Today, I have the pleasure of doing what I think is one of the most exciting interviews we've ever done on investor intel, which is to congratulate energy fuels and neopreformance on basically altering the landscape for a rare earth supply chain with your announcement today. So how about we start with Constantine, what does this news release actually mean? Well, it's apart from the fact that it is an exciting release. I think it says two things. First, this is again the reestablishment in a very long time of a supply chain that starts in the United States and joins with Europe to produce rare earths and value added material. On the other hand, I think specifically for the two companies, I think it's a confirmation that both energy fuels and neo, so we do what we said we were going to do. I mean, for us, it's not terribly exciting because there was never any doubt in my mind or I believe Mark's mind, but there's an awful lot of talk and talk and talk in the industry. And here we go. There's commercial quantities of rare earths mined in the United States, processed in Utah, and then shipped to Estonia for further processing. I think it's an exciting time and it's a great development for both energy fuels and neo. So for all of you out there in investor intel land, you may be new to the rare earth industry. What we have is basically energy fuels and neo performance announced a contract signing today and the launch of commercial shipments of rare earth products to Europe. So Mark, on that note, it was just a short while ago when you said, you know, hey, not only do we supply uranium for nuclear energy here in the United States, but we're going to help the sustainability issues for the rest of the world with rare earths. And so tell us what this means to energy fuels, please. Well, Tracy, as you know, I mean, we've been focused on what we call a critical mineral hub at White Mesa in Southern Utah. And you know, echoing what what Constantine says, you know, I think one of the things that attributes of both our companies is we're doers not talkers when it comes to making promises we can't keep. So, you know, I think, you know, when you look at the short period of time that, you know, we've announced that we're entering into the rare earth business and the time that we've been working together with neo, you know, I think I hope and I think that the world is becoming surprised at the quick progress and the focus and the strategy, particularly on the monazite plan. You know, I think the monazite plan for monazite sands processing and perhaps other sources in time is a real winner. And so, you know, the relationship with with us and neo together, you know, help keep us focused in the early days of our development in this area. Well, for those of us who've been following this industry since 2008, this seems like a really, really big deal.  Mark, what did you have over in Utah? I think we had a handshake and some subway sandwiches. So, but no, we got photos of the event. It was a great event having representation from neo and our employees at the mill were excited about the accomplishment and the progress being made. So, yeah, it was a celebration. We didn't technically cut a ribbon, but yeah, we did have dinner afterwards and some nice wine. So, what else is, you know, doesn't get much better than that? Well, okay, so let's get right into it then. The announcement was that you have announced the first container of approximately 20 tons of product of an unexpected 15 containers of mixed rare earth carbonate. Now, this is where I'm going to throw the ball over to you, Constantine. Actually, neo performance, your Estonia plant has been producing rare earth carbonate now for what 50 years? Is that correct? No, it has been buying rare carbonate primarily from Russia, from our suppliers at Solid Camps Magnesium Works, who are completely tapped out and they cannot supply anymore. So, as we're trying to utilize available capacity and expand that capacity, the worry of the project with energy fuels was extremely timely and that will allow us to capture that available 25% or so capacity in our plant and push it a little further beyond nameplate 100% capacity. So, it's clearly the right thing for neo and obviously I think it's the right thing for energy fuels. And so, what kind of commitment do you have with energy fuels to increase your supply? I mean, is it going to be exclusive?  Can you tell us more about this? Sure. It's the definitive agreement that supply and purchase agreement that we've signed says that there's a commitment for a certain volume of rare earth carbonate, which we have committed on both sides and then any additional amounts of rare earth carbonate, there is a mutual obligation to offer it to us first or there's a sort of a roll for on both sides. So, we could have additional materials as we're ramping up and we need them and we have every intention to taking those materials. So, the first phase of our relationship here with energy fuels is for energy fuels to produce really more rare earth carbonate that we would immediately need but by the time those volumes become available, I expect that we have expanded the existing capacity at Silmet. So, we'll be able to absorb pretty well everything that energy