Hi everybody, happy Monday. I'm Joe for Jaspy's Case Breaks.com with 2022. Beaumont Draft Baseball, super jumbo edition, two box break, random team number seven, all card ship, couple combos here. Big thanks to this group for making it happen. Congrats to the winners in those capstone packs. And thanks everyone who bought their spot straight up. They're the teams with the combos. Let's roll it and randomize it. Randomize names and teams three to five, eight times each. One, two, three, four, five, six, seven, and eight. After eight, we got Todd down to Emma. Three and a five, eight times four, the teams. One, two, three, four, five, six, seven. And good luck, eighth and final time. After eight, we got the Braavos down to the Bronx bombers, the Yankees. All right, here's how it shakes out Todd with the Braves. Didn't Todd van Poppel, remember him? Didn't he play for the Braves? I think he was drafted by the A's. Anyway, Edward with the Orioles, Paul with the Mariners, Zach with the Mets, Edward with the Padres, Henry with the Dodgers, Michael with the Guardians, Adam with the Astros A's combo and the Phillies Marlins combo. Henry with the Diamondbacks, Chris with the Brew Crew, Bart with the White Sox, Craig with the Rocks, Jeremy with the Angels, Zach with the Blue Jays, Ray with the Giants, Chris with the Royals, Ed with the Rangers, Todd with the Tigers, Zach with the Nats, Chris with the Pirates, Keith with the Rays, Jeremy with the Cardinals, Chris Reds and Red Sox, Red Teams, Bartholomew with the Cubbies, and Henry with the Twins, Emma, Last Spot Mojo, Yankees. It's alphabetized by a team, I know, right? Sorry, Adam. Hey, you know what? If those are the only teams that hit, though, then those become the good teams. All right, we're gonna pause the video when we come back. We'll have the two box break and we'll see if there's any trades. Stick around, we'll see you on the other side. All right, welcome back, everybody. There's a little bit of trade at chatter, but in the end, no deals are done here on a Monday night. We got a little college football on the background, National Championship game, end of the first quarter, Georgia 17 at TCU seven. Emma with that Last Spot Mojo. And this is a fresh case of the Super Jumbo's. It's a little bit of an awkward size. So I'm gonna open this over here. All right, so there's two boxes each right here. What we're gonna do, we're gonna roll the die. We'll go one, two, three, four, five, six for each of those stacks right there. One, two, three, four, five, six. Three, one, two, three, four. So these we will save for some other time. So Super Jumbo's, five autographs per box, which is quite nice. Let's go, got Elijah Green, Jackson Holiday on the front. Also, this break is also part of our latest All Break Sold promo. We've got until tomorrow night to unlock that promo, so let's not leave break credit on the table. If we get five or six of the break credit promo breaks done, we get like four or five of those done tonight. Knock out the other four or five tomorrow. And that'd make it really easy for us to unlock that break credit promo. Hey, we've got an outside chance of doing all of them tonight too. If we do all of those tonight, then we will run that break credit randomizer tonight if you want to. So check out all the details. JaspeysCaseBrakes.com are always doing some kind of thing. I'm sort of promo here and there, whether it's a site-wide kind of thing or whether certain breaks may have their own individual promo. So just go to the website, browse around, check it out. You might find some breaks, a little extra added value. I'm already good value on these breaks anyway, you find even more value in some cases. And if we get all those, the requisite breaks filled up, someone's got to win that break credit, it might be you. So you know where to go, JaspeysCaseBrakes.com. And the last sort of sausage link pack. All right, good luck getting away. We go to Mar Johnson, the kind of names that we're looking for here. Chris got randomized the pirates in this one. And there's our first auto, Cade Horton. Here's a who, that's gonna be for Bartholomew and the Chicago Cubs. And we've got some paper here. We've got to 499, Ryan Cermak. That's for the Rays, that'll be for Keith and all of these Jackson holidays. Gonna go to Edward and the Orioles. Nice draw for him and the randomizer. And that's with the spot that he won in the filler too. The filler spot that he won, parlayed into the Orioles and hopefully, a lot of Jackson holidays. Holiday, if we took a holiday. And we got a Dillon de Lucia, 152 out of 199. Aqua lava for the Guardians. I didn't like that batch. There was like a little extra glue that was in there. You couldn't really top load the card very well. There you go. And once again, that is for Michael. Cleveland, this is for you. Edward saying, who's the hometown team? What's the hometown team? What are we talking about? My hometown, your hometown. And we got a Jonathan Mejia. Purple Chrome to 250 for the Cardinals. That's gonna be for Jeremy. And we got a Chrome to Mar Johnson for Chris and the Pirates. We'll get that paper one as well. And another autograph, Drew Thorpe. 475 out of 499. That's for Emma and the Yankees. Last spot, Mojo strikes again. 70% of the time. Last spot, Mojo hits 100% of the time. And we got some green paper here. 26 out of 99. Chandler Simpson for the Ray, that's for Keith. And we got a Jacob Marcy for the Friars. That's gonna be for Edward. The spot that he won. It's the six round pick. Number 416 Prospect for the Baseball America. Earned three high school letters in football, all week performer, two in hoops. Just an all-around athlete. Purple paper, Jason, no, Justin Campbell. 50 out of 250. For Cleveland, it's gonna be for Michael. Looks like Georgia with a rushing touchdown. They seem to be in control of this game. Jackson Holiday Chrome for Edward and the Orioles. Should be one more autograph in that stack there. We got four already. There it is, Gabriel Rincones. 009 out of 199, Aqua, Lava, Parallel for the Phillies-Fish combo. Phillies-Marlins combo going to Adam. Third round pick, sharp-looking parallel. Got a blue, Alexis Hernandez. 50 out of 150. It's gonna be for Bartholomew and the Cubbies. All cards should, but I think that might be the first Elijah Green I've noticed. That's for Zach and the Nets paper. Unless I missed some earlier, but I don't think I did. There's a Chrome Elijah Green. One Super Jumbo box down and one Super Jumbo box to go. Good luck, everyone. Georgia in control, 830 left in the first half. They're up 24-7. I'm about to pick it off the TCU. TCU's gotta start, gonna get some more points on the board. They wanna make this competitive. I think you get like a touchdown and then maybe, maybe force a turnover. You know, that's the kind of stuff that they're looking for. Maybe another home run play, like their first touchdown. That big play that led to their first touchdown. Another five autos, let's go. Our first autograph is Trey Lipscomb. 107 out of 199, Aqua, Lava, Parallel, Zach with the Nets, third round pick. And we got Dominic Keegan, another Aqua, Lava to 199. That's for Keith and the Reyes. To Mark Johnson's paper. Pirates, Chris, if we took a holiday. And a one of one, Owen Murphy. Black Wave autograph. That's Todd with the ATL. First round or 20th overall pick. That's pretty nice. Nice randomizer, Todd. All aboard the Big Hit Express. Woo-hoo. We got a Marcelo Maier, Green Speckle, 63 out of 99. Red Sox, Chris, Colton Couser, 208 out of 499. Paper for Edward and the Orioles. Jackson Holiday. Holiday, some Elijah Green. Another stack, stacks on stacks on stacks. And 24 out of 50, Jet Williams, class of 2022 autograph. Jet, woo-hoo. Zach with the Nets. Hopefully he has some speed with a name like that. Was that some bread here? We got Benny Montgomery, four out of five. Benny and the Jets. That's for the Rockies, that's for Craig. One that spot got randomized, the Rocks gets the red lava parallel. Benny Montgomery, four out of five. All aboard the Big Hit Express. Woo-hoo. We got some blue paper car pre-lip to 150. That's for the twins, that's for Henry. Chrome Elijah Green, that'll be for Zach. Two, three autographs. So we should be expecting two more from these stacks here. Here's one, JR Richie, 29 out of 499. Refractor autograph for Todd and the Braves. 35th overall pick, first rounder. And we got a Zach Nito, one of these short prints. Ice. That's for the Halos, that's gonna go to Jeremy. The spot that he won. Nate's wondering if Georgia does what it looks like it's gonna do, does this mean the SEC is just that much better than the Big 10, Big 12? I mean, I think so. As a casual college football observer, that's what SEC seems to be like the premier, the Premier League of all the conferences and the ACC too, Nate's saying. And there's our final autograph. Victor Scott II for St. Louis, Jeremy Port. With the spot that he won. Got randomized, the Cardinals gets the auto of the fifth round pick. And we got a Ivan Melendez, 34 out of 250, second rounder. Purple parallel going to Henry. The Diamondbacks with the Snakes. Looking to his eyes. Oh, he's been telling us.  He don't play by rules. Girl, we don't play the fool now. Denzer Guzman, paper to 499. That's gonna be for Jeremy and the Angels. 278 out of 499. That's right, we have the Diamondbacks, Snakes, Coldheart Snake, Paula of Duel. Georgia going deep. Oh, did he haul that in? What a catch, if he did. Ah, now stepped out of bounds.  And that, I think, is that. Thanks, everybody. Two box Super Jumbo break. Turned out to be pretty, pretty, pretty nice. Got some nice color here. Got a short print. Got an out of five. Got a one of one. Lot of awesome stuff. Thanks for watching. Thanks for breaking with us. I'm Joe for Jaspy's Case Breaks.com. And I'll see you next time for the next one. Bye-bye.


