and so on. And the problem is when the parser goes to OS number. The OS number represents the number object in a kernel. And it's basically blindly trust the input arguments, here is the value in LAN, and just call the designated constructor, which is OS number in it. And here is a problem, because one of the arguments, which is new number of bits, is set to one of the class variable size. And this size will be used later on, on other method is number number of bytes. It's lead that return value of number of bytes is fully controlled by attacker. And why it's bad? Well, later on in ioregistry and target property bytes, this number of bytes method will be used to calculate the OS number length. And which is bad because OS number of value is stored on a kernel stack. Here it is offset bytes buffer. And basically the object length will be used to copy that many bytes from a kernel stack that needed from this buffer and return to user mode. As we control how many bytes will be copied, we can control, well, like, 255 bytes and basically leak some of the kernel memory. If this kernel memory will have any of the kernel pointers, it will be enough to terminate the kernel base. So we know the kernel base, now it's time to get some code execution in the kernel end. So CV4656 is a pretty good. It's used after free in the same IOS centralized binary, in the different branch. The problem here that during the deserialization, the OS string object will be delegated, but the pointer to object still stored in one of the arrays. And later on, the retain method will be called on this delegated data, which leads to use of the free. So if we can relocate this object with attacker control object, like fake OS string, which point to attacker control, we table, we can get the kernel mode code execution. This is how it's looked like. So the same IOS centralized binary, which parsed the binary and coded values and returned to IOS objects. It's the problem in when the object will be deserialized and saved to objects array. So now we see the set index macro that basically stored the pointer of an object, but not doing any memory measurement on it, like not retaining the object. This is bad, because later on, when OS string will be casted to OS symbol, the OS string object will be delegated, but the pointer to it is still existing in one of the arrays. And in the case of IOS centralized object, which is a reference to an object, it will be retained, which causes the use of the free. So we get the kernel level mode execution and the problem that we need to know what to execute in a kernel. So basically there are no watch IOS dump available in public in the time, as well there is no keys for watch IOS kernels. So basically to continue the drill break, I need to know some part of the kernel. And I have an idea why not create the fake OS string pointed to the beginning of the kernel and basically read the kernel as OS string chunk. Looks doable. The problem here that even the object is fake, we still need the real retable offset. And retable offset stored in data const, which means basically I need some parts of the kernel to dump a kernel. It's like a chicken and egg problem. And I start looking for ways, is there any possibility to dump this retable just in a runtime? Well, it is. As we know, the retable is stored in a data const in a kernel. And the data const is referenced in a kernel micro header, which means somehow we can leak the kernel header, we can leak the data const address in a runtime. And the offset to the data const reference in a header is always constant. They are like 0x2 to 4. I determine it from similar XNU build. So if in runtime we can branch to start of the kernel plus this offset, we can leak the data const. And how we can do it? Just use it as a fake retable pointer. So the kernel will crash, but we will get the data const address. Now if we know the data const, I was trying to calculate the offset for retable by checking, again, the similar XNU build from the start of the data const to retable. Unfortunately, it's not just work out of the box because the kernels are different. So I was trying to tune it with plus or minus 4 bytes delta, but in reality, it never works. So later on, I found that the difference are really significant between the watchOS and the iOS. It's like more than 4 kilobytes of difference in a data segment. So this method is not working. Okay, I'll start looking. It should be some other way to do it. And I look at OS string layout in a memory. So for 32 bits, the size of the object is like 20 bytes, for 64 bits like 32 bytes, and the very first pointer of an object is a pointer to object retable, and which is more interesting the layout of the retable. So our bug triggered the user free by calling a retain. And retain is like fifth element in array. So I start looking, well, it should be some way to like reuse this information. Here is what I mean. We have the OS string object layout in a memory, and the very first pointer of OS string object is point to object retable. And retable is pointing somewhere in a kernel code section, and our trigger, which is OS object retain, is like fifth element in array. Okay, so how we can use it? What if the object that will be triggered in a bug will be delegated but not reallocated? So this memory chunk will be marked as free, and which is more interesting, this free memory chunk will be pointing to the next free memory chunk in a free list. This is interesting. This is how it looks like. So we have a node in a free list. We have a free list head, and each node is pointing to the next node in a free list. And again, it's like the first pointer in this free memory chunk is a pointer to the next free memory. So what if we not reallocate OS string object? This memory will be marked as free. And basically, now it's