fuels produces. And of course, we know relationships are very important to both of you or at least I'm aware of this having followed both of you for some time. Mark, I'm going to get back to you here. Your quote was fantastic. Your goals are very impressive. It says energy fuels has a pool of processing 15,000 tons of monazite or more per year in the future. This is 20 tons. So, can you talk to us about what you deem scale to be and what your timeline is for achieving that scale? Well, look, we're and as I've said this, we're not looking at a small splash. We're looking at a big splash. And you know, when it comes to the ability to process rare earth monazite sands and rare earth carbonate, we can ramp up very quickly given adequate feeds because of the size of the mill and the ability to handle that. So, but at the same time, you know, working closely with Neo in the long term, you know, we are also planning on, you know, having separation capacity at the White Mesa Mill because we think that makes a lot of sense. And, you know, we're not really process limited when it comes to processing monazite sands at the mill. It's really just securing enough sources of monazite sands. And I tell people, we're talking to everyone that makes monazite sands in the world. And they want to see an outlet, you know, going through the United States for processing and having the ability to distribute those finished materials in the United States and in Europe. So, you know, there's a lot of people cheering us on. So, you know, our plans are grand and Constantine can verify when you look at the size of our tanks and the process facilities at White Mesa and you look at the, you know, small tonnages basically related to the monazite sands, you know, we've got a lot of capacity. Well, of course, Constantine, you came out of retirement in my opinion to fit this deal together. This, of course, is my opinion. You did come out of retirement to make some very large goals occur. Can you tell us what you, how you kind of expect the market to respond to this substantial news? Well, guilty as charged. I was retired or I was non-executive chair of NIO and I came back. And actually, Mark and I started working on this when I was still retired. But I'm very excited about this. So, it continues to confirm that my decision to come out of retirement was the right one. So, the market, you know, I expect that the market will see this as a positive. I also expect that it will see it as confirmation that we do what we say and, as Mark put it, we do. We just don't talk about it only. On the other hand, excuse me, on the other hand, I think there may be an inclination to see some of the comments in the press release about energy fuels going downstream into separation and further downstream as a potential conflict between NIO and energy fuels. This is completely not true. For those in the market that understand NIO, we operate three rare earth separation plans to in China, one in Europe, the only one in Europe, if I may add. But our rare earth refining and separation business is really designed to feed our downstream high-margin businesses in specialty rare earth materials for catalytic and electronic applications, as well as our magnetic business, which is where we make the bulk of our margins. So, we are net buyers of separated rare earths in addition to rare earth raw materials. So, to the extent that energy fuels can proceed along this business plan and establish large-scale rare earth separation in the United States, we'll be partners with them. We'll help them put it together, and I expect that we will have agreements to buy the output from that larger-scale separation plan. So, we're very much aligned on this. Second, I wanted to vouch for what Mark said. I mean, I was so impressed by the capabilities at the White Mesa Mill at Energy Fuels, very motivated, extremely capable people that were very enthusiastic about doing this. And when you look around Energy Fuels, you see very, very large-scale plans that when Mark talks about 15,000 tons a year of monazite, that would still represent a trickle compared to the available capacity. And we did see the cracked monazite solution of rare earths going into a tank, and it's a trickle going into a massive tank. So, I'm absolutely certain that Energy Fuels can get there because it has the capabilities. But perhaps more importantly, there's an infrastructure around Energy Fuels that is unique in the United States, if not the world. The capabilities that they have to deal with naturally occurring radioactive materials and not only deal with them, but turn them into a profit center by selling uranium to the energy sector, I think is unique in the industry. And also, they have the environmental systems to deal with all the issues that historically have plagued the processing of monazite around the world. So, these 1,000-year tailings ponds that Energy Fuels has away, Mesa, are unique in the industry, and they are absolutely right-sized and properly done in order to make sure that Energy Fuels has what it takes to deliver on a very large game-changing project in the United States. Well, you have it there. The most disruptive news in the supply chain for rare earths for the rest of the world that we've had in the last decade here to Down Investor Intel. Thank you so much for joining us both today. Thanks, Tracy. We'll see you, Mark.