What's up YouTube? I'm here with a different video. This one's actually going to be a small mini scheme from the New Orleans book Which I actually have an e-book out that's been very successful I've got a lot of good feedback from you guys that this e-book has really helped you guys move up in Weekend league rankings move up ahead the head rankings and really altogether become a bad man player And that's essentially my goal now I mean I've established myself as one of the best man players in the world and one of my biggest passions is Helping you guys get better because I want everybody to love this game The way I do and I feel like the way you do that is to get better at the game See the game how I see it and really become a better player both the offense and defense But this is mostly for defense and one of my biggest struggles personally coming into this year and that year is where I'm Going to put all my content. What am I going to sell? What am I going to put on YouTube? What am I going to do with subtips? What switch only what do I hide for myself to compete? That's one of the biggest things I think about all the time and this little mini scheme I really wanted just to add to the e-book You know because it's already it's already three great formations in there I believe and personally I only really use one or two But you know that my e-book has a three great formations in it and this was another one I was going to add but I decided to go ahead. Let's make this a little you too many schemes So obviously if you don't want to pay for the e-book, you don't want to go down that route That's cool But you can look at this and learn and this will give you an idea of some of the things that go into what I do Making plays and calling plays and and deciding where I'm going to throw the ball now. This is pistol bunch pistol bunch tight end is a compressed set and What's good about this set is that you're going to have to play pass defense because you have three wide receivers You have a tight end and a running back So you're going to have to defend the pass but you can also run the ball very effectively out of this set Because it has a draw that's compressed compressed draws are always good because you have everybody right there in the tackle box Blocking it also has a half-back zone and it has strong power We know strong power has been a great running man for many years since it's been in the game And it also has a counter and something to run like that I mean, I'm not going to break down the running game on on this video But you know because I hardly use it But if you're a runner This is a great way to force them to be in pass defense or run the ball and vice versa because you're running the ball Maybe now they'll be in put more linebackers on the field and you can go ahead and pass because you still have your three Wide receivers and I'll show you the three different pass plays. I love to use out of this So here we go pistol bunch tight end the number one thing I want you to do personnel wise Is put your fastest receiver in the top of the bunch. I have the saints I want to use Ted again Probably the second fastest receiver out on the left than the outside guy I'm going to use Michael Thomas there at the first play We're going to take a look at it's bunch verticals. I mean vertical is one of the best plays in the game Honestly, this crossing route to be just dominates the zone. It cannot be covered in zone You have this seam route to Ted again, which will scorch cover two two men on there will be instant touchdowns And you have the wheel route to Thomas, which will be covered too And obviously I dragged the tight end is my first setup of this Because I mean you got to be able to have an option to throw the ball quick if they're blitzing Or if they play coverage and they're backed off, you know, you got to be able to throw the ball To your Kelsey's and Grunks and and run people over get extra yards Also the beautiful thing about this this little ever delay route check down to Alvin Kamara You know, you want to be able to utilize all five people on the field This play does a good job of that being able to utilize all these people Mostly you're going to check down the Kamara and your tight end But we really want to hit this b route because zones do not cover it I mean deep blue won't cover it and run past yellows and purples and things like that Also always love to run my bunch to the wide side of the field It makes all these routes better, especially this seam route right up the middle with Ted again That is where I would put my tire re-kill or my other fastest receiver I really think tire re-kill and moss over here to the X receiver Michael Thomas and cover two doing that wheel route over the cloud flat I would think moss and tire re-kill would make this scheme that much better I think there are the two wide receivers that are must haves and must Ted again right at the middle. You see that could be tire re-kill for you Check out underneath the Benjamin Watson. I really don't have a preference in tight end I actually use girly at tight end. If you want to learn how to do that You can hit the e-book and learn how to get girly at tight end And there we go that crossing route That's cover three to cover three zones have no chance to cover it Luke Keekley even matched up on Cameron Meredith And he just was no chance for a bad receiver like Meredith There are going to a little delay route to Alvin Kamara It's really tricky and really can help you get a lot of yards What's going to be see Luke Keekley tries to cover Meredith Imagine if that's your Herman Moore, your Jerry Rice or somebody like that He's going to get wide open This is two man under and you see what Ted again does to that Because he can't be covered in the zone spread out Because we run the bunch to the wide side of the field Make sure your bunch is on the wide side Alvin Kamara underneath You can't cover him. That looks like a real saints game The way Alvin Kamara is running away from a linebacker Two man under again. Once again Ted again is just wide open Can't cover that seam round two man under The nice little dot that I come up with is just this wheel route here to Alvin Kamara Because they're going to give you the wheel route It doesn't control what side you put the wheel route But this puts it to the bunch side and with all the deep routes It really creates this hole so you can hit Alvin Kamara And get nice little chunks of yards I mean we pay a lot of coin for our Lechon McCoys Are you know whatever running back you may have Whether it be Leveon Bell, Todd Gurley Whoever you think is the best run back in the game And this is a way to get easy yards So get them the ball in space I know a lot of times we run the ball And you know you don't always get them in space But the best thing to do is have your best player in space And that what that plays allowed The next play I'm going to show you guys is spot option This is a cover three bomb What's going to happen is Ted again's corner route Is going to control the left deep blue If they're running cover three A lot of four sixes cover three A lot of three you know four three is cover three So you want to want to have this in your back pocket Like I said I would love Tyreek Hill on Y And Moss on X because you can see Michael Thomas Is still getting big plays even though he's not fast But if you had you know 92 speed 93 speed Moss out there This would be easy touchdowns But even with Michael Thomas it's close to a touchdown He's getting grabbed at the last second there By the strong safety The last play I'm going to show you is one of the best Stock plays in the game When I say stock I mean you need no hot routes to run this play You can come out and quick snap it You know they might get so used to be Being the receiver that they man up for the crossing route You have to have a crossing route to another receiver in your set That is a crossing route to Y here And it also has the double drags underneath To both Meredith and Watson I want to see here that if they play off You always have this tight end drag The tight end is going to eat Alvin Kamara is going to eat But if they start paying too much attention to that You're going to be able to go ahead and hit These bigger plays down the field As you see here Y Ted again The deep blue zone has nowhere to go The flat zones and yellow zones are sucked down By the drag on the other side And right now I'm noticing that my deep end route As you see again and again making a play Is too close to my crossing route So this play I'm motion out my deep end route Have a lot better spacing there But I still want to hit Ted again over there That route is really hard to guard So there you have it YouTube Those are the three little quick plays I wanted to show you guys That I use out of bunch tight end Pistol bunch tight end To go along with the runs And like I said you can really mix in the runs Very well out of this set Because they are very effective They can run both set ways And also right up the gut Your tight end and running back Are going to get involved I showed you many ways to get your running back involved So if you have Levy on Bella Or you have Todd Gurley Or you have some of the best running backs in the game This is a great formation And get them involved Get them to football Also a lot of things that I want to portray to people As far as passing balls I want you to have a plan When you drop back and pass the ball I always have a plan I have somebody I want to throw to I think we all have somebody we want to throw to football to And on most of these plays On verticals is that crossing route Or if they are going to give up the scene We want to take the scene But on verticals is the crossing route So that's what you want to look for But most people What you have to do is have a plan To where am I going to go with the ball If they manually cover that route So when I call play I always say Oh, I'm calling, you know, bunch of verticals And I want to throw the crossing route So I got to assume That this guy is going to cover the crossing route And where am I going to throw the ball to now So if he covers the crossing route Now I know I have my tight end on the drag And I have my running back on that delay route Over the middle Little check downs To make them eventually come down and cover that So I can hit B Because I want the big yards I don't want to go 10, 12 plays up the field I want to score in three or four plays And God forbid if they forget about Ted Ginnup the seam That's a touchdown So that's why I love verticals And you always have to have an idea Of where am I going to go with the ball If they cover my main option That's something I want you guys to get better at And learning when you're passing the football And that's what I do with verticals And the same thing with the cross drag plan You have two drags to throw to But I still want to throw that wide route Crossing the field But most players At least good players Are going to take away that deep route So you have to know Where you're going to go Either with those two of the drags Or you can hit that backside in route If they cover wide all the way on the sideline there So that's just an idea Of how I think passing the ball Obviously we all have somebody we want to pass So we all want the big yards We all want the touchdowns We all want it easy But you have to always have a plan On what to do if they cover that play That you want to throw Or they cover the big route that you want to do And that's something now I want you guys to realize That you have to hit the check downs You have to hit your tight end Have to hit your running back Have to get the yards there on the field So if you like this video Please comment below on what other formations You want me to put a little mini scheme out on If you like what this pistol bunch tight end Brought to your game Imagine what the rest of the e-book will bring That link is below in my description To check out the New Orleans e-book It has three more formations That are just as powerful as this one If not more powerful Also I have a way to get Todd Gurley a tight end That's something I use very effectively If you want to watch me play The link to my twitch is below as well You can check that out Check me out live I really appreciate all the support And the feedback fellas is really growing Channel is really growing So let me know what more you want to see What you want to learn from me And how I can help you guys get better at Madden


