Good morning, everybody. It's March 17th. It's Thursday. It's 2022. I don't know why I said it in that order. It's Thursday March 17th 2022 We're about to go back up to Norway house Manitoba. It's about a 10-hour drive from where I am now We're gonna bobtail up there. We're gonna pick up another one of those office trailers I'm gonna bring that one down to Selkirk. It's almost exactly the same thing we did yesterday Except that one we brought to Stonewall. Selkirk's a little further east down the road Pretty much the same thing though. 10 hours up there. We're gonna sleep there tonight 10 hours back down and we'll be back tomorrow Friday evening. It'll work out perfect Stop by the Timmy's here in At Deacon's Corner Look at all this. This is what happens when all the snow melts, eh? I don't know what that loader guy's doing if he's moving the water or if he's moving the snow I think he's trying to move the water Oh Boy, I don't want to get stuck here. Oh, oh, man. No, I'm not going in here. Oh Look at this. What a mess. No, I'm not going in there.  I'm bobtailing. I'm gonna get stuck in that stuff See we're not sinking in here. So this this part here is tough towards Harder just like where that guy is there too. He's safe there But this is all packed snow, right?  It's gonna hold on to you real tight so these are the kind of things you learned in your first couple of years of trucking and How how different seasons I've produced different challenges in different climates in different regions I think we can make it through that but doesn't look too soft We'll just come a roaring through here and just plow right through This gas station is almost ready here. It's gonna be an ESO So when Timmy's It used to be Timmy's and Wendy's always now. It's always Timmy's and ESO so the reason I Pointed out the fact that I was bob tailing before when I decided not to go through that Was because you have less traction when you're bob tailing because there's no weight on your drive tires, right?  I mean I would go through that fully loaded But you still run the risk of getting stuck. So if you don't want to run run the risk Just go where you're not going to get stuck Just if you're fully loaded you could probably because you're you're pushing tracks through this way And if you suddenly get stuck and can't go forward well, you can just back up in the tracks You just made right and then take another running start at it probably won't get stuck Like this guy here, look at him He's gonna plow right through give her bud always gonna go for the path of least resistance there, but You see he's probably got a lot of weight in that trailer Even if it's an empty trailer is more than I have So those are the kind of things you learn over the first few years of driving, right? And that's why it's sometimes kind of hard to get on at a company without that experience because the first two years You learn so much, but then the question comes up like Where do I gain my experience if everybody requires experience? Usually like in any career you got to sort of start on something a little bit Closer to home a little bit smaller maybe driving some dump trucks gravel trucks for me personally I went and delivered Pepsi for five years Pepsi and Winnipeg is always looking well I shouldn't sit now it's been ten years since I've been there But they were really desperate for drivers and they hired me right out of the gate. I was 18 I didn't even have my commercial license when they hired me for the job They helped me get my license and trained me and stuff. I got my license and then boom I was out on my own the next day They really needed drivers and I got my experience that way, right? Another way you can gain experience is some of the mega carriers they have these training programs set up already It's a very expensive Big program that some of the big companies do have I'm not familiar with them because I've never gone through them But I know that they they'll train you and hire you if you sign a contract to work with them for an X amount of Time like a year or two after your training is complete, right? That'll train that'll pay back your training Sometimes they'll even train you for free if you agree to work for a year or two at a reduced rate to pay back the training, right? I'm not familiar with those. I'm sorry. I can't help you with those I can help you get work here if you're eligible to work with us here and you do have the experience already We do we do ask that We all a lot of specialized freight here, so we need a Drivers who are passionate about driving who love to drive know what they're doing and can get our freight from point a to point Be safely and in one piece without wrecking it, right? So we are looking for drivers and Even if you think you may not be eligible, but you want to apply anyways You can always send me an email my email address is always down below in the description Trucker Josh at Keystone Western comm there's a link down below in the description to make it super easy for you If you're thinking that you want to work here with us Even if you're wondering maybe I'm not eligible, but I should try anyways There's any a message anyway as we can chat maybe we can work something out, you know, maybe we can figure it out together Maybe you don't have quite the experience that we require, but hey, maybe we can work something out. We can We can figure it out and get you in a truck, right? Because we're looking for drivers, too And we're willing to to work with you so that we can get our freight moving and get you working Buckle myself in so I don't fall out Start her up so we can move forward put her in gear All right But the lights on We're ready to rock. We have 825 kilometers to go. That's 500 miles approximately And we want to do that tonight Let's give her. Oh am I stuck? Nope. Nope. No. Yeah, let's give her no stopping no stopping Yeah, we can't go too fast or we're gonna Go flying out the window over all these bumps Yikes Okay, keep moving just keep moving just keep moving Keep moving. I don't even have to lock up the diffs or anything here Okay, this is a little bit of a soft part here. We should be fine. There's a tow truck right there if I need them Okay, okay And didn't even have to lock anything up Beautiful we've got our Tim's It's always a little bit of a rough ride Bob telling so it's gonna be a bit of a rough ride up north But once we hook on to a trailer, it'll be a smooth ride back south We get to go over that ice road again, that's pretty cool Told my wife last night that I went over the ice Shouldn't have done that Oh, well, it's only half a kilometer and the ice is probably like eight feet thick What do I know? These guys are Bob telling to maybe I should go that way. You know what I'm gonna go that way. I Don't know that way. I changed my mind change my mind doing this way Is this way leads up to the road we call doogled and doogled will take me to the perimeter The road that I want to go to we're gonna go around the north side of Winnipeg and Shoot up like an arrow up up highway six The one highway leading up into northern Manitoba, and it's pretty warm down here right now. It's plus three degrees Celsius Yesterday when I was in Norway house, it was minus 22 up there So it's quite a bit colder there, which is good because I don't want that ice road to melt out. I Don't want to fall through I Know the camera's got a steady camera option on it See you you really aren't seeing how bumpy this road is right now as I'm bob-tailing up the six I'm between what is that Grand Rapids and? Where the six turns east on the way to Thompson? Holy smokes. I forgot already. It's only been one day since I've been up here But yeah, we got to tighten all the bolts and we get there Yikes Look at this thing. Look at everything shake How bad the road is here there's nuts And this is the better part of it. It was worse over there. I pulled over because it was so bumpy I had to give my head a break. It's getting a headache. We're coming up to the generating station Genpeg I think there's a bunch of parking right here or in there, too could always park In and around here if I have to later, but I'm pretty sure I'll have a few hours to keep going yet narrow bridge It'd be interesting taking oversized loads through here I'd love to go inside these hydro dams and actually see how they work. I Think that'd be a really neat field trip Do any of you work in one of these somewhere if not here in Manitoba? Maybe somewhere else? Must be a pretty neat job. I'm surprised there's not more cabins or something up here Is all the lakes like this down in the southern part of the province in the southeast every lake like this has a Multi-million-dollar cabins and cottages lining it. I Guess up here. It's it's untapped one day. It'll be filled with all kinds of cottages One day Manitoba doesn't have enough people yet eventually we'll all spread up here We're coming up to the ice crossing Just about dark out here now On our way back. It'll definitely be pitch black outside Good thing. It's not a very long crossing like I was saying yesterday Usually there's a cable ferry that goes back and forth But when the water freezes We just drive over the water You know most countries they they build or most places I should say Canada to most places build bridges To get over rivers and bodies of water, right? No, not here in northern Manitoba Why build a bridge you just drive right over the water? Way easier cheaper too. Here we go. That's where the ferry usually sits And we got to go down here. This is just across. This isn't even road. This is just down the riverbanks Onto the water over there. It's been a bit of a warmer day today So we'll see how it is. Water we go. It's definitely a lot wetter than it was yesterday Yeeks. Yeah, there's water pooled up on top of the ice here already All right, let's give her On to the water we go driving on the water Insert Jesus joke here very slushy Yikes want to get stuck out here doesn't get your heart pumping. I don't know what does We got to go back across that with a loaded trailer There's my trailer right there exactly like the one I picked up before It's a regular 53 foot reefer trailer by the looks of it the reefer engine has been taken off on the front the refrigeration engine and It's just been converted. I Really want to get back over the ice as quickly as possible I Was only my second time coming up here I guess my third time going over the ice and Going back will be my fourth time but second time loaded and it's been a really warm day As you saw a lot of water and slush had pooled up on top of the ice already That's normal from what I've heard, but it still makes me a little nervous because I'm not used to that I don't do that that often. I don't want to get back over that ice as fast as possible So that I can just be back on the mainland I guess Because this is technically an island that I'm on right now. There's no bridge I mean, there's got to be a time during the year where you can't leave the island right because the ice is too thin to drive over But it's still too thick for the ferry to run back and forth So there's got to be a period of time and both spring and fall where no one can come or go I Don't want to get caught in that time. I don't think that's still like April next month, but I I want to get out of here. I'm gonna get back over that water Guess if you haven't noticed the roads were so rough on the way up here That these brackets actually broke Right off the frame. That's a steel bracket in there. This bracket here Defender like that. That's usually over here Broke right off. I'm lucky it didn't actually fall off I pulled over and it was sort of just hanging off a thread here and laying on the tire and Figure well, that's not good so literally just Picked it up and the rest of it broke off of here and I had to strap it on to the back there We'll get