Welcome back everyone to theCUBE's live coach here in Las Vegas for SAS Innovate 2024. I'm John Furrier with theCUBE. Dave Vellante, my co-host, head of CUBE Research. We've got a great guest CUBE alumni, Jason Mann, vice president of the IoT Internet of Things at SAS. Great to see you Jason, thanks for coming back on. Great to be back. So we had a great chat last year about the IoT space and SAS's role in it. What's the new innovations? What are you guys doubling down on? What's AI play in terms of the analytics and sustainability, big part of the story? What is the key message there? Absolutely, we're starting to see exponential interest around sustainability and the goal is to leverage this vast network of sensors that are in place and then apply that to the efforts to reduce power consumption, for example. Worker's safety, there's a lot of these initiatives that are driving a big change in how it's addressed in the market today. Can you give an example? Go ahead, please. Yeah, give a couple of examples. So a huge space that we're seeing right now is the goal of reducing energy consumption. So SAS has a solution called energy cost optimization and it's focused primarily in providing insight to the energy utilization across the processes within the company. Again, sensors, the price has gotten so cheap, it's almost a level of fidelity that's almost sensory in its effort. And they're able to take this information and provide insight into specific areas within the operations that are using the most energy, for example. Or where you have multiple lines, you're able to compare lines against others to determine why there's variation. A lot of these companies today are facing both federal and internal mandates to reduce their overall carbon footprint. And as I said, we're seeing exponential growth in this space. So cost of sensors are coming down. It's kind of like the dimmer thing switch in your house, put them everywhere. It's like adds up. But there's other costs too. There's silicon, there's data, there's analytics, there's labor, there's infrastructure around that. So how are you seeing that balance that Yin and Yang and how is SAS addressing that? Yeah, I think that the cost is extended, certainly outside of the sensors themselves. You think about the network costs and being able to move data with this explosion of the amount of sensors. You have this analogous explosion in the amount of data and being able to determine how to reduce the footprint, the amount that you push through the pipe is a key point of interest for many of our customers. You also have the landing zone. So once it moves through the network, you're going to have to have storage for it. And as we're all familiar with in cloud storage, that's a cost that can rapidly expand itself. What's the challenge for the customer? What's their big pain point in doing this? Obviously cost and sustainability, huge factors, we get that. What are some of the challenges that they're facing and what are you guys doing to help them overcome that? Can you impact that a little bit more? Yeah, I think as an example, we have a customer that's one of the largest brick manufacturers in the world based in Altria, Wienerberger. And one of their hurdles is to move these types of projects out of POC land. You know, that's a lot of places that projects go to die. So being able to move out of POC and distribute. So what we have is an experience with them over the last year to where they were seeing just in the pilot, about 9% overall reduction and their energy cost. And so then it's that next step. It's the problem that you're talking about. Now, how do we get this deployed? And we're able to work with them to deploy it into the first couple of factories distributed across the end to end process. And they actually realize about 15% cost reduction. And now it's like a phase two, they're going to 200 plus factories. So you're saying the challenge is the POCs just don't make it or they get distracted or they don't understand how to use the data. Is that the real problem? You do. A lot of the POCs aren't designed to transition into enterprise scale. And you put a lot of people against the project but it doesn't transfer. And being able to have a product that can understand and deliver insight, not just in the POC environment, but in real life is key. Can we take into an example? And I want to understand exactly where you play and where you don't play. And let's use your computer vision as an example and think about full self-driving. When you guys do fraud detection, you're doing it in near real-time or real-time. Correct. So you got to do real-time at the edge with automotive and there are thousands of applications like that. A lot of that data is not sent back to the cloud. A lot of it's done real-time and disposed of. But 5% of a lot is still a lot. Exactly, yes. So where do you guys play? Are you at the full end of that? Obviously the analytics can go back to the cloud or you do in real-time. In that example at IoT, where do you fit? Where don't you fit? I think the easy answer is wherever decision is required. So what we're finding