All right. Good morning, let's get started.  You guys can see me here. Loud and clear. Good to see you, Renzo. Good to see you, Phil. Everyone. Good morning, Greg. Everyone on YouTube, Leon. Good to see you, Phil. Good to see you all on. Good morning to you, Randy. All right. Well, having a fun exciting morning so far. It's not really working out too well like right now, like going to a really good pop. You could see here up in the alerts. You could see our pre-market watch list. You know, we started here right before 8 o'clock. We were basically at around 7 45. A couple of good stocks made some big moves. We got a, we had a nice pop right here on the eyes tray. We're going to talk a little bit about that stock. I sent a bulk email and I specifically asked everybody inside the group room, now everyone on YouTube, Facebook, if you want to come and join as you could, but I wanted to get your feedback on eyes. I want to know how you did on it. I want to know exactly what you did. Did you see it? Did you not? And if you didn't, it's okay if you missed it, but I know a lot of you made a lot of money on it and just want to kind of just want to go over because it was just a phenomenal stock, but it also moved pretty nicely this morning. Starting to do a little reversal right now right around 845, but what a great, great mover. Now, what is the big news? So Congress passed this whole they call it a, you know, they call it a stimulus or whatever they want to call it, but they came out with it and it, I don't know I don't know if they're really excited about it. I don't know if they're really excited about it. Nasdaq is obviously down, okay. The Dow is up, but a lot of high tech stocks are really taking big hits. So usually when they come out with something like that, I don't think you can hear the music anymore. Music is off, Michael, all right. But when you have like, when you have a news like that that comes out, usually you know, unless they were anticipating it because it was like buy on rumors, sell on news, but I don't know if they're really crazy about the stimulus package that they came out with the coronavirus. I mean I didn't see that much. Usually you'll get like a 200 or 500, you know move on it. I know it's kind of flashy. Now I was listening to a couple of people over the weekend and you know, a couple of analysts and stuff like that, people that predicted a lot of bubbles and stuff. A lot of them were concerned. A lot of them were really concerned that the market went up too fast. Now listen, being a day trader, you know I've been doing this for a long time, I've been through probably five or six bubbles, okay. And you know, some of you were in it with what happened with the coronavirus. So you can see how it basically took a big hit. But you know what, we went up a little too fast. I think these high tech stocks are starting to back off because NASDAQ is not really doing too well. NASDAQ is obviously taking a big hit and then just looking at a couple of things. I mean like Amazon just finally broke the first time over 3,000 in a long time. I mean a lot of them just not really doing great. So I'll be really cautious on your long-term swing trades as a day trader and we see that happening.  The energy stocks, the energy stocks, the energy stocks and the energy stocks. We'll talk a little bit about that. We did really, really well and I want to go over some of the stocks that we traded last week. But the energy stocks, if you were here on Friday and by the way, everything is recorded you can go back and watch Friday's show and remember these shows only last, you know in the morning what, 10 minutes, okay. But I was talking about it all week and what were the big winners that we had right there. I was going to go through some of the energy stocks because they were just like they were all over the place. But I want to talk about, there was a couple, there was a really good one WTI I want to bring that one up.  Look at this thing right out of the gate it ran from $4 to $5 and it went up so nice and slow. It just went up and went up and went up and went up and you could see here on the long-term chart it was literally around a $2 stock and look how it's doing well. Now listen some people like looking at it well aren't there other ones? Yeah, I'm going to show you a couple of them. There's let's look at VET, these are all the energy stocks. Look what they've been doing. Beautiful Fausta flag just starting to build up on that one. Look at the long-term trade right there. Stock was around $4 it's already almost at $8. What else we got? We got MRO. They're still cheap I mean I'm getting you wrong. $4 stock it's almost at $13 is another one over here. Look at that $4 stock it's almost at $20. What else we got? REI is another one. Not a huge but you know it was at $1 it's almost at $3. It's still up 300%. What else we got? Use some bigger ones a little more expensive though. R oh is it NR was it NRGU that one right there this one was with all the stock splits and everything I mean like thing was down to $1,100 drop down to $100 look at that trend. I mean stock was literally like I don't know $50 almost at $1,70 gosh that was a hell of a lot of stock splits on that one too. I think it was at $12,000 with all these stock splits you know now it's at like $89 things been going up. They did like a hundred to one stock split on this so when you people like stocks I've never seen a $12,000 yet because it did so many splits on that one but you could see how it's going up. They tighten the flow here's another one. I mean you could see them all there. All the energy stocks are doing really really well so swing trading on that has been pretty well. It's been not doing too bad on those. Now a couple of the stocks obviously I want to talk about. Let's talk about eyes really quick because that stock on Friday was just just out of control. This was a $2 stock was a $2 stock. The stock literally ran up until 12 o'clock and it didn't make a big move until around 12 and that's when a pot went from 5 to 10. This thing was got halted it was just so much fun getting in and out of it. Now I mean like I mean I tell everybody we get these at least I don't know maybe three times a month four times a month but you know to get like a nice 500% mover in one day but this stock right here basically paid for everything okay so like when you're a student at Cybertrain University I tell you guys and you know like the train is a lot of work it's a lot of work from our staff and this and that and I know you guys make big investments here at C2 and I says listen be patient don't try to catch the whale every time. You're not going to hit the home run. It's going to come to you. You're going to be at the right place the right time. You come to work and you know what if you got it at three and you sold it at four and it went to ten big deal you know what if you made a dollar on a thousand shares okay you do that every day for a year there's your quarter million dollars you don't need to hit a ten dollar winner okay you don't need it. You know what but sometimes you're just in it and all of a sudden five dollars that thing just takes off like what do I do fast though ten minutes and fifteen minutes I'm already at eight some of those big winners got to pay for the losers alright so because remember you're going to lose in trading you can't be afraid to lose alright because you are you're never going to be successful and remember the big part of C2U is not about winning it's about controlling losses the ones you control your losses you'll do great and that's our big motto here and because you know what you got the 30 second rule you got the three strike out rule but when you get something like this guess what you got to pay for all those little ones and that's what ends up happening so that one did really well another one that I know you guys are trading on Friday too that we did pretty well was this PRPL this one also a little more expensive though but you know you can see the stock took a big big hit it went from 40 all the way down to 25 it was a little death cap bounce stock went from 26 all the way to 32 nice little move but you know the spread was pretty big you can see right now so you want to stay away from it but it was a good stock to trade on Friday that was another one that some of us missed okay let's go back and bring back our charts back to normal let's go back through the watch list again again okay so regarding I know a lot of you guys are going to be hawking the stock eyes eyes is not an easy stock to trade okay I was looking this morning you got to wait until it opens now over here let me just bring up a couple of orders over here the level four so there's a couple of big big iceberg orders that keep popping up around here you can see how they got filled and went up but they keep popping up there was a couple of big ones right here of like 80,000 150,000 shares so you got to be you got to be focused on those big iceberg orders because that was what kind of like pushing it down I mean it came out with great news regarding what some drug they came out with but just be very very careful on it it does still look strong okay but you got that resistance levels right around 950 from Friday or 960 I think it was if it does break it this thing could really really make a nice move and by the way