it fixed when we get back to the shop But that's what I mean. I'm not kidding you the roads are terrible coming up here. I need to do something about that The truck is falling apart Need some smoother roads But we made it We made it In one piece the whole piece is still here. We didn't lose anything It's right there Crazy, it's always something. It's always something Just pulled it out just from beside the building there so that I could do a proper walk around Also made sure it was hooked on properly and I got to go grab these Landing gear pads check the tires tires roll turning on this side so the brakes aren't frozen. That's awesome Lights are working back here Fantastic, everything's locked up fantastic All right double check these You can tell that neither tire was sliding because the tracks in the snow So once again, you can tell that it's good by the way that it is Doors are closed and locked locked Okay, so now I've got to Find a place where I can tie down those Dolly pads, I think I might just put them in here There's room in here. We'll see if I can do that And then we'll be on our way Gotta get over that ice sooner the better I don't know if you can see them There's one there one here. I was hoping that because they were frozen into the ground, right? It's kind of hoping that driving over them would loosen them up. They're still frozen to the ground. So we got to go get our trusty fix it tool You know, which tool I'm talking about The trusty crowbar Fixes everything You could pry stuff with it. You can whack stuff with it. You could poke stuff with it haha, I Can't lose But you right here, I guess See the dolly pad down there, right? All right now, should I pry it or should I whack it as the ground thaws Trailer like to sink right into the ground If you don't put it on means I put them under there That way I have them with me very important because if this trailer sinks in in the front there That's a big mess to clean up and nobody's gonna be very happy with me and I like keeping people happy. I'm a people-pleaser Especially when I'm working. I have this thing about pleasing customers. I like them to be happy So that they call back to the ice road All my stuff is just all over the truck. I had this all organized before And I've already cleaned up a lot of it roads just were absolutely nuts and I have to some clean up later now Just nuts so much stuff under here, too Man, and what are my clothes doing up here? Those were all the way back there on the bed They made it all the way up here under the dash It's just a rodeo It's winter roads for you Okay, we're coming up to the ice crossing. I saw a produce truck go in the other way So he came across here fully loaded. That made me feel a little more comfortable There's a car in front of us here is gonna cross in front of us I don't know if you see him way down there Google's my GPS down here still telling me to take the ferry Can't do that this time of year google Okay, now there's a sign off to the right here that should say that the ice crossing is still open And the maximum weight allowed This is seafalls ice crossing. It says open max weight 39.5 tons Uh, that would be 39,500 kilograms So here we go and turn traction control off You know lock up my axles a bit Now you don't want to go flying down onto the ice. You want to go A steady speed but not too fast Let's avoid that little pool of water right there Okay, not too fast not too fast Okay We are on the water Let's get across don't hear any cracking This time of year. I'm not really expecting anything to go wrong, but Since I don't do this that often Uh, it does make me a little nervous when I get so slushy and watery like this on top of the ice Get on to the Banks here. Okay. Now we're on the land I believe And we want to go up the riverbank. Actually, you know, this is the edge of the river yet, right? And we want to give her a little bit going up here Give her give her give her Come on get up here. Here we go. Look at that another successful ice crossing Look at us.  You're now an ice road trucker Cross the ice roads together. It wasn't so bad Thanks for hanging out with me all the way to the end the crossing on the way back was a Well, the second crossing like the second this today was a little bit more uh, uh Intense for me. It's it was only my second time ever going there and back across an ice road and The guy explained it to you right there. There's like a few inches of just slush and water on top of the lake Apparently that's nothing yet though because the locals there were telling me that sometimes there's a foot of water on top of the ice So you're you drive out into the the river and it's just water You drive out. There's a foot of water on top of the ice that you're driving through the water To the other side. You can't see the ice. It's under the water. That's already melted, but it's still good Still good. You still go across Ah, I'm glad I I'm glad I wasn't there for that that would I'm a southern boy. I live in southern canada. I like living in the south You know where we don't have to drive across rivers. Why don't they have a bridge? Apparently the government's been promising the the first nation reserve up there a bridge for like years and years already And they just haven't built it Doesn't that just seem right in line with everything else that they've been promising, you know I Having trouble getting fresh water up to these reserves and we're having trouble building a simple bridge across a little river It's not even that big of a river Come on guys build them a bridge already. That's crazy. Come on. Let's let's get a bridge built up there for norway house man Anyways, uh, that's that's just the way it is up there right now fairy by summer Ice road by winter and I'm guessing there's a certain amount of time during the year Where neither is working because the ice is too thin to drive on but too thick for the boat to go across I don't know I don't know problems that that you know a Just a bridge would solve simple solution Whatever Hope to get one soon. Thanks for watching everybody and I'll see you in tomorrow's video. It was fun crossing the ice road with you


I'll moderate on behalf of the team here just to assist today. So sorry, tova, yep, yep, yep. Don't have to take you expected. Jason, and then I'll come back to Jessica. Yep, yep, yep, yeah, something. Yeah, Jessica, yeah, Mark, yep, yeah, yes. So you've fully said in, what's the point at which, you know, the app considers you fully vaccinated or have you? Yes, yes, limited. Derek, and then I'll come back to tova's question on booses, and then Ben, yeah. Tova, and then I'll come to Ben. Yeah, capability plays. Yeah, yeah, yes, please, yeah, yeah. Um, yeah, yep, yeah, no, yeah, yeah, Mark, yeah, yeah, yeah. Yeah, go ahead, and then we'll finish there. Mmm, okay, sorry, Jessica, yeah. Oh, Jason, and then Derek, something. Yeah, yeah, yeah, so the, yeah, yeah, who haven't I taken?  Yeah, Jessica, and then I'll come over here, and then actually I'm going to finish with Bernard. Jessica, frustration to men. Yes, yes, all of those things. Yep, workplace, the sticks we required to be vaccinated. So I did say I was going to finish on Ben. Yeah, Auckland remains at level three. So I'll let you finish with a sub-ben. All right, thank you, thank you everyone, five pass. We won't make anyone endure more than an hour. Thank you.


I liked working with the dead, until last night. My shift began, as it always did, at 11pm when I arrived at the station and walked along to the platform where the train was waiting. The driver's cabin at the front of the train is self-contained. There's an access hatch for loading goods in the front carriage, which is also the way I entered and exited. First, I did a walkthrough of the carriages to check the cleaners had been thorough. The smell of detergent lingered throughout the four carriages and all the surfaces looked to have been wiped down, so that was fine. It usually was. Last week, on the Monday, had been an exception. I'd found a cigarette butt lying on the floor. I'd picked it up, wiped carefully around where it had been with a tissue, and filed the report with my supervisor. I'd placed the offending item in an envelope and attached it with a paper clip. My supervisor works nine to five and never seems to lock his office door, so I left the report on his desk. If there had been consequences, if a reprimand had been issued about the cigarette butt, no one had told me. I finished my walkthrough by checking the emergency exit, which is at the end of the rear carriage. It was locked as it should be. This done, I returned to the front carriage. The interior of the carriages are empty, apart from fluorescent strips fixed into their ceilings to light the way. I exited via the access hatch and went to greet the loaders. It was quiet in the station. The last commuter train for the day had departed 30 minutes ago. A cross-country express passed through at 20 past midnight. Most people didn't know about the night train I worked on. We simply got on with what we did at a time when we were quietly out of sight. The coffins are brought to the station by road, then placed on trolleys. I counted 24 coffins as they were loaded out of the train over the course of the next 40 minutes. This tallied with a note the loading crew presented. So I signed off the consignment, the coffins, and those they carried were in my care now. They came from the city's public hospitals.  The homeless, drug addicts, crime victims, some who taken their own lives, all reduced to John or Jane Doe's with no family or friends prepared or able to give them a decent burial. So the city authorities stepped in. I've always been a civic-minded person and took pride in the role I played in this. It wasn't a job I'd planned for. I'd been a conductor on one of the commuter trains for 20 years. One day, it had been a Saturday early evening. A young man was mouth and off to me. I thought he'd been trying to impress the woman he was traveling with. I could smell from his breath that he'd been drinking. He kept on cussing me, the obscenity spiraling, until I cuffed him across the face. Just once, not that hard. They wanted to fire me, but I dug my heels in. Then they offered me a job as guard on the night train to the cemetery. I said yes. I did my second walkthrough of the shift. The coffins were placed out on the carriage floors, where they would remain until they were unloaded at the cemetery. This is a sprawling, actually pretty interesting place on the northern outskirts of the city. I went there once in the daytime, not long after I started my new job. I always meant to research its history. I'd never gotten round to it though. A familiar hum filled the carriages. The driver had arrived and was starting up the engine. I moved back through to the front carriage and took my place on a flip down seat. The journey would take about 90 minutes. Apart from the rattling of the carriage wheels on the tracks, it is quiet. Quiet enough to hear what sounds like sighing, coming from inside the coffins. The first time I heard this, on my first ever shift, I was badly spooked. When I reasoned out, it was simply gases being expelled from the bodies. All part of the natural process and nothing to be worried about. About 30 minutes into the journey, I did another walkthrough, just to double check everything was okay. It was, apart from one of the coffin lids in the rear carriage, was slightly open. The lids are not hinged, but stuck on. It's a matter of economics that the coffins are of poor quality, made of thin sections of wood, and on this occasion, the rattling progress of the train must have shook the lid loose. I slid it closed and went on my way. With 15 minutes to go to our arrival at the cemetery, I decided to make sure the lid had not worked its way open again. I walked through the carriages until I