is in the market today, obviously the cloud adoption, but we're starting to see more and more architectures that require a hybrid version. So you have your cloud storage, but you're moving to aggregation points that may be co-located to where the data is being generated. So decisioning sometime is needed there. Or it may go all the way to the sensor or the camera, as you mentioned, computer vision, where you need an insight generated at the time of the action. And you're not doing the full loop of moving the data all the way through the network back to the cloud for decisioning. You enact there and then publish alerts from that point. So obviously automotive is one, I mean, I'm looking at, you're looking at, I'm up for a new car. I'm looking at your car, pretty nice car. But there's sensors everywhere, there's cameras everywhere, there's sensors everywhere, there's of course microprocessors behind them. Obviously, Industry 4.0, manufacturing, energy exploration, I mean, where's there not sensors in computer vision? I think that's exactly right. If you can put a camera and monitor something, you have the ability to generate insight from that. One area that we're seeing, again, a lot of interest as of late is around worker safety. In the industrial sector, obviously there's a lot of dangerous jobs that are out there. And it's critical for employers to be able to define safe spaces and then monitor it to make sure that the employees are following the rules. The best way to do that is to leverage the cameras that are already in place. So it's generating further ROI from infrastructure that exists. So they can create a geofence, then use the cameras to monitor the employee actions and use it in two-fold, either to catastrophic capabilities. You want to generate an equipment stoppage, for example. But you also have the carrot part of it where it's training and positive reinforcement to change behavior. You know, Dave, I was asking Brian Harris in the media briefing a question. And I remember as Key knows, it's kind of a dumb question that I asked. I'm like, is that a good question? His response that he prompted him for was about multimodal. The vision brings up the whole AI. You got cameras. And what I didn't realize in my questions, they've been doing this for 47 years. So IoT cameras are huge. So it's industrial. So it's OT-like environment, now IT-enabled cloud. You got multiple modes. You got LLMs. You're going to have all kinds of stuff. How's the GNAI going to piece into there? I mean, obviously sustainability check, worker safety check, very responsible. Good job. Okay, put it on the side. Sure. Table stakes. Other innovation, GNAI. What's coming next? I'm imagining all kinds of cool stuff with cameras, video, audio, I mean sounds, tables, graphs. I mean, if you're running in these environments, you're going to have a very diverse data set. Absolutely. So I think one of the big advancements as we start to talk about topics like generative AI is you start to expand the engagement of analytics and the outcome that analytics can provide to a much broader population. We get outside of the data scientists and now you're looking at operators. So where we're seeing the most advancement is doing that translation of what had historically been a quite deep dive into assessment of process to something that's conversational. What is my biggest area of concern on line three? Where are we seeing the most areas of failure in operation B? And it really can be an engagement at that conversational level. And that's what GNAI is doing. You know, we heard, Dave and I, we've been, how many cyber shows did we do last year? I think it was at the Google Mandy and show that mostly threat detection stuff. But one of the things that came out of there in GNAI was it does all the security reports for you. One of the biggest pain in the butts was for CSOS was doing the incident reports. So I know there's compliance as a huge part of the IoT, your area was worker safety. Do you see that to be a hot area with a lot of assistance coming in on the compliance side? Just like from one monitor, you said save spaces to reports. All that stuff, probably all that heavy lifting. Absolutely compliance and there's inspection capability or requirements especially within the heavy industrial space. We have a customer here that speaking at the event, George Pacific and they were wanting to be able to expedite time to resolution for potential issues that pop up on the line. So historically, if a machine threw an error code as an example, you have to go to a system to look up the error code. Then you go to another system to look up how to repair it. Then you go to another system to understand in the past how was this resolved and they're using a convergence of all that data aligned with GNAI initiatives to be able to bring all of that and put it on a platter to the operator. One of the things I'm impressed about what you guys are doing on the prompt storage, I love those, and the models across industries, right? That's a huge deal and it's your models which is a great announcement. What are good candidates for some of the vision stuff and the multimodal, what industries are a good sweet spot or low hanging fruit to say, okay, we can see immediate