that resistance levels back in 2019 kind of explains it right here why kind of like backed off right there but if it does fill in that gap which it did right here and you could probably hit 14 but we won't know until the market opens up so we'll see how these guys react to the stock once it opens up a couple other ones in the watch list ANCM we're going to look at this one you know what she's starting to back off right now probably going to have a change of heart I'll put this on the B list Expo I know what's up with that one but making so much of a cool move we had some fun with this stock I mean this stock back in January it ran from like a dollar to about eight bucks alright we love short squeezes here at Cybertry University but you know she's holding it pretty strong it's about 19%, 6 million shares we'll see how this stock works out but I'm going to put it on the watch list OPGN another one that came up on the watch list it's on the B list I thought it was going to make a good pop I know one of you guys were calling out in the Cybertry you say you know what it looks like it's starting to make a little bit of a move and I'm like I agree with you but I don't know what happened it looks like kind of stopped right here so but she's got some support levels right now and I'm seeing that on level 4 too what else we got oh what's going on with GameStop looks like GameStop is starting to make a little bit of a move this morning right my god can you believe this thing the longer you trade here the worse it is because that means more and more people own it but 2 million shares are already traded so far and it's already a buck fifty starting to have a little bit of a push I don't know let's see if the Reddit guys are going to be doing pretty good on Wall Street Bets which leads to AMC AMC also did well on Friday and this one's starting to go up a little bit too it's got a big I mean it's I don't know you know what could be a decent move this morning seeing a lot of action in it where this smoke there is fire NOVN is another one that's moving this morning too a real cheap stock of 11% about over half a million shares traded penny stock though you know how I feel about those but you know this is pretty tight here we have another one FSR that made my came up on the list again this is the stock we did really well the stock is a new IPO stock obviously had some great volatility you've traded this so cyber traders in the room already just remember look at your journals like we told you how to take very good notes and remember you know how to do on it what was the shakes you know what's the spread on it you know there's a lot of money to be made on the stock but you got to be very careful regarding on the volatility on it because these things start getting pretty damn volatile but she's doing pretty well 21 to 23 not bad so that pretty much does it I said the AMC we're going to watch the energy stocks we're going to watch this eye stock by the way eyes has a warrant too and you know what maybe they won't do anything maybe they take off but you know what we always find some new ones when the market opens up and that's part of the game plan now did I miss anything I did not call did I miss anything anything else out there Andreas says the IMTV is moving is that right IM oh I spelled the wrong IMBT nice little move this stock took a huge hit right here major hit the stock went from 50 down to 10 yes this stock is obviously definitely going on the watch list right here hell of a move right there though the stock you could see it just from 17 to 21 volume is pretty good spreads a little pretty big right here but the IMVT nice stock right there definitely put it on watch the call right there John says the GEVO GEVO let's just look at that one you know what once again you know we're a big bottom fish team we love stocks that get crushed and get killed but the stock had a big pop up had a nice little falstow flag around $4 to $5 she made a big run up she's backing off I would probably be a little concerned about it right now I wouldn't go crazy about it we'll see how it opens up but not terrible alright anything else listen it's Monday Monday's a very scary days we don't want to get too crazy going on a Monday so let's be very very careful what we trade let's not get too cocky and we'll go from there now guys don't forget Wednesday we have Tom Sassner the founder thinkorswim the president of Tasty Works he's going to be here he's a very good friend of mine we're going to talk about swing trading we're going to talk about options trading we're going to talk about the economy you know what you've got to learn before you can earn so if you have not registered yet please do so I believe I have the link let me just give you guys the link some of you here haven't probably done it already just bring up a browser I have it up here so I guess you guys register for it here it is right on our homepage or our website if you have not done so just go out there everybody knows who's Tom Sassner alright so just definitely go out there let me just put an alert for you guys out there too and make sure you click on that link on the homepage and just click where it says sign up starts in two days just click right here and just get registered for that alright good luck everyone happy trading if you're watching YouTube Facebook Live we'll be back here at 2.30 if you want to get into the room just click us, like us, friend us do a nine dollar trial, cyber traders Kenny is a billionaire right now you know what's amazing, he did it twice twice you all do it once, did it twice and you did it half times three times quicker than the first one but we'll talk a little bit about that, it's going to be awesome so I'll see you guys there, happy trading let's make some money and if you see something you say something good luck everyone


So I just got home from uni and I got a huge misguided delivery parcel and I was gonna, I was telling my mum I need to try these on and show her and you know we pick what I like and what I don't like and stuff and then I was like might as well record it for you guys as well so you guys can see these are the some things, these are the some things these are some of the things I got from misguided two days ago they had 30% off student discount but that's not on the sale items obviously but everything I got apart from one item was full price anyway but it was really good because like my order was like 300 pounds and then it came down to 200 pounds but yeah we'll see how much of it I actually like I was telling my best friend Christina on the phone that I haven't ordered from misguided in so long so I don't know if their quality is like good or not because I don't know I feel like everyone else has like who has online clothing companies have like upped the competition so you know we don't know if other people have managed to keep up with the quality or not so I'll be able to tell you guys when I try on these clothes Mum say hi to the vlog Hello everybody I hope all of you have a lovely time and you are well, healthy Yeah, what are you gonna do now? I want to have a little bit paneer satsi Whilst? Oh, I want to watch Seppy She wants to wear her clothes for me and I look at my beautiful daughter and we look at them You already did, you made me a snack So first up we have this cropped jacket What do you think Mum? That's gorgeous Let me try it on It's double sided so you can wear like the white side out You can wear like this with the nude side out That's true, there is a lot of fluff This is what it looks like on I hope if you're wearing black clothes We look at it in the mirror, hold on I don't know if I like it, I find this bit really inconvenient and when I fluff it down I feel like it doesn't look as cute The only thing I don't like is too much fluff This is what it looks like, it's jumping in your arms And I just tried to tighten this bit I just tried to tighten this bit and it's so sharp it cut me Look, there's something wrong This bit of it is so sharp it's sticking out I don't know if you guys can see but it just cut me So, yeah, I thought it's cute but I don't know, it's also impractical I don't know if I like it Can you try this other side? It's not something that's spatial Oh my god, it's not It's all flat Yeah, it's a mess It's going in my eyes This is the other side And it's so fluffy Yeah, I don't like it So this is a no No Already I can tell you guys that one of the coats is missing from my order Was there only one bag, Mum? So I ordered this big aviator jacket and it's not here But this is the bomba What do you think? Just like a classic simple to throw over things So this is just a classic bomba jacket I've been looking for one I don't know if this is the one Let me know what you guys think What my mum thinks So-so So-so from my mum I like it, I think it's cute I think it looks good quality And the next up is this sweater dress I thought this would be cute to wear with fai-hai boots Fai-hai? I meant knee-high boots I'm gonna try on You're going best with that I could wear a belt with it or not What do you think? I think it's nice with a belt So this is what it would look like with a belt And this is what it just looks like casually Yeah, I know So it's nice Yeah it is I think I got this in a size 6 But I feel like for me this is coming up quite long Like I feel like it would look nicer on me if it was up to here Yeah So guys, maybe I could cut it Probably it would look good I think so You can cut this? Yeah, you know I'm very good She is I've cut everything She cuts all of our leggings and into the top But it's super comfortable and cosy I really like this Next up is this teddy Is it called a teddy? Teddy high neck sweater dress Again, this is the softest thing I've touched Mum touch This is so soft Let me try this on So this is so soft and cosy And in Sydney I like this one Much more than the last one Because in Josh, like here It's got cash chimichurri Yeah, elasticated So literally the bottom of it Holds up and can be as mini Or as long as you would like it to be I like it to be mini And I feel like this would be so cute With my like Zara knee high boots Very nice Color is nice, style is nice Other one is too loose Yeah, I feel like This is so much nicer than the other one I love this one Next up we have these mum jeans They look like this I have a pair of mum jeans That I'm obsessed with That I got in summer from Zara In the sale For like 12.99 But yeah, I thought Seeing that I love mum jeans so much I might as well try another pair This is what they look like Mum, what do you think? Why don't you like it? Because I didn't like your last one So this is what it looks like On That's pretty nice Yeah, I told you Like with a crop top Like this And like heels I think that's pretty nice It's like Do you think? I really like it Wow, I didn't think I'd like it this much I thought it would look bad I like it nice Well done Miss Sky, I