reached the rear one and came to a sudden halt. Cold fear ran through me. The coffin lid was lying a skew on the floor. The body inside the coffin was sitting up. Its eyes were closed, its lips were pursed, its mottled skin was gray and waxy in the fluorescent light. It had a green hospital robe on. It was. It had been. A man. I could make out a tattoo on the body's neck, four inked letters. Jane. Had that been his wife, or his lover, I wondered, and fear became sorrow as I thought of a life lost. I have no medical training, but I considered that this could once again be something to do with gases that are produced post-mortem. Or was it muscles constricting? Yes, that made sense. It was horrific and heartbreaking, but that was all it was. I steeled myself. I couldn't relieve the body like this. What would the crew who unloaded the coffins at the graveyard think of me if they saw it? Sometimes it felt like my pride was the only thing I had left in this life, and it was pride that made me step up to the body. I placed my hands on the green hospital robe and pressed. There was resistance. Like the body was locked solid. I pressed harder and was able to slowly lower the body back down into a lying position. Then I retrieved the lid, put it back on top of the coffin. I was thinking how to now properly secure it when the train drew to a halt. My mind was so addled that it took me a moment to realize that this was because we'd arrived at the cemetery. Trying to compose myself, I walked back to the front carriage. I needed to open up for the unloaders. After sliding open the access hatch, I stepped out of the train. I wanted to breathe in the fresh night air. Behind me, I heard the crew bustling around. I watched as they began to transfer coffins onto trolleys to be transported to the chapel of rest. They would be buried as they always were. Engraves marked with simple wooden crosses at first light. I was still in a daze and I didn't hear the first time when one of the offloading crew had said something to me. I said sorry and asked them to repeat it. I heard, mistake, there's been a mistake. They explained that when they reached the rear carriage and lifted one of the coffins, they realized from its weight that it was empty. They'd slid open the lid to double check and, yes, there'd been nothing there. That can't be, I thought, and was desperately trying to work out what could have happened, but the crew wanted me to sign off the note, which now had handwritten on it that one of the coffins had not been offloaded because there was no body inside. The crew wanted to get on with taking the coffins they did have to the chapel of rest and the driver was leaning out of the window and signaling at me to get going. I climbed back into the front carriage, closed the access hatch, and took my place on the flip down seat. I felt numb, nauseous. The train set off. I was alone in the carriages, just me and the empty coffin in the rear carriage. There was a rational reason for this, I tried to tell myself. There was nothing else, or else the offloading crew would have seen it. I knew I should go through the carriages to look for myself, perhaps try the emergency exit. Check, it was still locked. I couldn't. I sat, paralyzed with fear. My mind was racing. The carriage wheels were rattling, and there was a new sound of something scraping along the floor, like feet. Being dragged. Was it getting louder? Was it coming towards me? I closed my eyes and prayed and waited. The rest of the journey passed in this way. As the train juttered to a halt, I opened my eyes. My legs felt so weak I could barely stand, but I managed to make it off the train. I stood on the platform. It was still hours before dawn, and the station was deserted. I stood there, and I wept. I didn't file a report. Instead, I left a handwritten letter of resignation on my supervisor's desk. I didn't give any reasons why I'd resigned. Some things cannot be explained.


Hi, good morning. Hi, good morning, and welcome to today's products and focus So most global equity markets are a little bit lower this morning following a volatile session yesterday And we're beginning to already ramp up for for next week where we do have the FOMC session due and that's on the 17th of September, which is Thursday and More data on Sunday night On China which a lot of traders are looking at so it's suspected that there might be a little bit Selling pressure towards the end of our session or first thing in the morning as the Asian sessions come to an end But obviously towards the end of the US session tonight where some people might want to take some money off the table just in case That Chinese data comes out much worse than expected But obviously if it comes out really bad And that means that there'll be a lot more potential stimulus calls in that part of the world if it's just slightly worse than expected That's probably gonna have the biggest impact on equities Not that's gonna have a huge impact necessarily, but you have been warned Especially after you look at that 24th of August Chinese sell-off that came very that came on the Monday Following a really poor date release from China at the weekend So don't forget about those ones at the weekend. They are available to you actually on the economic calendar We just kind of fast forward through here. You can see The date releases so I always have a look at Saturday and Sunday now on a Friday on the market calendar Make sure you don't miss out on those date releases. So in regards to our economic date today We do have USPPI and the University of Michigan sentiment index at 1 30 and 3 p.m. UK time respectively So make sure you don't forget about those as well. So then looking at the UK 100 Similar kind of picture, I guess graveyard doge formation on Wednesday at more volatility on Thursday And we're down towards the bottom end of our range already this morning Looking at things from an intraday perspective the damage pressure is already Getting ramped up first thing, but we are coming up close to the end of the Chinese session I think that's run about half past the 9 o'clock UK time for the Shanghai composite index closes and I can see that Hong Kong 43 in China a 50 are trading they're slightly down at the moment But apparently there was a little bit more government intervention in China last night as well on the yuan I believe so that was quite an interesting move and some FX pairs overnight because of that. So looking at Japan 2 to 5 Actually making positive headway if only just these candle formations are quite strange to to see On the screen here because it's kind of unusual to have a count formation like this And then I follow through with loads of all till the next day and still be positive and then be positive again already this morning dollar yen 120 spot 55 But potential resistance at 18 306 still in play those crossover on the MACD so looking at dollar yen Looks to be that 21 period SMA providing short-term potential resistance with one 21 87 being the actual price Potential resistance, but you can just see there this black 21 period SMA on here It might be providing a little bit of short-term potential resistance as well with 118 or 119 being the potential support So moving on to West Texas crew It's down one day up next Bullition golfing pattern. Yes, the looks to be that 45 85 is certainly a potential resistance level to be aware of and failing to break through So Saudi Arabia blocked calls for a conference on the price of oil. They're quite happy obviously with the political landscape To keep things as they are No plans to cut back on production to support prices. Everything's all status quo So that was the latest news in regards to crude oil So with gold it's not doing a huge amount either obviously we had this there's the break lower. Yes, and it's not fall through today The dollar's actually lost a little bit momentum because sterling and neural have both gone up on the day charts Lots of people saying that it's As a timber rate hike seems Kind of shouldn't shouldn't happen. It's good for America, but they've got to think about the rest of the world To be honest, it's all about is it right for America to be completely fair depending who you speak to Some people will think that yeah They should raise rates because they need to have that little bit of extra wiggle room for the future and other people saying there's too much Volatility in the markets right now It kind of feels to me that maybe they should just raise rates at this time just to have left off And that there might be some short-term volatility But it could be better for some countries longer term the countries that will be the the most affected by a raise in interest And the UK will be emerging markets Such places like Indonesia and Malaysia South America They've got huge amounts of debt in dollars And they'll be big capital outflow in a lot of those countries as people begin to flood in to buy the dollar because it's got a higher evil basically and It'll be interesting times Thursday the 17th September very very big day for the FOMC So looking at your dollar your dollars slowly actually had a great day yesterday More positive positive movement this morning if only just we're in the middle of two ranges now So one spot 1475 and one spot 11 on the side We are trading above both moving averages and we've got bullish crossover on the MACD So bullish momentum could still be in your dollar and we finish up there with GBP USD Again decent day bullish engulfing power and smash through 154 24 on the right side of the line Capped potentially but 21 period SMA with one spot 56 be the next potential Resistance we could maybe build a base around 154 24 bullish cross on the MACD and the slow stochastic So yeah cable looks quite interesting actually so with these date releases today at 1 30 and 3 o'clock GP USD and Euro dollar Will undoubtedly be in focus Because they've got the most potential momentum behind them But be wary of a sell-off towards the end of the sessions as some traders may choose to take some money off the table It's not obviously a guarantee obviously because we do have another round of date releases from China Early doors on Sunday morning UK time So as ever guys keep you behind the chart for Megan says probably going forward and join me again on Monday to find out What happened next?


A central Minnesota man is being held on one million dollar bond following the death of an infant in his care. Twenty-year-old Presley Slyster was charged in Cass County with second-degree murder without intent in the December 5th death of a three-month-old baby boy. Deputies were called to Slyster's staples home for an infant who had suffered a seizure and was not breathing. The child was taken to the Children's Hospital in Minneapolis where he died two days later. A medical examiner later determined the boy died of homicide from blunt force trauma to his head. Slyster told investigators he didn't know how the baby was hurt, but said it was possible the baby may have hit his head on a stairway or a door frame.


Speaking of the Lakers, they now go up 2-1 in the series over the Phoenix Suns. After that win last night, how much more action did you see come in on the Lakers to win the title or win the ease, or excuse me, the West? It's been early, obviously the game was over quite late. So I wouldn't say a huge amount, but you know, they're a minus 800 shot now to go on and win the series. I think we all know that, you know, that series looks like it's shot now. Chris Paul, obviously hurt. I have a little bit of concern about some of the Lakers, some of them looked like they were banged up. Obviously KCP came out, AD was hobbling around the court while still dominating, but that one looks done. So yeah, I think people are quick to jump back on the bandwagon of the Lakers and they're the best things to slice bread all of a sudden.