value. What could you outline and unpack where you see low hanging fruit, immediate value, great use cases to get started? Yeah, so I think it's very similar to what we've seen across the history of IoT and it plays into these industrials and these industrial use cases. So manufacturing, transportation, energy. We're also starting to see an expansion into government because they have many of similar use cases there where they're having to provide early alerting and you're starting to see a transition of that going to what I would call environmental risk, right? So flood protection, fire protection because it's still leveraging very similar types of sensors and you're providing a very similar objective. I want early warning to a particular state that needs to be resolved. You know, it's just in a day, we cover a lot of the public sector market with theCUBE, obviously the convergence of private public partnerships, smart cities, all these government and agencies. This is an opportunity with Genii to actually serve citizens better and imagine like the demos we saw on stage where you can democratize SAS tooling for city workers, you get cameras everywhere. So you don't have to be a power user or a data scientist with some of these Genii tools. So that'll probably create a lift for you guys in these other markets where you now have more users out there. Users, consumers, those that can engage directly, absolutely the population will expand drastically with the use of these conversational infrastructures like Genii and LLMs. Yeah, cool. Do you see it as like a big disruptor or is it where incumbents are now just sort of applying the latest and greatest AI and sort of solidifying their position? How do you think about that? Yeah, the disruptor is access. It's really moving up in an exponential scale of those that can get the benefits of analytics or analytics for AIRT and be at arm's length. And that arm's length is a conversational engagement that Genii is providing. So it really is about broad consumption. How does SAS look at the ethical considerations around AI and IT solutions around data privacy? Obviously we heard on stage that the statement, we protect the data. They were very clear about we're not using foundation models or LLMs that are the ones that are most known. This is data that the customer owns. There's always that gray area of wait, is that my data is the customer data? So how do you view the privacy piece of it? Super important. It's going to be critical. You mentioned also the computer vision. So personally identifiable data is oftentimes picked up through cameras. I think understanding the biases and the risk that are associated with that type of generalized data capture or generalized inferencing from globally available data is always going to provide a risk. And it's one that we have to closely monitor. Let me ask you a question if you don't mind, if you've got a couple minutes left. Obviously IoT can't stop thinking about the edge. It's the next area that's going to get massively disrupted in a good way. Obviously the user experience of the edge has things get smaller, faster, cheaper, it's more intelligent. With Genii you're going to have more from device to inside to the cloud. It's going to be a hot area. And obviously IoT is going to play there. What's your view of the readiness of that market? Because remember the OT and IT conversion is still happening. I think AI accelerates it for sure. How ready is the market in your opinion? And where are they in the progress part? If you can peg a spot of kind of the transition from one to 10, 10 being fully immersed. I think they're ready today. And the first movers have already been there. They're moving on to second and third iterations of these projects that are returning high value. We talked about the sensors. And I mean, even if you're not there today, it's such a quick start to deploy these elements that are the foundation for that insight. The turnaround of value is rapid. You know, I feel like sometimes large language model is a misnomer, especially when we talk about IoT because it's an event driven environment. Now maybe it's different AI for that. But I wonder if you could comment on that. Is it really like event driven models as opposed to large language models? Yes, I understand there's a natural language interface and that's where the LLMs come in. But it seems like the AI has greater power, whether it's systems of agencies or co-pilots to actually drive events. It is. So I think that's where you see the convergence of IoT analytics and Gen AI or large language models is oftentimes we are looking for an event. But it's for purpose. It's an event for correction. It's an event for risk. So being able to combine the two provides the basis for the outcome. So we can identify the event. Gen AI or the LLMs can provide a path to resolution to correct that. So it really is where the two meet. Yeah, and I think the stream processing in video is going to be a huge part because that's going to be such a good volume. And again, they're going to be deployed at street lights to wherever on the networks everywhere at the edge, but the volume of data coming in up that's going to be massive. And so you get the volume velocity and data volume. AI