really like these jeans a lot I feel like they're very flattering And dance My mum, whenever she likes Like an item of clothing When she tries on an item It's a fluff on my face Whenever my mum tries on an item Of clothing that she loves, she always dances Show them, how do you dance when you like something? No, I don't know much about that No, I feel like try something After I can show you Next up, I kind of jump On the joggers And like matching top bandwagon So let's open this up I don't think my mum is going to like this So this Track suit bottom And then down the side it says Eason It's kind of like Yeezy style So these tracky bottoms I'm supposed to match them With this little bodysuit So let's try this on You like the bodysuit So This is it mum, what do you think? I love the top Or rather the bottoms I love it, this portrait is good I like the bodysuit Let me see the track suit bottoms I like it I feel like if I want to be like casual Going to uni Not that I get to go to uni casual A lot these days Because I'm mostly on placement But if I want to be casual Go to uni, then I feel like This is a cute outfit to rock I don't know, maybe you guys have ruined my mum What do you think? No, I don't like the trousers Because I don't think so many have got out That is... I just looked at this in the mirror And I like the bodysuit And I like the track suit bottoms But I wouldn't wear the bodysuit with the track suit bottoms I wouldn't wear it together I'd wear this with a crop top And then I'd wear this with like really tight jeans But I feel like together I don't know But I don't know, would I wear it together Let me guys know what you think So next up we have the dresses And honestly This dress looked Like this in the photos This bit doesn't even hold up It's dangling And it's just It looks stupid Honestly, this is such Poor quality I can't get over it What is this? It just looks stupid So even without the bra This bit is just so floppy And bad quality I feel like it looks good on I don't like it Doesn't it look very poor quality I don't know Let me know what you guys think But to me it's such Poor quality I've got better dresses than this before But yeah Just black But this bit It's just so floppy They should have put a wire inside it To hold it I feel like the camera is not showing Just how floppy and bad this is But it's chilling Do you think? Yeah So we've got another dress This is the same material I think this is nice It's a one shoulder dress So let's try this on So this is the one shoulder dress My mum likes this I like this too And I think that it's much cuter Than the other one It's the same quality The best of materials But it wasn't too expensive So I got no, definitely because of shape And shape hasn't got any It doesn't suck me in basically Like it doesn't hold me in Yeah Shape is not good Shape needs something to keep it But this one's cute I like it Maybe I'll wear this on a weekend I have a product This is nice, I love it I have this chocolate Cowl neck dress I love this, it's as nice as mine Do you like it? I feel like the material of this is really nice It's like a slinky material It's very comfy And form fitting And sexy and short I like, because I'm kind of short I'm 5 foot 2, I like my dresses to be kind of mini Otherwise I end up looking very short So you're not sure I am short But yeah, I'm not short I'm not medium either I'm not medium Sorry mum I'm not medium Love this, very pretty This is a party outfit again I've got two parties this weekend So I guess I've got two outfits for them now Also gonna need to tape this down somehow I don't know how Do you know how to tape down a dress? No mum, I don't want to close it I want to tape it so that it doesn't move I'm just like, do I have to put it on the way? I've tried on everything now for a misguided Overall, what do you think? I feel like it was so hit and miss Some of it was really nice, some of it was just On top of it, I'm missing a coat From my order I ordered this AB's coat Overall though, don't you think? Baz, yes, she's ush, it was nice And the rest of it was not nice But in the end Quality is not really Yeah, the quality isn't that good I'm gonna end this all here


Welcome everybody. Everybody will come in and get us sat down. Erin is here to talk to us about Linux containers. Thanks. Yes, hi Erin. I've been doing security, ISEC. If you don't know who NCC Group is, ISEC, Montesano came together, we were brought by NCC Group from the UK. But same people, same place. I've given some talks before on some different things. So this is my first DEF CON talk, but it is my 12th DEF CON. This is my 10 second promotional motivational slide to not wait as long as I did and not be a slacker. And if you've got an idea and we've got lots of inspirational talks and cool talks here, keep that going and do research and submit to the CFP and give talks. Don't wait as long as I did. So I want to start with this story. So Bob, this is Bob here. He's got some web app or he's got something that's on the internet. It's on Linux. And somehow there's a bug. He gets popped. There's some kind of RCE. He gets arbitrary code execution, something like that. And he wants to add some security, but he's not really sure. So somebody says, well, you should use CH root. That's legit. Open SSH uses it. It must be good, right? But as we all know, it's broken if you have root. You essentially just CH root yourself and then you can go up to the root. So that's well well known. So somebody else comes along and says, oh, you should use SC Linux, right? That's easy. The NSA made it. It must be secure. If you know anything about SC Linux, it's a super complicated type based system. It's really designed for multi-level security. It's really designed for kind of government things when you've got lots of different things to classify. It's got really good support on Red Hat, but other than that, it's not so great. Some of those reasons, right? Complexity. It's really complicated to actually create it. It has the Linus Turvolds problem, which most of the other Linux security modules have where, you know, he doesn't really believe in any of them. The set and force zero problem where, you know, if you walk into a box that has SC Linux, the odds of it being disabled are high. And, you know, at the end of the day, the kernel's got a kernel, right?  If you ever look at any of Spender's exploits, he loves to just do that first and then dig at them as he does. But speaking of Spender, so somebody else comes along to Bob and says, no, you should use GR security. That's the best. And yeah, it really is in a lot of ways. But that's not really solving some of the problem, right? If he has WordPress and he's got some arbitrary, you know, command injection, GR security is going to do nothing for that, right? You're doing a lot of memory corruption protection. You're doing a lot of other things. But unless you do all the kind of turn everything to 11 with RBAC and everything, it's not going to solve that. So then somebody else says, no, you should just use VMs. You know, that's how to be ultra secure. But at the end of the day, you know, VMs aren't perfect either and you've got a lot of other problems with configuration management and everything to do there. So the second story is Glenn. He knows a lot about security. He's a crypto cat. And so he talks to this potential source and he's really, really paranoid. He wants to run Linux because, you know, he doesn't trust OSX. He doesn't take that seriously and, you know, malware is on Windows or whatever. And, you know, all the cool kids run Linux and it's got to be super secure, right? But not really. I mean, he's one Tor browser bug exploit away from having his calculator popped or whatever may happen. You know, lib purple track record is awesome. Last time I updated my live CD, that didn't go so well. So the third story is Margaret. Margaret works at an IOT company. She is tired of getting these, everything running as root and everything getting popped and not having to be able to see any kind of security on this little platform. Then I actually inserted this slide after I saw Charlie and Chris's talk where, you know, maybe Margaret also works on the GPU connect team and doesn't want to run D bus as root and have just come, you know, no ability to control things. But really, you know, a lot of that's done just because money obviously takes time to add security.  You know, a lot of these other things are too heavy duty solutions. There's got to be something we can do. And really these stories have in common attack services, right? That's the worst attack service possible there at the bottom. But really, you know, attack service is really important. And sandboxes and containers, it would be great to see them being the norm, not the exception, right? If you look at Chrome and Adobe Reader X, Seatbell, you know, any of the like kind of modern sandboxing environments, that really should be everywhere. There's a battle that we're fighting with native code and you're going to lose, right? And so until we can win and everything's rewritten in some crazy rust or whatever it may be, we have to cut our losses and we can do that with containers. You can do that with sandboxing. You can do that with other isolation. So for Linux, you know, open source loves to reinvent the wheel.  And there's this kind of bumbling investigator that says, you know, what if it wasn't six guys with six guns, but one guy with six guns?  But really Greenlee was right. It was one guy with six guns. So, you know, the question is, what if it wasn't a whole bunch of kernels, but one kernel with multiple user lands? And that's really the core idea of containers, right? So this also is not a new idea. This has been done a long time before Docker and everything came along.  You don't want to rely purely on any virtualization solution. You know, you need guys with guns and fences and, you know, air gaps, actual air gaps, not things connected by wires. And really, you know, I'm not up here to say that containers can do everything. But what I am here to say is that you don't want to depend on any one single method. And containers are getting a lot easier. They're getting a lot powerful, more powerful. And if you can do anything, you might as well just add things in layers, as we've seen. So to get that to how this actually works. So the first major area is namespaces. So within the kernel, just like a lot of any other cool stuff on Unix, it really started in plan nine, where they had the idea of namespaces in the first place. But the Linux kernel is split up into these kind of five namespaces. Network, Mount, user, UTS, which is host name, and pit and pit. And the way you get into one of these namespaces is you, when you clone, when you process clones, you know, spawn a child, it's kind of the new fancy fork. The kind of phrase that you get set up into is you enter a new kernel execution context. And the way you do that is by, when you run, when you call clone, you add these special flags at the end, depending on the namespaces that you want to enter. And so the Mount namespace was added first a long time ago. It basically lets your process have a per process view of what the file system is. IPC, we can keep going through these. You know, your processes can have their own host name. They can have their own view of the other processes. And they can be nested and they can, you know, there's some cool tricks you can do.  