The next Republican Senator from California, Congressman Ed Schaou. I sometimes blurs our memory. Mr. President, I and every American want to thank you for lifting us up and giving us the chance to realize the dreams that we have for ourselves and for our children. Thank you. Ladies and gentlemen, you know this U.S. Senate campaign. It's with the deepest gratitude and profound respect that I present to you a truly great leader of America, a man who has given us the wisdom to honor the past, the courage to seize the present, the faith to create a better future for all, the President of the United States of America, the most honorable Ronald Wilson Reagan. Thank you all very much. Thank you. Thank you very much. Thank you all very much for a most heartwarming welcome. Thank you, Ed, for those very kind and generous words. I should say thank you, Senator Ed, if the people of California do what's right. Governor Duke Majin, Senator Wilson, all the distinguished guests here, our master of ceremonies. My Nancy and I can't tell you how good it's felt to be back in California and now to be here with so many truly dear friends. It's going to take a lot to get us on that plane headed back to Washington. I've always said that had the pilgrims landed on the West Coast rather than where they did, the capital of this nation would be in California. But I'm proud to be here tonight with a member of our own team who has taken on a special mission and that is to enlist the American people in a war against drugs. I don't want to sound like a doting husband, I am, but I'm mighty proud of the work that Nancy is doing. With us tonight are many of the real heroes of our Republican campaigns over the years. And I want to give special thanks to those of you who, through hard work, generosity, and grassroots organizing in communities and precincts throughout this state, have not only made a difference, you've changed history. Twenty years ago, when many of us started out together, we were challenging all the policies of the reigning liberal establishment. Yet we shared a vision of individual freedom, of building a creative society, and of unleashing the genius of the American spirit. And it was this dream that brought us together and carried us over the obstacles and through the rough times. We took that dream to Sacramento to put our ideas to work on a state government that was in trouble, big trouble. And that's when I learned an essential truth about political change in America. Alexis de Tocqueville, a young Frenchman who traveled throughout our country 150 years ago, described it even then. There is an amazing strength in the expression of the will of a people, he wrote. And when it declares itself, even the imagination of those who wish to contest it is overawed. I put that in a different way. You don't have to make them see the light, just make them feel the heat. And together, we've mobilized the people time and again. And with that support, we did what the so-called experts said couldn't be done. We put California state government back on a sound financial footing, reorganized the state bureaucracy using the experience and professional management techniques of successful executives from the private sector, many who are in this room here tonight. Fundamentally reformed the state welfare system and more than anything else, we returned government to the people. Now, I wanted to mention all this because despite the progress that we made in those years, it wasn't long before liberals in Sacramento took our state back to the bad old days. And that's why I want to take this opportunity to express my admiration for an individual who has again brought California back into the light. We both have performed the unpleasant task of cleaning up after a brown. Now, when I was in Sacramento, the man to whom I'm referring was a tough and diligent member of our team in the legislature. Later, he was a fine attorney general. And in these last four years, he's been one of the best governors this state has ever had, Governor George Smith. In the late 70s, liberal power in our nation reached a zenith. They controlled much of the state and local government, both houses of Congress, the presidency, and all the executive departments and agencies. As predicted, liberalism was about as good for America as Mrs. O'Leary's cow was for Chicago. Again, I turn to you and together we mobilize the people. In 1980, we set out to fundamentally change the direction of American government. The election was just the first hurdle. Together, we've been turning our dream of a strong vibrant opportunity filled America into reality. It's as fitting that as I head into the last major campaign of my political career, the last campaign in which I will have a personal stake that I'm here with you. In the November election, the voters will decide who controls the United States Senate. It's a make or break election. Their decision will determine if everything we've worked for, everything we've struggled and sweated for is to be given a chance or to be undermined by people who oppose everything we believe in. It all comes down to the Golden State. If we win this California Senate race, we will keep control of the United States Senate. Control of the Senate will mean two more years of moving forward or two years of stalemate and retrogression. I didn't come to Washington to be a six year president. I didn't seek reelection just to protect the gains of our first term. Together we can and will win the Senate and keep our country and our cause moving ahead. So here we are again getting ready to mobilize our strength and pull out all the stops to make certain that California has the representation of the United States Senate that it deserves. And that means replacing one of the last vestiges of the failed past with a forward-looking leader of the future. I just so no one will get the wrong idea with a birthday cake that looks like a bonfire every year. Let me just say it's not that California's senior senator is too old. It's that his ideas are too old. The days of the big taxer and the big spender are over. The days of something for nothing and left wing redistribution schemes are over. The days of blame America first are over. And the days when one of America's most strident liberal leftists can represent California are over. And this year when young people are looking to our party, our standard bearer for the United States Senate in California is an individual who exemplifies creativity, vision and action. An entrepreneur who is keenly aware of what is needed to keep America number one and leading the way. After teaching at Stanford and Harvard, Ed Schau decided to put theory into practice. In 1968, with only $2,500, he started, in his living room, a company which makes disks for computers. Ed Schau would have started his business in a garage only he didn't have a garage. His company, as is true of any successful business in a free enterprise environment, filled a need and did it well. And it went from zero to 800 employees. Now that's what I call a Republican job program. We were having dinner here tonight. I just told Ed about a comparison of that with the other kind of job training program. It was only a few years ago, just before I was president. When in a speech, I was telling the people how in less than a year's time, somewhere around six months, the government spent $252 million on a government job program, which finally succeeded in graduating a little over 5,000 workers. They could have sent them to Harvard for four years for less than that. We're talking about an individual who fully understands that American progress flows from the enterprise and hard work of people who are free to follow their dreams. High taxes, over-regulation and big bureaucracies are not the way to a better life for the American people. Ed Schau's opponent has spent a lifetime in government promoting those outdated and failed policies. Ed Schau, as a private citizen, fought to unleash American enterprise from government's ball and chain. In 1978, he personally fought to lower the capital gains tax from 49 to 28 percent. Having had some experience in cutting tax rates, I know how hard it is to convince those with the power to tax the wisdom of lowering the rates. Adam Smith, two centuries ago, noted that high taxes frequently afford a smaller revenue to government than what might be drawn from more moderate taxes. Some of these young people I mentioned earlier probably think Adam Smith told me that personally. He didn't. I heard it from someone else. Well, that cut in the capital gains tax coupled with our income tax rate reductions and other reforms early in our administration spurred America's economy and put us on the road to record-breaking growth and expansion. We've had 45 months of economic recovery. We've created more than 11 and a half million new jobs with the highest percentage of our people working on record. Total employment announced day before yesterday is 111,852,000 and at the same time as Ed told you inflation is at a 20-year low. You know, every time that the unemployment rates every month are mentioned and you read them in much of the press or hear them in the media, I hope they'll forgive me if I tell you something. Subtract one-tenth of one percent of everything they say. There are two unemployment figures. One is for only civilian employment and the other one is total employment and I think those people in uniform in our country are employed and it's always one-tenth of a percent lower if you count them in. I know figures can get boring but I have one other one. You know, when they give you the rate of whatever the unemployment is, I think we should know, you don't already, that the unemployment pool in the United States is officially declared to be everybody 16 years and up all the way to the limit, male and female. And today the highest percentage of that total pool is employed than ever in our history 61.2 percent of that total pool of people is employed. But I'm proud to be here tonight in support of a man who's been in the forefront of the battle to keep our economy growing and keep government off the backs of American business and out of the pockets of working people. As a matter of fact, in his job as a congressman today he does something that is very rare and unusual. You know that there is a fund that goes to each congressman to pay for staff and to pay for newsletters and all that sort of thing, the administrative overhead of the office. I've never heard of but one, maybe there are others, but one who turns back money and he this year turned back 16 percent of that allowance to the government because he said he didn't need it. Ed Shaw was barely sworn in as a congressman before he was named chairman of the Republican Task Force on high technology initiatives. Five high tech trade associations have named him the high tech leader in the United States Congress. The Chamber of Commerce has given him a 100 percent rating and the National Taxpayers Union named him, quote, the taxpayers best friend, unquote. Now all of this as compared to an opponent who is a world class champion at expanding government and centralizing power in Washington, a man with a 100 percent rating with the left wing ADA. California needs a senator who will focus his energy and creativity on pushing back the frontiers of knowledge and technology, creating new alternatives and new opportunity rather than maneuvering in the halls of power for bigger and more costly federal programs. It's up to us, all of us, to get out the word, to make certain the voters of California recognize the difference between these two candidates by election day and don't underestimate or rate your ability, talking to friends, neighbors, talking in the locker room, out at the club, talking to business associates. We learned once some years ago back in the motion picture industry that the greatest advertising the industry had was word of mouth, neighbor talking to neighbor and asking them if they'd seen the latest movie. Well, don't hesitate. Do all the things that you're doing, but then talk it up with everyone you can reach. We have to make certain that the voters of California recognize the difference between these two candidates by election day. Having been in the profession I was in for many years, I know the