pointing to the next free node in a free list. And this pointer will be interpreted as OS string retable pointer. So if we call retain on it, it will basically branch out of bounds on the next node. This is what I mean. So again, we have the nodes, each node is pointing to other node. And if we call the user to free without reallocating an object, one of the nodes will be interpreted as OS string. And the beginning of the node is a pointer to the next node, and this pointer will be interpreted as a pointer to OS string retable. Then we call retain and run out of bounds, basically branch out of bounds to the next node. But what if we can control the next node? So if you spray OS string objects, make a few holes on the heap, then basically trigger user to free. The pointer to the next node will be interpreted as a retable, which is now branching to the next node. But if this next node is OS string, it will branch just in the beginning of the OS string object, which is a retable. This is what I mean. This is the initial state of the heap with some memories allocated. And basically, heap sprayed a lot of OS string objects. So we fill memory and trigger some of those OS string allocations. So basically, now we have holes on the heap and trigger the user to free. One of these holes will be interpreted as OS string object and pointing to the next hole on the heap. And when we call the retain, it will be out of bounds for the next node, which in our case is OS string. So we will dump a wittable in a panic lock. Well, this method is working. I get it working on 64 bits. I can dump a wittable on 64 bit kernels. But for 32 bits, it's pretty painful to make it work because of the size mismatch on the zone size and the object size. So I say, oh, it should be some other way to do it. Well, I started looking for similar kernels and I found that the reference to OS string is OS string wittable is in iOS centralized binary. That's interesting because our bug is in iOS centralized binary. And iOS centralized binary is referenced in iOS centralized XML. Say, okay, if somehow we can leak one of the opcodes from iOS centralized binary, we should like calculate this wittable offset. So, yeah, it should be doable. So I crash in iOS centralized binary during the object deserialization. Kernel will crash, device will crash. I get a panic lock. I just copy it from a watch, read the LR register. Well, and now I know where the iOS centralized binary is like clear out over the start of the kernel. Which is interesting because now we can start to dump in the opcodes by a panic lock. So we can use the address we want to dump as address of our fake wittable minus 0x10. This wittable is, this pointer will be interpreted as a wittable and branch of this address. Obviously, the device will crash. But we get the kernel panic lock and the register state. And the register state will contain basically the PC register which is pointing to the content of the address. So I start dumping a kernel by a four bytes by crashing the device. Using the address as a fake wittable, the watch crash, wait until it's restored. And now I need to copy panic somehow. That's the problem because it's not just work out of the box. So I need to break my phone, SSH to a phone, trigger special service which basically copy panic from a watch to a phone. Then copy it to a Mac, parse the panic, get the address content, put it in disassembler, get the opcodes and update this address with like plus four bytes delta, upload it to a watch. And repeat. So it's like, you can say it's pretty painful way to dump a kernel. I can say it's pretty fun. Yeah, so I have a lot of panics and a lot of crashes. Once again, how it's looked like. So we, we need to start dumping opcodes in iOS centralized XML until we found a branch to iOS centralized binary. As soon as we leak this address, we can start dumping opcodes in iOS centralized binary until we found the reference to our string wittable. It could take like another 10 panics. Again, the full attack plan, crash in iOS centralized XML, dump the four bytes, put it in disassembler, read the opcodes until we find the opcode which is branching to iOS centralized binary. Leak the address and start leaking iOS centralized binary opcodes until we found the reference to our string wittable. Yeah, so it takes me like a long time to dump a kernel by this way, but it's, it's doable. This is how long it takes. Usually it takes like five minutes to recover a watch after a panic. And it takes another five minutes to fetch a panic from a watch. Because as I say, I need to jailbreak a phone, SSH to your phone and like keep trying and triggering the special service that is fetching all the panics. Then copy it to my Mac, parse it and I don't find any way to automate the process because I need to recompile the binary all the time and re-upload it over the Bluetooth to my Apple watch. So it takes me just two weeks to dump the wittable. Yeah, but now I have the wittable, now I can construct my exploit. I use the fake OS string with a real wittable, put it into the beginning of the kernel and start reading kernel as OS string chunks. We can even read them in a user mode using IA registry and to get proper. So I like the kernel header, calculate the kernel size from a header and dump the whole kernel into user mode. Okay, we have a kernel, but there is no symbols. So the first thing I've done, I've started looking for a kernel extension, basically a driver sending kernel, which I've pre-linked to this kernel. There are a few ways of doing it. We can look for the XML, which is usually at the end of the kernel. We describe all the kernel extensions that are pre-linked to this kernel. Or in a bad case, which can just look for a macro header magic. And if you find the magic, we know this is the beginning of the sum