Which leads me to the awesome snake oil solution. You can't hack what you can't see.  And the username space, which is the newest one, which was added, that is really important for securing your containers and essentially lets you be root inside of a container, but that's still treated as a low rights user in the context of the kernel outside of the container. Which obviously is also a high risk area of the container. You're really controlling a lot of how the UID system works within the kernel in very sensitive areas. And so there have been a few vulnerabilities of, you know, using the username space to break things outside the context of containers.  Essentially just shifts all your UIDs up by some offset. So the other major area of containers is capabilities.  And capabilities are great, right, that lets us get rid of this just kind of god mode and split it up into a whole bunch of little pieces that really can do, you know, only what you want the process to be able to do with root. The bad thing is that they started lumping them together a bit in weird ways. And so you end up with kind of a capabilities model that somewhat works but is confusing, hard, and can be messed up. So some of the, you know, kind of dangerous capabilities or capabilities that you might commonly encounter are things like being able to receive raw packets or bind to something lower than 1024 or change resource controls or send kill. So everyone always asks, you know, what capabilities should be dropped, you know, should I drop this or that? And really you want to drop all of them. You want to set up everything for your container or your namespace ahead of time and then when you pivot into it, you want to throw away all your capabilities and just live in your little cocoon and you can't do anything at all. And then you get questions on forums or even just people as implementing this, you're thinking like what if I just leave this one capability enabled? What happens? And the answer is it depends. So if we go and look at an example of this, so we look at Ping. Ping is setUID root, right? Everybody from forever ago remembers that, you know, like CD record with setUID root and you could pop shells on Linux and do privsk by doing, you know, any kind of setUID root binary with a vulnerability you get instant root. So it's kind of ridiculous that Ping, you know, on these days still has root and setUID root. Obviously the attack surface is Ping and has been pounded on a bunch. If you copy Ping to somewhere else, you'll lose your setUID root bit. And if you try to run that Ping, you'll get operation not permitted because you need to be able to create raw sockets for Ping or ICMP. So the way to fix that is you can set a capability of CapNet raw on that new elf. If we, you know, look at that, we can see that we have CapNet raw. And then when you try to run it, even as a low rights user, now I can Ping, but that's the only thing I can do. That's the only capability that I have. So obviously there's a lot of dangerous capabilities that you don't want to give things.  That's definitely things you don't want to have. The other bad thing is there's a capability CapSysAdmin. And obviously that sounds pretty important. It's basically root. There's a whole lot of things that CapSysAdmin can do. There's also a great post by Brad Spender that goes into all the detail and all the different capabilities and how to use to get root or do bad things. And that's the link to it. And so the other major aspect of containers is control groups. The basic idea of those is they're hierarchical and inheritable system for controlling resources across a set of processes. And that can be devices or CPU usage or physical CPU, memory amounts, I.O. rates of a certain device network. And it's really you limit on steroids if you want to think about it that way. And it's mainly used to kind of fill the gaps of some namespaces. So right now there is no DEV namespace or there's no namespace. So you kind of have to get around that a little bit by using C groups in a way that someone intended to do that but not really. They're typically controlled through a proctile style file system of pseudoFS. So it's just a directory and you put create directories and this corresponds to PIDs and things will read that directory. The good thing is that obviously it's a file system based and everything on Unix is a file that used to be at least following that model. But at the end of the day you can do tricky over mount attacks that is a side effect of having it be a file. So it's it can be controlled through CG manager but really most of the container platforms will abstract this away. So when you put all that together namespaces isolate the elements of the kernel, the capabilities help enforce those namespaces and limit the capabilities within that container and then the C groups limit the access. So really those three elements along with some other secrets, magic sauce will create containers and it is better than CH root. There's a lot of background to those. You get special mount options. You can do things like an overlay file system where part of the directory is shown to the container and part of it is shown to the host and there's some go in between. You can do crazy stuff with SSHFS now. So where are Linux containers being used now on servers? So a lot of platforms as a service systems, you know, EC2, you can do Docker, Google App Engine uses containers. Heroku has been doing it for way before anybody did and they, you know, Rackspace everybody probably more that don't have on that list. It's also being used in clients. So Chrome OS is a huge user of these technologies. They've done a lot of work hard hard work on making awesome sandboxing in Chrome and Chrome OS. It's somewhat used in Android. It's somewhat used on some Linux distributions. There's also some cool sandboxing tools if you're into those that use these without kind of going to full blown containers. So the kind of major one that started on the kind of path of Docker and the current trend was LXC.  There's also been some recent advancement and I say recent within like the last year or two of containers. So unprivileged containers, I mentioned that the username space, so that really creates the ability for container that they can then be root in but is all treated as a non-root user when it comes down to it. Obviously there's some weird things that can happen with that situation so there's more work and auditing needs to be done there, but that'll be, you know, a futuristic thing where, you know, a low rights user that doesn't have root and never ever will get your root will be able to create containers and do things. But you have this problem, right, we talked about attack surface. So syscalls are one of the main entry points to the system. There was a lot back in 2.2 and now there's a whole lot more. What are all those and does your app really need all those, you know, 300 of some odd syscalls? Probably not. So then this thing came along called Set Comp and the guys at Google Chrome team are doing a ton of awesome work to really push the boundaries of what you can do here in a very good way. This has been tried before, but the way they're doing it is much better than some of the methods that have been tried in the past. But it's important to point out that Set Comp by itself is not a sandbox. It's purely made to just limit the attack surface to things that your app really doesn't need to have. So you can also, not only can you filter on certain syscalls like this process, it's just crunching numbers. So it just needs to call, you know, return and open and that's it. But you can actually control the arguments to those syscalls and say, you know, it only needs to open this file or it can only do these flags on this file. And so that's pretty powerful, right? You do encounter a performance hit. So when you've got a lot of filters, there will be some impact. I think that we're still kind of figuring out what that is and how to optimize it. But it definitely is something to consider if you're going to be rolling it out. If you're going to use any jail directly or use mbox or something like that, you can't, if you're going to use docker with set comp, you have to use the slash contrib or wait till 1.8, which I think is when they're going to actually launch set comp support. But LXC has it right now and you can use it. It's typically done through the PR control. You basically can set one of two flags, the strict mode, which I think will be used for just like, you know, once you get your process into a spot where it's just going to be crunching numbers or doing something very basic, you can put that on there. Or you can filter, and by filter I mean a Berkeley packet filter, which everybody remembers from TCP dump. This is how you would use set comp in an actual program directly. And Berkeley packet filter is pretty cool. You can actually use TCP dump to dump out some of the things that I don't really know how it works underneath, but it's cool that you can see it. So where is set comp being used right now? Lots of places. You can turn it on in lots of places at least. It's not necessarily on by default. It is definitely in Chrome and they've been doing a lot of good work. It's also in Tor, but it's not on by default. So containers, you know, who's doing these, right? So docker, obviously, CoreOS, they have Rocket. There's lots of interesting companies that are either doing these in the background, or they're offering them as a service, or they're going to be offering those as a service. Big shout out to the sandstorm.io guys. They have a crazy customized system and they do GRSEC for everything. And they're super serious about security and everything else. And also the Rancher OS is an interesting idea where everything in that kind of minimal system runs in a container. It's also funny, I don't know if this has been fixed or not, but when you would Google that, it would actually bring up WAVOS Rancheros. Google would fix it. So yeah, they might have some SEO problems. But we're really here to talk about the big two, right? So docker. When I usually mention docker, this is the response. I'm from Silicon Valley, so this is usually the response I get from some devs. It's really packaging and kind of development focused. But one thing that is really good about that, I think, is that it's also very app focused. So the philosophy