importance of being recognized. As a matter of fact, it was brought home to me one day in New York. I'd made 50 movies. I was then several years into a TV series and I was walking down Fifth Avenue, typical street crowded street and so forth and about 30 or 40 feet ahead of me, a man stopped coming my way and he pointed and he yelled and he said, I know you. I see you on the screen. I see you on the television all that time. I know you and he started stalking me and everybody like they will in New York just kind of went back and made a lane and stood there. I'm at one end and he's coming at me and he's reaching in his pocket for a pencil and paper. It turned out to be and all the way he was telling me how much he'd seen me and everything else and he wanted my autograph, Ray Milan. So I signed Ray Milan. There was no sense in disappointment, but we're not only working to build an economically sound and growing America, but a secure and safe country as well. And here too, the choice is clear and the difference distinct. Ed Schaue is up against a man who has spent much of his career trying to weaken America's military strength and encourage retreat from our foreign policy responsibilities. Ed's opponent is a man who voted against an amendment declaring an American policy to oppose Cuban expansion in this hemisphere, who said the presence of Soviet troops in Cuba is not a threat and who has blamed the arms race on the United States. We're up against a man who has fought us every step of the way in our effort to rebuild America's defenses. You'd have to search long and hard to find a senator who has opposed us as often in our attempts to do what is necessary to protect our national security and meet America's international obligations. We're succeeding despite him, but you could do America a big favor by replacing him with Ed Schaue. We are just now finally overcoming many of the problems we inherited from the irresponsible days of the last decade. When we got to Washington, we faced the challenge of saving an America from an economy racked by double-digit inflation, sky-high interest rates, and business decline. You might say our economy had been cransonized. We've come a long way. We turned decline into vigorous growth, despair into optimism and national uncertainty into what even our critics acknowledges a rebirth of the American spirit. But the job is not finished. Today, we're offering America the leadership it needs to propel us into the 21st century. The next 10 to 15 years may well be the most exciting and challenging in the history of our nation. As President Eisenhower once pointed out, the future will belong not to the faint-hearted but to those who believe in it and prepare for it. And that's what we're doing this evening. Being here, I can't help but think of the dinner that we attended at this hotel shortly before the primary began in earnest. And I reminded all of the candidates that after the primary battle, the party must again be united and focused on our common goals. Yes, we've got our differences. It's hard to recall now, but about this time in 1982, Pete Wilson's campaign was just getting underway. And there were some in the party who expressed misgivings and had some doubts. But now, needless to say, we know Pete Wilson has been doing one magnificent job in the United States Senate. And I know he's one of my strongest supporters. Now, all this suggests that any differences between us are trivial compared to our differences with the opposition and compared to what is at stake. We have a choice to vote for a candidate of the past who wants to turn the clock back or a candidate of the future who wants to complete our revolution. Some people might think having a Democrat senator and a Republican senator is part of our system of checks and balances. It is no such thing. If you like what Pete Wilson is doing for California, does it make sense to send a senator back to Washington who'll cancel Pete's vote every chance he gets? When we took off as Democrats that controlled both houses of Congress for more than a quarter of a century, now for five and a half years we've had control of the house, or of one house, I should say. No, we don't have the house. We have a one house, the U.S. Senate. We couldn't have accomplished what we have without that majority in the Senate. There was no way it could have been done. Ed Shaw will be a senator you can all be proud of. The election of Ed Shaw and control of the United States Senate is absolutely critical to the future of this country. If there was ever time for a maximum effort, that time is now. This election is special for us, for you, for me, and for America. And I'm asking to just win one more for the Gipper. Ladies and gentlemen, Mr. President, after what you've said, there's only one finale, and we have a beautiful lady and a beautiful voice to lead us in it. God bless America, Ms. Vicki Carr. You know, patriotism is what these past six years under President Reagan has been about. In another era when patriotism was required, a great American singer Kate Smith helped rally this country with her voice and her song. Please remain standing and join me in singing that song, America the Beautiful. God bless America. God bless America. God bless you all. Thank you. Good night.


good morning everybody. How are we feeling? Good? Yeah. Nice. Nice.  So a quick programming note. We know, we absolutely heard about all the problems in the hallways yesterday and you notice we made a couple small changes yesterday that I think seem to improve some things. We made another kind of substantial change today. So what we did was Defcon 101 that has moved to Bali's gold. So over at the other part of the hotel. Track 4 moved to where 101 was and then if we do need to corral all of you fine folks, we will probably be doing it in the area where track 4 used to be. Make sense? Cool? So hopefully that will make the congestion problems a lot better today. But that said, hey, keep cooperating. You guys were great yesterday especially for some of the big talks like the Tesla talk and I'm sure we're going to have some talks that are just jammed in here. So keep playing along and we'll all have a good time. Right? But hey, let's talk about Mac. How many people in here are up Macintoshes? It's nice hardware. It's nice hardware. And depending on who you ask, some people may have a nice sense of oh, I'm so safe because I have a Macintosh. That kind of thing. Well, we're going to learn once again why that kind of idea is false. And we're also going to reinforce the rule of and say this one with me, physical access is total access. No? All right. It's early still I guess. All right. Let's give our guys a big hand. So good morning. As Argyon alluded to, we're going to be talking about MacBook physical security, but also some software security. So I'm Tremel Hudson and I really like to take things apart. I've been doing a lot of work in reverse engineering, things like the camera firmware for Canon SLRs. I've produced a GPL runtime to let folks write their own programs to run on it. I also really enjoy digging through old ROMs, looking for Easter eggs such as the Apple team that built the Mac SE that they hid in their ROMs back in the 1980s. And this project got to start a couple years ago when my employer, Two Sigma Investments, a high tech hedge fund in New York City, wanted to deploy MacBooks. And there had been some reports about root kits and I was asked to use my reverse engineering skills to look into if it's possible to defend against them. Because we have a lot of concern about security both physical and software. Hi, and I'm Zino Kovac, Corey Kellenberg couldn't be with us this year at the cons. But this past January, Corey and I started Legwood Core and we're basically the only company that's focused specifically on PC firmware security. So firmware for X86 PCs, Macs, and then all the peripherals as well, all the hard drive firmware, NIC card firmware, GPU firmware, all that other stuff that people talk about at conferences, but nobody ever seems to get around to actually checking. That's what we do. So this talking sort of got its start last year at CCC in Hamburg. I presented Thunderstrike, which I suppose we can now call Thunderstrike 1, which was the first firmware root kit for MacBooks that we learned how to, what protections Apple had on their firmware and how we could generate files to write into the ROM. The day before my talk, Rafale and Corey presented some really amazing attacks on UEFI security, including one called Darth Phenomus that I found very interesting and really wanted to see if it was possible to port it to the Mac. So we teamed up and what we found is that yes, it is possible to port vulnerabilities from Windows systems to Macintosh and other systems. And that's the key message of this talk is that these most EFI vulnerabilities, many EFI vulnerabilities are OS independent. They're in a lot of cases hardware agnostic and that vendors and everyone needs to be aware of that. So that's enough talk. Let's jump straight to the demo. So Thunderstrike 2 is an improvement over the original Thunderstrike in that now physical access is no longer required to initiate the infection. It's possible to, with a remote code execution that can then use whatever root exploited the day to escalate to root. Once root, it can install the white listed direct hardware kernel extension, which allows it to map all of the physical memory, including the memory mapped SPI flash registers. On some machines, on some Mac books it's able to immediately unlock the flash and start writing into it. And this is using the information again from the Thunderstrike 1 talk about how are the firmware volumes organized? How are they integrity checked? So in this case we've added a, we've appended a payload into the free space and we've updated the CRC. While we are scanning memory, we also go ahead and walk the PCIe bus looking for devices with option ROMs. And we're able to write the payload into those as well. In this case, much like Thunderstrike 1, we're using the Gigabit Ethernet adapter as a payload transmission vector. So the option ROM now contains the payload and the Mac book also has written the payload to the motherboard boot flash. When we reboot the machine, we will see the Thunderstrike logo come up. We are deliberately not trying to be stealthy with the proof of concept. So there's our awesome ASCII art logo hidden in the boot ROM. And this is controlling the system from the very first instruction that it executes. The viral transmission means that we can put that laptop aside and share the adapter with another one, which is pretty common in a lot of corporate environments. So now the EFI firmware loads the exploit from the option ROM. And it's not able, in this Mac book, it's not able to unlock the flash immediately. But what it can do is use the Darth Phenomys attack that was presented at TCCC by Cori and Rafal to hook the S3 resume boot script. So then when the kernel boots normally, and then at some point later, the system goes to sleep either via software or just the user closes it. And the vulnerability is that when the CPU enters the low power state, all of the flash protection bits get reset. So when the system wakes back up, the S3 script, which is executed on resume that we have injected code into, writes thunderstrike into the motherboard boot ROM. And this is not in, this is not on the hard drive. So you reinstall OS 10 and it doesn't fix it. You swap out the hard drive, it doesn't fix it. And possibly when you swap to a new computer, you could re-infect through the peripherals that you retain. So at this point, as I mentioned, we're not stealthy. So when the system reboots, we'll see the logo. A weaponized version could use SMM or virtualization, similar to the blue pill attack from a few years ago, to really do a good job of hiding from attempts to detect it. So this laptop's now infected. And the other part of the infection that's new is that it's watching for clean Thunderbolt adapters to be plugged in. And then it writes the exploit into those adapters so that they can then continue to spread to other machines, possibly crossing air gap security printers. So what we've demonstrated with this proof of concept is a somewhat unique life cycle for a firmware worm that