of the kernel drivers. So I find the kernel drivers and the next step is to find the system call table. The trick here that system call table not really changes over the watch OS version. So which means that Apple add the new system call at the end of the table, but they not really change the system calls in the middle of the table. So if we found the beginning of the table, we can automatically resolve like more than 400 functions and basically get the symbols. The same for Mac Traps. And finally, we can resolve IO kit objects with tables and get like even more symbols. So I have the same as implicated kernel and I started to analyze it and set up the primitives. We already have the exact primitive with use of the free. So all I need to find some interesting gadgets for read and write. So they're on a slide. We set up the primitives. We get a semi-simplicated kernel. And one thing I need is to get the internal kernel structures layout. In this case, there's a proc structure which represents the process structure in the kernel space. And the kernels are different between OS and watch OS and like I cannot even use the X and U source code again because of the differences. So I start to reconstructing this proc structure just in runtime by looking for proc underscore functions. They are referenced to some of the fields in the proc structure. So I can reconstruct the layout I need. In some really bad cases, I just dump the piece of memory and look for constant values. For example, like CPU type or CPU subtype, they're always content on the watch OS. And I know, okay, if it's a CPU type, it should be like a field zero extent or so. So I semi reconstruct a few of the structures that I need. And well, now it's time to find the patches what to disable in the kernel. I use a pretty classic approach called the patch finder. So when we are looking for a string or byte references, find the, yeah, find the pattern, find the reference to it. And with some additional instruction analysis, we can find the beginning of the function or the variable we need or so. Again, resolving the syscall table will be pretty useful here as we can automatically resolve more than 400 functions. In some bad cases, RMC2 instruction emulation was needed to determine it was the sum of the variables allocated. So it was a pretty big win for me. I get the semi-simplicated kernel, I get the internal structures layout, I know what to patch. Now it's time to patch. So I begin my jailbreak work by escalating to root privileges and get out of the sandbox. So the most easy way to do it is to patch the set tree ID function. So there is no kernel patch protection on 32-bit kernels, including the Apple Watch. So nobody really prevents us to basically patch a kernel and patch the kernel page tables. So I patch out the checks and set tree ID and just call set tree ID zero zero to get a root. Or there is other way if we don't want to patch the kernel code, iterate the heap, find the pointer to the whole prog pointer. And this whole prog find the pointer to the prog structure of our process. And this prog structure find the pointer to Ucred structure. And in this Ucred basically update UID, GID, area ID fields and basically become a root. The same thing is how to get out of the sandbox. The same Ucred structure, just null out the sandbox label. No label, no sandbox restrictions. So we are out of the sandbox. The next thing is how to obtain the kernel task. The kernel task is a pretty useful way to write anywhere in the kernel memory, read anywhere and even allocate the kernel memory. So most obvious way to do it is to patch task for PID. It's a special API that returns the process task to a user mode based on the process ID. Of course there is a hard coded check if the process ID is zero, which is kernel. Return null. So we can patch out this check and just read the kernel task. Other way to do it is again iterate a heap. Look for a whole prog pointer. In this whole prog pointer find the prog structure for a kernel. Find a pointer to a task structure in a kernel memory and save the send write, which is a self. Just write it to our task bootstrap port. Then in user mode we can read it by task get special port. It will convert this pointer to useful task structure. Well, yeah, we get the kernel task port. With the kernel task it's pretty easy now to write anywhere in the kernel memory, including the kernel text. So I start disabling the code sign checks. There is a global variable called debug, which is referenced by all PE icon has debugger functions, which like set the debugger capabilities for a kernel or one of the drivers. So we can set it globally to one or we can patch PACon has debugger only for a kernel extension that we need by updating nl symbol pointers. The next thing is update the unfree variables, like cs enforcement disable and allow invalid signatures. This will allow us to run any unsigned code on the Apple watch. And the last thing we need is to remount the root file system. The problem here that root file system is mounted as read only, which mean if we want to override it with some of our binaries or just add the new binaries, we need to remount it first to be writable. There are a few ways of doing it. There is a Mac mount function in the kernel and this function is checking if the file system is a root file system prevented from remounting. So we can patch out this check and call remount or again iterate a heap, find the pointer to root of sv node and this v node find the pointer to the Mac, the mount flags and basically remove a check and then remove the flag which represents this file system is a root file system, which mean this file system is not true file system, we can easily remount it with a Mac mount. Additionally, we need to patch lightweight volume manager. It's a special kernel