of docker is that it's not just a container with some things in it, it's ideally one process in that container and that's it. As a security person, I really like that because then not only is it that one process in that container, but it's that one process with just the libraries that it needs and just the files it needs and cutting off a lot of attack service there. And the big deal about docker and why it's gotten so popular is that it really makes containers easy, right? LXC was kind of doing it in kind of the harder mode whereas docker is you know, you just do docker pull and magic happens. But docker isn't just containers, right? So there's all these other things that they've done. It used to be based off of LXC and now they have something called libcontainers written in Go. They also have libchan and libswarm and all these other things. They have a REST API. It by default uses a Unix socket, but you can turn on a REST API. It also, one of the kind of downsides of it that they're working on fixing I think is related to the fact that you know there's this root daemon that runs and everything, all your containers and everything from that goes you have to be root to interact with it which then makes people run as root on the container host and that's never a good thing. So you can pull down your images, you can map things from the host into your container. There's also this idea of docker hub which is kind of like GitHub for containers. You can do commits and all this stuff. And there's all the orchestration, communication and management. I don't think the word orchestration really mentioned much all at all in the last 100 years except for maybe last year. So CoreOS is the other big one. It's really started out as a minimal OS for hosting containers. They're launching Rocket in this app container spec. They're trying to kind of distance themselves from LXC and docker. They're kind of main ideas that they're trying to be more secure and lean and be what docker should be or used to be. And why would anybody use any of these systems? And it's mostly just to make it easy or to package a lot of the functionality with it. And one way that you might kind of relate to it is you can run for EBSD and you can secure that but you kind of need to know what you're doing or you can run OS 10 and it's easy and it's kind of BSD still but you kind of have to take some things for granted about control. And so LXC, it's kind of vanilla, you can do whatever you want and you do get some bleeding edge there but you kind of have to know what you're doing in order to do everything correctly especially based on the defaults. Whereas docker, they do a lot of stuff for you. They drop most of the capabilities that you don't need but they still leave some around and you need to kind of explicitly disable those if your app doesn't need them. We'll get into that. So LXC, hard mode but you got flexibility. Docker, easy but you have some costs or some risks. It's very, very new. We'll get to that. But we're here to talk about attacks, right? That's all just stuff. So if you think about this, there's a lot of different ways that we can go about thinking about what are the attacks in a container or what should I be worried about. So there's containers to other containers. There's things in the container against itself essentially trying to elevate your privileges within a container if you're not just a single process. Container to the container host. Things supporting infrastructure whether that's orchestration and all that other stuff or whether that's other things on the network and you can go from there. So kind of starting at the top, the kernel obviously is doing all this virtualization stuff. So in the kernel, you've got all these old drivers, you've got all this old code, you've got weird file system support. Pretty much nobody compiles a kernel from scratch anymore that doesn't have all this bloaty stuff that you probably don't even need. Which means you're also inheriting those vulnerabilities of some random Canbus, you know special Canbus driver thing in Linux that you don't use on your server. The other way that this kind of typically goes bad is not dropping capabilities. So CapNet Admin is kind of a bad offender. There's been, I don't know how many different CVEs were of documentation and vulnerabilities where you can go from CapNet Admin to something else that you shouldn't be doing that isn't related to networking. The way that's happened in a lot of cases is being able to force CapNet Admin to load an arbitrary kernel module that you then control.  But, you know, speaking of dropping capabilities, Docker was really stung by this. So they kept around for a long time the CapDac read search capability.  You can also invoke OpenHandleAt, which is a syscall that doesn't really have a ton of documentation.  But it turns out that if you actually use that syscall and you do some other tricks based on iNodes and other things, you can essentially brute force the iNode of EtsyShadow in the host and read it from inside the container. And obviously there's other attacks you can do related to that. But, you know, that was something that really gave the capability model a good example of why you need to drop the ones that you don't really need because they're complicated. And, you know, if you don't drop those capabilities, you have to rely on some other thing to enforce the rules on your container. And, you know, that's typically done through a manager access control system like SC Linux or AppArmor. But if you don't use that, the capabilities are your only line of defense because if you're root in a container, you're still root on a host unless you're using the user namespace which again doesn't have a ton of support yet or adoption. You also have the problem of limiting access. So we mentioned how the kernel there's not a namespace for PROC or there's not a namespace for DEV. And so what happens is you have things in the kernel or things in the container that are exposed from the host or that bridge of the host and the container. So things like PROC or where you can expose the kernel memory into the container. You have things like, you know, CISREC which everyone forgets about but stung, you know, LXC for a number of years where they, you know, were leaving that open. You also have things like being able to make new devices or even just CD message, right? That's not a ton of attack surface there but, you know, you're leaking things like maybe firewall rules or other stuff. And then unattain access to the network, right? So a lot of these container systems use a bridge system by default. If you remember networking 101 a bridge is a switch. So most of the default systems by I think almost all the containers will create a bridge and let your containers talk to each other. And that isn't something that most people realize when they deploy five containers on a host. They don't think that all those containers will be able to communicate but they can unless you've written firewall rules or switched to some other networking type. That's not limiting any resources. Obviously if you fork bomb a container with my favorite bash function there you're going to be fork bombing the host.  You know, that doesn't really happen. What happens when there's a vulnerability in one of those libraries and you need to update it? What do you do? You know, you can't just you're not supposed to run app get upgrade on your containers. It's kind of a no-no in the container world because they're supposed to be ephemeral and immutable. And so what do you do? And so you kind of need to have a system to adopt that, have a patching system. And then the lack of mandatory access control. So most of the container systems also have some form of app armor support or SE Linux support that works quite well. Obviously it's not perfect. There's been some bugs even very recently that were published there. But at the end of the day, you know, the kernel is still enforcing things. So this isn't a perfect solution either. And really it should just be one facet of many different things. And we mentioned that the networking defaults and how that can be bad. For LXC specifically, the defaults are quite bad for dropping capabilities. But that kind of relates to the way that the model of LXC is you have a minimal container, but it's not supposed to really just be a single process. It's supposed to be a few different things, maybe an SSH daemon or SystemD or something like that. Whereas Docker is the idea of one process. But speaking of Docker, so Docker does a pretty good job of dropping capabilities. But if you read the between the lines, they mention that they drop all the capabilities except for those required. But if they don't know what you're going to be running, how do they know the ones that are still required? And then, you know, you have to be root to use it. So that ends up being kind of bad. I've been on a number of engagements where there's been a, you know, people have been added to the Docker group. But, you know, if you're in the Docker group, you can essentially root the host trivially. There's also things like the REST API by default doesn't have authentication. So if you've turned that on and it's bound on problem where, you know, some outside attacker can get to it or, you know, some server side request forgery or some other thing where you can get to that system. And it could even be exposed to containers through that bridge system if you don't have firewall. And then it also has the kind of GitHub all the way down problem, which I think is not just Docker has the problem where, you know, you've got something like it's including these from these five vendors and they just accept commit requests from these five other people on GitHub. And all that code is just being chained down to some kid in the basement. And he doesn't know that the code he's committing is going into data centers and, you know, a crazy company. And all it would take would be one commit. There's been backdoored AMIs published before so we'll see what happens with GitHub and all that. It also, you know, I mentioned it doesn't drop all the capabilities, you know, by default it still keeps CapNetRAW, it still keeps the container. You can still make devices in your container. You're going to be limited by app armor, but, you know, most of the time your app probably isn't going to need those so you should drop them. When you bind a port to Docker by default it binds it to all the interfaces. And so if you have a multiple interfaces that are exposing to your container it's going to be on all of those. There's some other things related to, you know, base images are also really huge. So a lot of people in their file which is, you know, the main way of spinning up your Docker image they'll, you know, from Ubuntu or something like that but that pulls in like 250 megabytes of packages that, you know, you don't need. And, you know, that's kind of a problem where you think you're just running a single process in that container but really there's a whole bunch of other stuff there that could be used to try to attack or break out of that container. I mentioned giving the, you know, giving users access to the Docker user or the Docker group on a host, you know, essentially giving them root. It doesn't have support right now for SAC Comp or username spaces which are two, you know, really critical security benefits but it will very soon. I think 1.8 is what they've mentioned about that. And the other thing I've mentioned that I've seen on GitHub is people for trying to do introspection with their container if something in the container be able to see, you know, what's going on with them, they'll expose the Docker socket inside the container. Don't do that. That's giving your container root on your host. And speaking of the user name space, I have to kind of poke at them a little bit more. They mentioned on Hacker News that, you know, I'm the maintainer of Docker. You know, we will soon have support for user name spaces. When we feel comfortable, the Docker can run UID uninterested zero. We will say so clearly. We're going to go, no, probably more year than a year ago now. And they still don't have it. To give them a little credit, though, I think that one of the major reasons why they don't have the user name space is I was actually a limitation of go and not necessarily their fault, but they're on it now and so hopefully it will be soon. Also, every container talk has to have an image of some broken container. So I can check that box.  