starts with a software exploit, is able to write itself into the boot flash on the motherboard. They can then infect Thunderbolt and other removal option ROMs, which are able to hook the S3 Resume script and then write themselves into the boot flash of other machines and continue the infection. Right? So that's the black magic attack here, but now let's get into understanding how it works, right? So the key point, again, is that firmware vulnerability is found across many systems. When we disclose things in the past, they would affect many different PCs. And here we're showing the effect max as well. A little quick background on the transition of firmware on modern systems, right? So you'll hear about, you'll hear us often use the term BIOS interchangeably with EFI or UEFI. When we say BIOS, we just mean generically firmware. But firmware for X86 PC is typically. So Intel started the EFI extensible firmware interface project back in the late 90s to replace BIOS. So they were trying to create a non-backwards compatible IA64 architecture. They said we want to get rid of all this legacy croft you don't want to keep working on this, you know, thing from the 80s. And so they said, okay, for our new architecture, we're going to have a new modular, well-designed version of the firmware. So they did that. They did that on their itanium systems. And then when Apple first moved from PowerPC chips over to Intel chips back in the early 2000s, they said, okay, we'll go ahead and use this new type of firmware that Intel recommends. That was the Intel EFI one point, you know, whatever version. So in 2005, Intel was trying to bring more people in the fold, get wider industry adoption. So they created the UEFI forum as a sort of industry consortium to collect up many more players, get all of their buy-in, get all of their contributions, and get them to actually start using this. So the original EFI one point one was deprecated and now everybody was talking about UEFI and the EDK development kit, the EFI development kit. So of course, when they got more industry buy-in, they didn't just go ahead and rewrite everything from scratch, right? It just meant they continued to evolve with more people's input. So Apple forked it back at the one point one and you would expect Apple's implementation to generally diverge from the rest of the world and the rest of the UEFI implementations. But still, there's of course going to be millions of lines of code that are similar from the old stuff and the new stuff. The way that the whole UEFI ecosystem typically works is that there's a single open source reference implementation. That's the EDK 2, the EFI developers kit 2. Single reference implementation which is then modified by the independent BIOS vendors like AMI, Phoenix and Inside. They go ahead and add value to the systems, right? They have to compete amongst each other in order to say what new features they've added that the other guys haven't added and that's how they're going to get OEMs to buy theirs. And then the OEMs buy and maybe manipulate if they've got enough BIOS engineers themselves. The OEMs will do further customizations on this and then that's what we ultimately see. But because of this hierarchical nature, you know, that means fixes that happen, the open source reference implementation take a long time to trickle down, right? Months and potentially years. So a big point of this talk is to be, look, no one's a unique and beautiful snowflake. Everybody looks the same. So we took a, you know, ASUS machine that we did with our CanSec West talk, we did an analysis we showed, you know, here's all of these places where an attacker could hook all of, all of the systems that are out there today. And we took that, we analyzed it and so its control flow graph picture is a little bigger because it's got comments in it. But then you take a ASUS desktop and you take a MacBook Air, Ultrabook if you will. And the thing is they look all the same, right? Their control flow graphs look the same. They call the same functions in the same order. There has to be some level of similarity in order for EFI or UEFI systems to implement that extensible firmware interface, right? There's a spec out there that says how the firmware interface works and to conform to that you have to look the same. So, you know, call the same functions in the same order, have the same assembly in the same order. No one's system firmware if their EFI derived is unique and beautiful snowflake. So that means that there's going to be shared vulnerabilities, all of the stuff that we've been disclosing over the past couple of years for PCs, you know, does it affect Macs? Well, spoiler alert, yes. Right? So, this means that there's all these vulnerabilities which are out there and a lot of vendors don't necessarily pull in the code and the fixes from upstream and they don't necessarily they hear, oh there's this PC attack, maybe it doesn't affect me, right? I'm a Mac. So, beyond this there's problems such as Intel has recommendations about protection mechanisms that vendors should use and not all the vendors use those. Beyond that there's still these decades of legacy decisions and things like option ROMs which we'll talk about later which lead to sort of inherent built-in vulnerabilities.  And so all of these should be old news at this point, right? These are all things which were responsibly disclosed over the last couple of years, publicly disclosed at conferences and yet when we came along and we said, let's take a look at the Mac, are they still there? Yes they are, right? That's not cool. So the first thing to think about is the speed racer vulnerability. This is actually vulnerability in Intel hardware. So this is not the kind of thing which we would expect any given vendor to say I'm not vulnerable to because if you're running chips the core vulnerability is in Intel hardware and the core fix is to use some Intel protection bits. But speed racer is going to be a race condition, a hardware race condition and that will see, you know, why exactly that happens. So if you look at the BIOS control register on Intel hardware, this is sort of the oldest protection mechanism for the firmware. It says, okay, am I allowed to write to the BIOS? There's a BIOS write enable bit that must be set before you're allowed to write to the BIOS. Now, if a vendor wants to stop any malicious OS attacker from writing into the BIOS, they need to set the BIOS lock enable bit. BIOS lock enable bit says, if someone sets the BIOS write enable bit, I want to cause a system management interrupt. I want this code that I've put into SMM, system management mode. I want to catch anyone trying to set the BIOS write enable and I want to probably stop them from writing into the BIOS. So that's the oldest most common functionality. But what the speed racer vulnerability disclosed is there's this hardware race condition where once we have multi-threaded hardware, right, so back in the day, that was just single threaded hardware, single core hardware and so that protection mechanism worked great. Once you have multi-threaded, multi-core hyper-threaded type hardware, you can have an attacker who just continuously hammers on the write enable bit. They say set it writeable, set it writeable, set it writeable. And then in a separate thread, in a separate core, they continuously say write this value to the BIOS, write this value to the BIOS, write this value to the BIOS. And so the core race condition is those two threads continuously are just hammering on trying to write to the BIOS and eventually we found that they're always able to succeed. This is the kind of race condition which an attacker likes, right? There's no penalty for failure and beyond that you just keep doing it long enough and you're always guaranteed to win. So Corey talked about this back at CCC in December 2014. This was disclosed privately to Intel and CERT in May of 2014 and so this has been out there for quite a while. So Intel's sort of response to this was okay, well we recognize that that could potentially be a problem but we had already added this new protection bit back in 2004 to our newer platform controller hubs and this new bit says even if the BIOS write enable is equal to one somehow, I still want to stop an attacker from writing into the BIOS unless they've broken their way into system management mode. So this bit says you must be in SMM before I allow you to write to the BIOS. So that requires an extra exploit, an extra bit of effort on behalf of the attacker. They can't just race from kernel space and set and write to the BIOS. So this is basically the way that Intel says it should be. This is the way Intel recommends that BIOS vendors actually set their protection bits. So you've got layers of protection each of which provides some architectural value. So BIOS lock enable says system management mode they get to man the middle every attempt to write to the BIOS and that will be stopped and checked. Well that's the problem with that is speed racer bypasses that. But if a vendor sets SMM BWP then that will also say you must currently be in SMM before I'm going to let you write to the BIOS. And beyond that there's further protection mechanism called protected range registers. And these allow the BIOS maker to set non-contiguous slaces of the firmware as non-writeable. And typically a firmware maker would set the code as non-writeable even from SMM. They basically say lock it down and this is the kind of thing where it would be locked down and you want that to be stopping an attacker in SMM from writing into the flash chip. So when we go back and we said okay let's consider this let's see whether or not this is Apple's vulnerable. First thing is we check the cert vulnerability disclosures. So the nice thing, the really nice thing that we like about cert vulnerability disclosures, the reason why we used cert for our coordination even when we were at MITRE and even when you know we had CVs available to us is that CV just tells you these vendors are vulnerable and they've you know set their vulnerable. The cert ones are nice because cert handles the coordination for you and then they go around and ask the different vendors are you vulnerable and they get back responses. So there's going to be some vendors that say they're vulnerable and then usually they'll be a fix to their a link to their fix on the cert disclosure.  If they don't even care enough about firmware security to respond to vulnerability disclosures they're probably going to be vulnerable. So we looked at Apple. Apple said it's not affected. Okay well this is a fundamental hardware race condition. All the Intel CPUs have this so that bears investigation. And like I said you know if vendors don't actually respond to these and if you don't hold them accountable if you don't say hey I saw this talk about whatever are you actually vulnerable they just aren't even going to say anything. So we need to check Apple. We need to say is Apple vulnerable to this problem?  