is perfect fit there to do heavy lifting. That's where the algorithms come in. I like this is where Dave, I heard from Brian saying, hey, we're going to make a better question, better answer. I think this is going to be an area where you're going to have a big pile of data and I think you will see some new innovation. What do you expect to see there in that area? Because it's going to be one of the hottest areas. Yeah, I think we've far surpassed the ability for humans to consume and evaluate this type of data. And that's where you're going to continue to see advancements. I think the biggest change you'll see over the next 12, 18, 24 months is the idea of autonomy within these processes. So no longer are you going to have a human in the loop making the final decision to make the correction. You're going to ask the equipment to correct itself. Based on that data. Dave's team doing a big research project right now we're digging in. Started six months ago. It's called the Uber for the Enterprise and where you have Uber has cars and users, people, places and things. But it's the cutting edge example of the kind of environment you're dealing with. Real time, third party, device, contract, the driver of the car, the company. A lot of databases are involved. A lot of data is involved to make things happen in real time and you're in the middle of it. The edge is a hot area because that's where the users are. That's where the point of the contact is. Sure, sure. Do you have enough data? Never thought I'd ask that question because we were like data is so plentiful. It's like insights we're lacking. But now you hear that AI is running out of data. And so you hear all this synthetic data. So, and I know in our case with our LLM it's like if the data's not there, it'll. SLM, small length. It is an SLM. Yeah, but it'll make stuff up if the data's not. It's like Swiss cheese. If there's a hole it'll go find it and then it'll grab from the full parts. And so you want to try to plug those holes. Do you have enough data? Or do you have to create synthetic data to get quality? Many times you don't. So there's a lot of drivers as to why you may not have data. Sometimes you're looking for rare events. So you need to create data that'll replicate those rare events so you can create modeling. Sometimes the access to the data is a disruption. So you want to move the evaluation and the analytics outside of the process and oftentimes you create data for that. And then other times there's risk to sharing data. Personally identifiable data or patient data is another great example where you have to create that and then you reduce the risk for that being released into the public. So the specific examples for synthetic data it's not just like making up data on the fly. There's a reason why you're using it. That's what you're saying. Absolutely, and it has to represent data from a real world application. So in that case of PII or healthcare data which is very sensitive obviously. The easiest way to say no, you can't look at it but that doesn't solve the problem. So what you're saying is you create from either the metadata or you anonymize that data and then create synthetic data that replicates that without being able to identify an individual. That's something that you would do when you've got technology to do that. That's correct. That actually works today. Absolutely, and whether it's patient data or a critical process, both of those, you're at risk of impacting either operations or exposing personal data, so both are a driver. Interesting, on the critical process there still could be IP leakage even if there's anonymized data. Exactly a few points, not about the data. That's one element of using the data. But also there's use cases where it's well formed, well understood. So it's just use fake data to test the models and accelerate the either forecasting or reasoning or reinforced learning. It's going to be so much action. I guess the final question I want to ask you, Jason, we got to know you last year in theCUBE. We've seen each other throughout the year and met your other team members. Great work of SaaS you guys are doing. Really appreciate you taking the time to come to theCUBE. Next year when we sit in here talking, what are we going to be talking about next year? Last year we talked about digital twins and you brought more to the table this year. The company's delivering on some of those points which generally I last year explored the last event. When we come back next year, what are you going to be talking about? I think we're starting to see a bit more confidence in autonomy, as I mentioned earlier. I think when we're talking next year, we're going to talk about self-healing processes that are existing within manufacturing environments, high-speed environments, to where the correction happens without human intervention at all. Yeah, right in the moment. All right, yeah, next level. Every year it's the next level of innovation. Jason Mann, Vice President of IoT at SaaS. I'm John Furrier, Dave Vellante. We'll be right back with our next guest. All day, wall-to-wall coverage. Stay with us all day here in Las Vegas at Innovate24. Thanks for watching. We'll be right back.