It's just a binary that you can run and it does this stuff, but there's no thing that's running on your host. It still requires root to run it. So I don't know if they've really solved the problem. It also doesn't drop almost any of the dangerous capabilities. It also doesn't support the user name space. Let's see, what else? Kind of supports SE Linux, but there's no documentation. For a long time, they had a bug where you couldn't actually run things inside a container without running them as root inside the container, which just seems crazy. They don't have a lot of limits they should on proc or proxys. So if you read the documentation, they have this very impressive design with this multi-stage system and it sounds really good, but unfortunately I think this is a competition. I hope it improves because I like to see competition, but I think right now this is where they're at. So then very recently, I think at DockerCon 15, they announced the open container project. I was really, really bummed that they didn't go with this logo because it's awesome and a great movie. So they actually changed their name to the open container initiative. And they really have this specification for containers and kind of to standardize the system and not have all this different kind of competing things. They launched something called Run-C, which is a very, very minimal container that essentially is a kind of competition for Rocket. It's very minimal. You just define your container with a Gison file or something like that. And then it's backed by LibContainer, which is supported by Docker and RoboCop. So all that stuff sounds kind of bad and messed up and what can we do? So there's a lot of recommendations I have. I actually have a ton of stuff in a white paper that I'm going to be publishing really soon. So I kind of designed my slides to be somewhat of high level of each area. But the white paper goes into a ton of detail on all this stuff. But really the big message is defense in depth. Nobody says that and I can tooth that horn a bunch. But really if you're trying to defend against things you want to build your defenses in layers and that's really the only way you're going to do it. So if we're going to do that we want to start with the kernel because it's got a kernel. So you want to do GR Security. Like just everyone should be running it. It's ridiculous, especially on a server where there's no special hardware. Sometimes on a laptop GR Security can be a little tricky to do with drivers or whatever it may be. But on a server when you're just running a few things or you're doing containers just do it. And so obviously hardening your kernel in other ways. Dropping all the capabilities that you don't want trying to design for the smallest possible set and also assuming the worst. So you're giving these capabilities out but you want to be careful about what they are and try to fully understand what each capability really can do. So if you have an app armor or a GR Security RBAC or a SMAC or some other thing if you can most of the container systems will have app armor by default enabled which is awesome. It also can be nested so that's kind of crazy to think about but you can create an app armor profile for a container and then in that container if you want to then have something be able to apply a secondary set of that first one you can do that. That's kind of neat. For Docker specifically you don't want to allow users to run Docker if you don't want to give them root on that host. You don't want to run containers that are privileges or containers that are root. As we've seen either using an IP table trick or using the CapNet bind service you do not need to be root to bind to lower the 1024.  Using small base images is also cool. There's a really good talk about building a crazy tiny go Docker image and it's going to be documented. Using set comp if you can so right now with LXC you can use a whitelist of syscalls that you want to allow your app to be able to call. That can really cut off a ton of attack surface in ways that the kernel is typically accessed. You want to do all your normal system hardening that's a long list of things but there's a lot of stuff to do there and that's what should be done. You want to avoid things that are listing on all interfaces that cross container networking. The other thing that's cool about containers is if you have these different interfaces it's really easy to tell what's going in and out of my processes in that container and so it can be great for trace flow. The core picture is you've got this hardened application then under that you've got your user namespace you've dropped capabilities then you have mount protections. For maybe like the log files or something like that. Then you've got a minimal container distro and then you do sitcom filtering and then you've got GR security and then you can even do a hypervisor or some other kind of virtual machine to gain some actual hardware separation and then you isolate that whole thing by some trust that you give it and then do that differently for other things. For containers that are getting hit by your API that are on the front end of your system those should be treated with different trust than some container back end that has your database. You don't want to have those on the same system if you can avoid it even in separate hardware VMs that's not ideal. Where do we go from here? More namespaces hopefully will be coming that will help clear that up a little bit. Some of the edge cases where PROC right now is kind of a shit show there was a thing recently where Intel came out with this thing called clear containers which is essentially like a 20 megabyte hypervisor that will give you some hardware virtualization aspects that you can apply to containers. That's a really cool hybrid model that I think is going to be need to explore. More minimal container distros will probably be coming out soon or more refined going forward. And also because this is Linux on Linux and most of these features can be implemented anywhere Linux can run you can actually do this kind of stuff on embedded devices. You can do these kinds of isolation mechanisms or run containers on a phone or on whatever whereas virtualization or other things is less capable there. There's also, we've talked a lot about servers but really there's no reason why desktop Linux can't benefit from all these isolation mechanisms or using containers. So hopefully there's a lot more efforts there. I personally run everything in a container that speaks anything externally or that parses anything from the outside. So there's all of this microservices idea which is somewhat new. It's kind of cool. You end up something like this. I think one of the ways that's neat about it is that actually isn't a microservices picture. So if you think about it the way that microservices the idea of them splitting up everything into 100 different REST APIs that sounds like a pain in the ass but really it lets you do a lot of least privileges and least access and you can do a lot of crazy cool security where everyone always draws all these boxes on a white board of this is what our system looks like but at the end of the day there's a whole bunch of other pieces that get connected there just my auth service talks to the database it also could talk to some other thing because nobody writes firewall rules for all that stuff so the microservices model is this kind of splitting everything up into pieces running it all in little containers having message queues and all kinds of things unfortunately it starts off with something like this and ends up something like this when it gets implemented so really it's not about perfect security containers you can't just drop that and think you have security but it's improving the work the number of times that I've been on a pen test or some red team or something I've been stopped by popping something and then having it be inside a sandbox or a container is close to zero and that's just silly these days because it's not that hard to do containers it can secure a lot of existing systems that are Linux and the microservices architecture it's coming it's going to be adding that's going to be a lot more popular and I actually like it from the security aspects of it so coming soon so my white paper is coming out it covers everything that I've talked about in a whole lot more depth it covers all kinds of past attacks and looking at new areas and everything and hopefully it'll be released soon if you want to make sure that you get it I'm going to be writing everybody emails me in a text file you can follow me on twitter and I'll talk about it at some point any questions or comments yeah three and I'll be around after this is the last talk thanks a lot for hanging out it's kind of late but I appreciate it


In this study, we found that a 14-day VPZ-containing triple therapy was safe and more effective than other treatments in the Chinese population. Additionally, VPZ did not have any direct inhibitory effects on H. Pylori but instead worked indirectly by down-regulating genes related to the ribosome. This suggests that VPZ could be used as a first-line treatment for H. Pylori infection in the Chinese population. This article was authored by Zinan Zhang, Zinan Zhang, Fan Lu, and others.