The BIOS control register is set to 8. I won't make you do the bit math in your head for that. But the basic result is BIOS lock enabled not set. SMMBWP not set. Right so they're basically not using those first two layers of protections. So in a very technically accurate you know pedantic sense of the word Apple is not vulnerable to speed racer because you don't need to use an exploit to get around protections that just aren't there. So this is what protection looks like on a new Mac system. I bought I went out bought the absolute newest Mac mini and this is the protections I saw. So you see they're not even using the first two protection mechanisms so that means they've got a single point of failure. Right and beyond that there are gaps. There are gaps in this region. The first gap points at the EFI variables. If you use the command line tool NVRAM you can twiddle NV variable bits. But even some variables are prevented from being accessed by NVRAM. But if an attacker knows how to write to the flash chip they can just bypass whatever Apple's API is to writing to the variables. Write directly to the flash chip and modify any variables that they want. Beyond that there's an additional sort of gap in this protection which we don't even know what that does. But as you know testing this sort of attack we go ahead and we say all right corrupt that. Write all X's into that and let's see what happens. Well what happens is the system is bricked it will never ever boot again. Right and that's undesirable behavior. So there's a video for that online which you can watch but it's kind of hard to show a cool demo video. Look the system does not boot it's just a picture of the system. So we decided to skip that and you can watch that video online if you'd like. So second thing we need to look at. Darthonomus vulnerability. Got a goon crawling up here. I don't know what he's doing but okay. So Darthonomus vulnerability right. So we saw that the protection mechanism still have the protected range registers. Attacker would like to get around that modify the code and stuff. And so that's exactly what the Darthonomus vulnerability allows an attacker to do. Sometimes called the dark Jedi attack. This was named by Rafaal Wojcik because basically Darth Plagueis defeated Darthonomus, killed him, put him into this and then continued to resurrect him and then kill him and resurrect him and kill him and resurrect him. I'm not you know I don't know the exact story and consequently it's been said that this is just like you know putting maybe he didn't kill him he put him into coma that sort of thing but the analogy here is that we want to continuously kill and resurrect the system and use it to study the system find vulnerabilities for science. So the Darthonomus vulnerability is the situation that when you put your system to sleep just normal sleep not a hibernate not a what does apple call it deep sleep. If you just put the system to sleep close the lid. You're going into what's called ACPI S3 sleep this is a low power mode where the hardware tries to power off as much of the motherboard as it can. Well some of the stuff that it powers off is parts of the chipset which allow these protected bits to become unset right you're going into low power you lose all of your you lose all of your electricity and the bits get unset right and so this can be manipulated by an attacker. So this vulnerability was disclosed to CERT and the newly formed UEFI security response team back in September of 2014 and then this was publicly disclosed in December of 2014 as Trammel said day before his talk and you know wanted to find out whether this applies to apple. So very very quick you know I recommend you go watch the actual talk if you want to know the details but at the highest level the details of Darthonomus or this. A normal system when it's booting is going to take that top path there. The normal boot path you're going to execute each of your UEFI or UEFI phases. As the systems booting it's going to save information about which hardware configuration bits it set to this little cheat sheet this is boot script this S3 boot script which is going to be stored in RAM somewhere. Well unfortunately it's stored in unprotected RAM that's the core of the vulnerability but when you go into sleep and you wake back up the resume execution path is going to say instead of executing all of my normal boot code which would make my resume from sleep as slow as a normal boot. I just want to consult the cheat sheet and it will say you know it has these type of operations you can write to IO you can write to memory and so you basically just go down the line and interpret this boot script and that will make it so that the hardware will be reconfigured the same way it would be with a full boot but much much faster right that's why you have the nice quick wake from sleep. But there's a core problem with this boot script core vulnerability the vulnerabilities are two fold one the script gets stored in nonprotected RAM and why does it get stored nonprotected RAM well because you look at the spec document from 2004 and you can see right there they're recommending storing it into this ACPI nonvolatile memory well the thing is that memory is just memory like any other memory an attacker can manipulate it compromise it.  So a script that has jumps to arbitrary code plus an unprotected script somewhere in RAM means that attacker can compromise the script get rid of the protected range registers and have access to everything you know get access to the code modify the code so that right from the very beginning all of the code is compromised by the attacker. So that's the net result of the Darth Phenomus attack. So when we go back and we say you know did Apple say they were vulnerable or not vulnerable look at the cert disclosure this case this particular disclosure unlike all of our past ones was a little weird in that we saw cert had been listing only the affected vendors only those vendors that replied and said they were affected so at first we didn't know you know did Apple say they were not vulnerable did cert not actually contact them but by running it to ground we found out that cert hadn't actually contacted them and told them about it. Well that's fine but it was still also coordinated through the newly formed UEFI security response team and since Apple is a UEFI board member you would expect them to listen to the UEFI security response team right. So again the big finding from Darth Phenomus is the fact that previously Trammel's attack was the first thing that showed and proved that you could write Apple firmware there had been you know snares earlier 2012 attack there had been some thought that maybe Apple firmware was somehow protected by extra hardware something like that. Trammel showed no that's not the case you just need to know how to fix up CRCs and things like that and once you do that you can write to it but again Thunderstrike 1 required physical access with the Thunderstrike the Thunderbolt device itself. So Darth Phenomus says you know no more physical access is required anyone who can get remote access to the system can manipulate that script in memory and then make it so that when you go to sleep and wake it back up you can compromise it. Now sorry that this is so small that no one who didn't sit right up next to the projectors is going to be able to see that but the basic this is showing you know just a plain Jane software attack version of this. So once you've used a root privilege exploit you can look and inspect the system right. Inspect the system it does have protected range registers they are protecting the code but then you find the boot script in memory you find one of these dispatch op codes and you point it at some other address where you're going to put code. So point it at a different address insert code into that address and so the specific code we did here was to set a lock early so basically the boot script is going down down down and it's interpreting stuff. The protected range registers get set somewhere lower in the boot script somewhere higher there's going to be this dispatch op code and so all we do is we just lock down the registers and say no one is allowed to modify these protected range registers in so doing they get locked into a default zero value that they had when they got cleared because you lost power. Right so when we do that then you set it to sleep then you wake it back up there you go after wake now the protected range registers all zero locked in can't be changed until the next you know sleep resume cycle. So after that right we've just taken out protected range registers Apple doesn't use bios lock enable or SMMBWP that means you know go to win the attacker can write anything into the firmware here we just showed writing hello world into the firmware some place we knew wouldn't actually brick the system. So another vulnerability very similar to this that you may have heard of a couple months ago is called Prince Harming. So we'd actually seen this vulnerability in the past in other vendors called it Snorlax and told CERT about it back in 2013. Unfortunately the vendors fixed it before we told CERT you know you can make this live now it's been you know fixed and then CERT said well it's been fixed we don't need coordinate this anymore. So they kind of wouldn't post our thing for a long time until Pedro Velaca came along this past May and he found the exact same sort of vulnerability on apples. Right so Pedro came found the same vulnerability we said dear CERT you can you can start coordinating this now it's open zero day again. So Pedro didn't give it a name but you know he didn't want to go the hype route but Katie Mo suggested Prince Harming because this poisoned kiss wakes you from sleep so we're going to go with that. So his blog post said basically he had seen literally he had seen the title for this talk he saw Thunder Strike 2 Scythe Strike right and he correctly caught you know the implication of that Scythe Strike probably has something to do with Darth Venomous right we're probably saying Thunder Strike, Max Stuff, Darth Venomous, Scythe, Darth Venomous right. So he said he had been looking into the Darth Venomous attack on Max and he had been you know using some other proof of concept code that was put out there by another researcher to look into it. When he looked into it what he found was this Prince Harming vulnerability which at the end of the day was actually a little more severe than Darth Venomous because you didn't have to do anything special as an attacker you just put the system to sleep you woke it back up and everything was unprotected they were just not even setting any of the protection bits that matter on resume. So this you know he was a little concerned about this as a Mac user I was a little concerned about that as a Mac user it leaves something to be desired when an attacker can just sleep your machine wake it back up and right into your firmware that's not good right. So we had not actually reported the Prince Harming vulnerability to Apple why not because we were testing on our MacBook Pro 11 2's which turned out to not actually have the vulnerability so Darth Venomous Prince Harming was actually fixed at some point. His 10-1 had it our 11-2 didn't have it so Apple basically silently fixed this at some point and they didn't back port it to older machines. So consequently what that meant was accidentally this blog post went live he thought that we had told Apple about it he thought that Apple would already know about it because of disclosure of Darth Venomous but no Apple didn't know about it so oops Apple zero day now anyone can break into the firmware right the core question is why are there zero days just laying around to be found like this on Apple that doesn't make me happy as a Mac user sure that doesn't make you happy. So now that there was a full disclosure vulnerability out there in the wild right Apple turned around a patch relatively quickly. So basically they put out this EFI security update 2015-01 it affected they patched 24 different models and the models which they patched were basically everything from 2011 and newer so if you have a system from 2011 or newer right hopefully you're just applying Apple's updates as you go. But how did they actually fix this right? So they fixed this with improved locking and so the question is you know what is that exactly mean? So I was very curious you know what is this improved locking so I did a binary diff and dug into their update and what I found is that they've moved the protected range register and flash lock down configuration register setting out of the boot script and they lock it in PEI before they begin executing it and this is this is the right place to do it because you don't want the protected range register to ever unset. So this does prevent the demo that we showed from being able to write directly to the boot flash. However they're still not using the BIOS control bits so it's still possible to break the system. The S3 boot script is still unprotected so you can do all kinds of interesting stuff in PEI long before lots of other protection is enabled. There's also some obscure features like TSAG MB that were discussed in the original Darth Phenomus attack that are left unlocked which means that it's possible to DMA into SM RAM which can then get code execution in system management mode. And something that I find very worrying is that the brand new MacBook the USB-C only one is protecting the boot script in some way. So this means that there are now two classes of machines some which are vulnerable to Darth Phenomus and some