I need the market to obviously Tell me hey dabs. I'm ready to go in this direction If for the past two weeks the market hasn't really done much we've been capped the dollar index has been capped in the range Dollar index spanning across ad usd euro usd gbp usd All the dollar base pairs have been pretty much capped in the range It might look like the market is moving on a one hour time frame 30 minute time frame But if you scale to higher time frames, you realize that the market is actually capped in the range and this is exactly why When you get into a trade you find out that the trade doesn't really go that far before the market starts snapping back to your entry And eventually stopping up and personally, I'm not really a fan of trading like that I like to trade place my trades and hold so this is exactly why you know, the market just has him You know in football, they call you the true pass You know that true pass when when we split the defense just give me And it both gets to the strike and is a goal. I don't like you know pass pass pass come here Didn't I I like the true past to be clear and leave the guys Before X defense has been quite tight So I'm gonna take you guys to my screen shortly to obviously just show you guys what's been happening on the charts and Potentially show you guys some training opportunities as well. But before I go into that That's always every week. I get messages, you know From you guys thinking me about the Forex mastery program and how is that actually change your lives? Mr. What's his name? Mr. Michael a guy called Michael, you know, he shared a fantastic story with me He said how he was in debt over the years from Forex trading and you know, Forex can be very very daunting Forex can actually drive you crazy and ever since he bought the course for just he said this $99 he spent on the Forex mastery program is one of them the best investments He has ever made the guy has lost over $70,000 in his life from trading and since he took the program He's been able to recalibrate his trading. He's been able to grow his account by 60% and he's currently talking to investors Because he took the Forex mastery program and the investor program as well He's currently talking to investors while going to obviously invest in this trading as well to the to the sum of I think He said half a million dollars He's looking to take on because you know after taking the program He now has a more consistent approach guys these stories. I have to share them because they made me happy This is why I do what I do to change lives You know to tell you guys that I markets like IML Ponzi schemes sign up people to sign up people It's not the way to trade Forex day trading is not the way to go indicators It's not not the way to go signals is not the way to go to so to actually see the Forex mastery program change lives and see people actually You know take up trading and see trading actually put foot on their table makes me so Happy so guys. Yes shout out to you Michael. I love you very much Thank you for listening to everything that I shared on the program and thank you for implementing them positively And yeah, thank you for being you thank you for being an amazing trader So guys without any further ado, I'm gonna take you guys over to my screen. Let's go Hey there. What's happening people? Oops. I hit my mic by mistake. Hey there. What's happening people? Welcome inside of my screen Once again, like I said is good to have you guys To be able to speak to you guys and communicate with you guys has actually been a while Unfortunately, I couldn't put out a Twitter talk video last week because the market wasn't actually doing that much And when the market isn't exactly doing that much. There isn't really that much to talk about So this is why if you see me away from the charts for a bit, just understand that I'm I'm trying to give the market room to breathe and for the market to present to me Opportunities that I can eventually come and share with you guys But today I want to update you guys on what has been happening so far and hopefully we can potentially find some trading opportunities That we can take advantage of this week. Today is Tuesday the 4th of May 2021 and yeah, I'm glad to be back on the charts on the screens And let's dive right in. So guys the first The first pair that I want to speak about today is the euro now the euro has been A bit stubborn over the last, I don't know month two months now We made some money early on in the year January February from the euro However, ever since then the euro has been neither here nor there so We were expecting the euro to pretty much fly out from here all the way here We pulled back all the way down here to come and test this black line the forex mastery students, you know Why we use black lines how we use black lines the market came to test this black line Just shy of this major level and if you actually come and draw your trend line Like so you'd realize sorry guys I have Message coming you would realize that Um, this market actually did come to test this you know this level on the trend line So and this is looking like one two This is looking like the third touch of the trend line for euro USD So what the third touch of the trend line actually Signifies to me is that the market might be ready to