extension, which is prevent us to write any data to protected partitions. In our case, the root file is a protected partition, so we need to find map4io function and patch out is a very protected check. In addition, set PE, I can debugger capabilities in this lightweight volume manager. So yeah, basically we patch a kernel, we disable most of the restrictions. So now I start to basically compile in my payload. I recompile the drop beer, which is lightweight SSH client for this RM7K architecture and recompile the basic tools package like PS, Chmod, LS and so on. Put everything in my watchOS extension and basically as soon as I get out of sandbox, copy it to a root file system. There is a problem here, when I spawn the drop beer, it got killed, it got killed by a sandbox, which means that watchOS has more restrictions than the iOS. So some of the things that just work on iOS get killed by a sandbox on watchOS. So I just found pointers to specific sandbox operations in a kernel and just nulled them out. Okay, now it should work, but I have a surprise. Here's the list of watchOS interfaces. The AWDL0 looks promising, which is Apple Wi-Fi direct, but as we see, now it supports only the Bluetooth, which may be a problem because I plan to basically connect from my Mac to a watch over the SSH and I need to somehow figure out how to run this SSH over the Bluetooth. And there is a way, sent to for Luca to point me to this possibility. We can use a mobile device framework on a Mac and send the special message to your phone. And the fun part that phones should not be jailbroken, it can be any release phone. So we send the message, it would say, hey, please start forwarding service port with a port 22. And we get a response, we should companion proxy service port. So basically what we done, we bind the port on a watch to some random port on a phone. And later on, we can use this port on a phone to bind it to some port on a Mac. Oops, what happened? I guess HDMI. Yeah, okay. So as I said, we bind some port on a watch to some random port on a phone and bind this port on a phone to some port on a Mac and basically over this USB and Bluetooth, we can run the SSH connection. And basically it works. Now I can show you how. Okay. Yes. So yeah, the very first thing I need to do is like bind this port. So I call it like a Bluetooth proxy, which bind port 22 on a watch to a phone and bind the same port from a phone to my Mac. Now I can use that as a local host with this port to connect over the Bluetooth to a watch. Yeah, we got the password prompt and yeah, we got the shell spawn it. So let's prove that we are running on the Apple watch by running the U name, which is Apple watch on watch one two. Okay. Let's try one of the common line twos like PS and dump the list of all the processes. So we see that the watch is pretty similar for the IS in the point of security in the point how the operating system work. For example, we can yeah, we can list our drop your client, which is yeah, doing SSH connection. So as I said, I recompile the basic tools like tar, like STP to easy archive or unarchive stuff to copy files from a watch. But as for me, pretty painful to copy files from a watch and to a phone, then copy it from a phone to a Mac. So I found more easier way and just STP directly from a Mac to a watch and just upload the files. So in this case, I just take Proz Explorer binary. It's a tool written by Jonathan Lewin. And yeah, copy it to a watch. We get a pretty good speed over the Bluetooth. Still copying. Yeah, so it's copied. Now let's prove that it's basically only watch by running our Proz Explorer. As I said, it's a tool it's like similar to PS or top but show the memory pressure and some other useful things. So the process called the watch pound is our jailbreak. So yeah, basically it's a copying to watch work. Now we need to find a way how to easy copy files from a watch to a Mac. For this purpose, I use like SSH to watch tar or basic archive some of the files that I need and use a pipe to easily just dump everything to my Mac laptop. Let's check how it works. So yeah, it started archiving the private frameworks on an Apple watch. And I will switch to my Mac basically to prove that we got some files copied. Yeah, as we see like three megabytes of Apple watch data was just copied to my Mac. With like one single comment. Okay, this is basically the SSH on a watch. So I start looking, okay, we get a jailbreak on a watch and the watch have a test to SMS calls. Even the photos and emails can be synced to a watch. It can fit GPS location from a phone. It's in some cases, if you use a watch to answer a call, it has a microphone usage and even it's involved in Apple pay. So it may be pretty interesting to look what is on a file system. So as I said, we have a jailbreak. So it's full attest to file system and we can look for escalate databases not limited to the messages, the call history, contacts, emails and so on. So what's going to be next? I basically recompiled the hooking in giant that can do an interposing on trampolining to hook some of the system function. Which means that I can catch data when the data will be synced between iPhone and a watch. So maybe in the future we will see the tweaks for a watch or as I said, we can run the Frida or Radar and on this pretty small watch screen. Okay, so as we see, the watch has is a pretty secure operating system. Its security is equal to iOS. But still there are some differences and some of the techniques that we use on iOS should be adapted for a watch. And as for me, the data forensic may be a little bit easier on a watch as on a phone because phones have all the kernel patch protectors and like a hardware restriction which watch doesn't have. Okay, basically we still have a time for questions. Yeah, it was an Apple watch jailbreak.