which are not. So the fourth vulnerability that we take advantage of is a really legacy feature of option ROMs. And this goes back to the original IBM PC with the 8080. The BIOS's in that era were typically socketed ROM chips and there's also empty sockets on the motherboard for optional expansion features. This is where you can put your basic interpreter or your hard drive controller. The ISA expansion bus also allowed cards to contain option ROMs. So this allows you to drop a new video card into your system and have the BIOS be able to display onto it. Unfortunately because this gives you code execution early in the boot process it's a great place to put malicious code. And this is not a new idea. John Heisman presented it at Black Hat in 2007 with a modified PCI at that time PCI card. And in 2012 Snarer gave a amazing talk at Black Hat showing how to build EFI root kits that ran out of the Thunderbolt Ethernet option ROMs. And his talk is what actually started my research into MacBook security. Intel realized that this was a problem for any sort of trustworthy boot. So as part of secure boot they required that all expansion card ROMs be signed, cryptographically signed with a key stored, with a public key stored in the boot flash on the motherboard. And they required this for secure boot in UEFI 2.3. As we've mentioned Apple has sort of frozen on EFI 1.10 which doesn't support the secure boot concepts. And they still unconditionally load and execute option ROMs from both internal and external devices like the Thunderbolt. This is despite Heisman's talk in 2007 this despite Snarer's demo in 2012 and despite my Thunderstrike demo in 2014. And what it really needs is an architectural fix. Either security conscious users need to be able to disable loading of option ROMs or whitelist hashes of option ROMs or signatures on option ROMs. There are quite a few steps that could be done here. In the Thunderstrike talk I hypothesized that the option ROMs can also be used to spread malware by early. And this is an improvement over John Heisman's talk that had the option ROMs on PCIe cards fixed in systems. But now with Thunderbolt devices can be shared between machines. At the time of my talk it was mostly a hypothetical because to rewrite the option ROMs required booting to DOS and plugging in the adapter. But what we've realized is that the Linux kernel Broadcom 57 device driver had all of the hooks for writing and writing the option ROMs. So we were able to port that over to OS 10. And now it's possible to install new option ROMs into these removable devices with just root access. We also ported it to run in the in the DXE environment so that it's possible for Thunderstrike to rewrite from the option from the boot ROM. So the way that this could be used maliciously is that you get a remote shell somehow. Use whatever exploit of the week. You install this whitelist to driver and then you're able to flash code into the Thunderbolt device. And we use the Thunderbolt device because they're very easy and very small and cheap. But lots of other devices have option ROMs. A lot of Wi-Fi cards do. A lot of GPUs do. A lot of SATA controllers built into SSDs have them as well. So again back to the main point of the talk. UEFI vulnerabilities shared across many systems. It's highly likely that any given vulnerability that's found is going to report to everywhere. So ultimately in this work we considered six vulnerabilities that were all old, all publicly disclosed, all privately disclosed. We said, you know, which of these affect the max, right? So there was Prince Harming which was patched in the June 2013, June 2015 patched by Apple. Completely gone now. That's not an issue. As we said, Darth Phenomus is only partially patched. You can still use it to break into SMM which is not good. Got Speed Racer which, you know, we're still vulnerable because Apple doesn't use SMM BWP so we don't have to get around that vulnerability. But then the really interesting thing is Queen's Gambit. So Queen's Gambit we presented here one year ago at DEF CON. Corey just won a pony for it the other day because it affected hundreds of models of PCs. But a vulnerability that had been disclosed privately one and a half years ago. Publicly one year ago is still actually affecting Apple systems. They're not patched yet. Apple is working on a patch for them. But so although they patched the basic thing that would allow our current proof of concept Thunderstrike 2, this vulnerability could do exactly the same thing. So that's still out there and open. And then the Sicilian is a much lesser known vulnerability. This just had to do with us trying to make a point that previously invisible things labs had said if you break into BIOS, if you break into SMM that does not imply you can break into BIOS but if you break into BIOS you can always break into SMM. We wanted to show that you can break into BIOS from SMM on some systems just by way of saying this is a possibility. The sixth thing that we considered was the set up vulnerabilities that are very common amongst UEFI systems. The set up variable will have configuration bits which will affect secure boot. Well again Apple doesn't have secure boot so even if they had this variable it wouldn't matter. But the set up vulnerability can be used to bypass secure boot on a lot of PCs and if you just corrupt the variable you can break the system. This vulnerability though does not affect Apple's whatsoever because they don't use this variable, they don't have an equivalent sort of variable. So five out of six old public vulnerabilities all affected Apple systems right? That's not what we wanted to find but that's what we found. So what can vendors do right? We always go around and we help vendors understand you know Intel's recommendations should really be thought of as requirements. They're not really recommendations. There's a reason why Intel said that you should set all of these protection bits. You don't want to have a single point of failure when you're only using one of them right? So obviously vendors have to test all of these old vulnerabilities against their systems. All of those vendors on you know go look at the cert disclosures see whether you're currently running a machine that your vendor doesn't even respond to vulnerability disclosures right? They're probably vulnerable. Obviously setting all the protection bits. Chipsack is Intel's tool that they had been privately disclosed they had been privately passing around to bios makers in order to have them fix vulnerabilities before they ship right? And then they eventually made it public for researchers to play around with right? If you run Chipsack on an Apple system well it doesn't support Mac unfortunately so you have to either run it from EFI or install Windows but if you run it Chipsack would say this system is vulnerable right? If Apple were using Chipsack they would understand the system is vulnerable. And then there's other things like the SMM lock box which can protect make it so that the S3 resume script is not just sitting around in RAM where anyone can manipulate it you lock it back in system management mode where an attacker would have to have an extra exploit to break into SMM before they could manipulate it right? That's not a panacea though because even at the original Darth Phenomus attack they showed that you know some Intel systems were using SMM lock box but just because you hide your stuff away in RAM if it still jumps out and reads from other unprotected memory well that's a bug as well right? Intel boot guard is a great technology that allows a system to actually have a much stronger root of trust so that instead of the very first instruction coming from your potentially manipulatable firmware instead it comes from signed code where literally the CPU verifies the digital signature on that code so that's a much stronger upfront guarantees and then of course option ROMs there's many things that need to happen for improving option ROM security. Digital signatures are a good first step but that's not an end step and certainly it would be nice to have the ability that if you're security conscious you're setting a firmware password something like that maybe you wouldn't like all of these untrusted unsigned code to just be sucked in and executed in the BIOS. Alright for all of you who are not BIOS engineers who don't spend your day making BIOS's all the time what can you do? Well you have to start doing firmware forensics right? It's not just about hard drives anymore it's not just about RAM memory forensics right? You have to do firmware forensics and as I said people have been running around giving these sort of talks for years now but no one ever seemed to do anything about it no one ever seemed to actually you know provide ability to check the firmware and so that's sort of why we started like before but in order to not leave you empty handed here we put out an option ROM checker right? So you go you take you plug in your Thunderbolt Ethernet adapter into your machine plug it into your machine and then run the script that we provided it will dump out the option ROM using the stuff that's been ported over from Linux dump the option ROM and then integrity check it because it turns out everybody's option ROMs that we've seen they all look the same and they're very easy to integrity check and so this gives you a first order you know is there some manipulation of my option ROMs. So we've only checked it on our own and you know a few devices beyond that so if you go check yours and it says there's an error either A our tools are broken highly highly possible or B you actually have some attacks so in either case whether it's a false positive or true positive we'd like to hear about it. The other thing you can do I always have to put my plug in here the other thing you could do is go get smart on firmware right go learn x86 assembly go learn about root kits go to open security training take some free classes get smart on things and then go off and do your own firmware security research. Alright thanks so much for attending our talk this early Saturday morning.


The only thing that I see today to even look at our watch is UAL which is down okay, and it's on guidance so that's that and What I realized this morning is I should have realized this yesterday, but Everything this week is going to be off. So This is like not going to be a normal week when you look at the charts about how things are acting because of what happened with the bank collapse and now Everything that's happening going into next week NVIDIA So we had bad data this morning But the market is up because the market thinks the Fed is not going to raise rates with bad data and what happened last week I'm in the camp that they will raise rates. Maybe the only raise them a quarter instead of a half Yeah, we can watch NVIDIA If the market goes this will go if the market fails Nothing's gonna go So that's the bugaboo and that's what I'm that's what I'm just trying to say Nothing this week is gonna work right that you think it's going to if that makes any sense. I Mean some of these charts It's just I don't want to get into it now, but let's just focus on this Let's do 25 by 95 crap. There it is 25 by 95. Don't just do it. Don't even worry about where you got filled We'll here be in it Here it's going 46 46 50 46 25 46. Oh I got it. I think too hard That let's put it at 95. I'm just seeing the spread here 95 UAL But if you did it, you're ready in it. It's already going. We'll see where we go 46 50 is not a bad number and again Fast rates fast rates fast rates fast rates fast rates fast rates like that's our mantra Every day now more than ever more than ever 63 here we go here. Nice call. Here we go UAL. Hope you all did it here See we get under 40 Yay, there it goes 35 did anybody get out? It's just moving so fast Let's see we can get one more push in this, but she could be out. It's moving really fast We can't mess around with this too much longer. Here we go. Here we go See we can break 25 on Bootsie Whoo, there we go you there out done boom good enough Wow nice good start to the week here here. We are great here If you're still in it 45 80. Whoa whoo Let's look at the market. Wow 78. There you go Okay, that's a good gyros nabidia not ready yet Okay, well that worked out well