bounce out now the third touch of the trend line always does the trick And so far so good the euro looks like because while we were trading here I kept on I just wasn't comfortable with buying the euro because I felt like the euro was Looking a little bit too linear linear means that the market was looking a little bit too straight I had a feeling that the market wanted to come and like You know consolidate and retrace a bit more Okay, you know expand a bit more before eventually heads to the upside And that's exactly what has you know played out and has happened thus far So we've actually swung to the right as you can see and we have bounced out of here If I check the weekly timeframe, this should be a very bullish candle. Yes, so on the weekly timeframe, I can see that You know this was a bullish engulfing candle off of this You know trend line support off of this black line And not only have we you know had one engulfing candle We've had two and we've had three and all three of them have gone ahead to break this Minor resistance level somewhere about here Okay so That being said I'm going to need to pause this because my laptop is acting up a little bit Yeah guys, sorry about that. I had a little breaking transmission. So, you know, I can see one two three and we've broken above this Support that was holding this that eventually turned resistance We're back above And from what I can see from a weekly timeframe perspective the euro might just be heading to the upside now Something is holding the euro from actually, you know jumping all the way to the upside what is Actually holding the euro from jumping to the upside is actually this trend line like so So if I just delete this So two things can happen to the euro as we speak What I feel is most likely going to happen is We're most likely going to pull back into this yellow bar And then eventually break to the upside. Okay So in the case of the euro, I'm actually favoring the upside to the tune of 70 percent or We can just collapse all the way to the downside now How do you go about trading this is simple and very straightforward allow the market come into this level let it form a base On a daily timeframe a bullish engulfing candle off of this level will be sweet You can probably buy off of that level or you can wait for a break out of here Now my targets are going to be all the way at this blue bar somewhere around here because I'm very confident Actually first level targets always at the 100 percent retracement You want to take out a percentage of your profit somewhere around here But I'm very confident that if this bullish momentum sustains The euro is actually going to blow up quite significantly or on the flip side We can roll over to the downside. So, you know, that's the thing with forex Like, you know, you can't be 100 percent certain except the market actually confirms to me So for a bullish bias, I would wait for a base to form here A daily bullish engulfing candle to break all the way to the upside Or the flip side for a bearish scenario a daily candle close here Then what we might be seeing some further bleeding all the way down to this blue bar around here This is the euro usd in a nutshell So I'm going to go ahead and delete this and I'm going to be watching this pair very carefully once again A base around here a daily base around here, you know, pull in nicely For a push out to the upside or if I just see a total collapse to the downside That will obviously present some certain opportunities for us But at the moment the euro is pretty much trying to decide what exactly wants to do as it has been doing for Oh my god, almost a month now. It's been absolutely ridiculous, right? The next pair I want to speak about which has actually been on a lot of people's mind is gold Now what exactly is happening with gold today? I want to just shed some light on because a lot of you guys seem confused, you know You're just clicking buy sell buy sell left You know, the market is just tossing you guys left right and so now So what exactly is happening with gold is this? On the monthly time frame, we have a double top that has formed on gold as you can see massive double top We're expecting this market to bleed all the way to the downside. However On time frames lower than the monthly time frame from what I can see the market is This trend line is holding gold from collapsing this trend line And it's one so this is looking like the third touch of the trend line for gold So there's conflict of interest when it comes to gold There's a lot of conflict the monthly time frame is saying Yes dabs bearish reversal all that but the weekly time frame is telling me your this trend line is here Now whenever this happens, I usually do nothing I like to stay away until the market finally decides what it wants to do But one thing I know for sure is gold is eventually going to rally up a bit more To 1.825 Test here once we get here We can then decide what it wants to do and on very certain days It bearish trend line and descending trend line that is coming all the way from the upside So you want to watch out for this level is a key level right about here Okay This area right about here is actually a very important level So, you know This will actually be the third touch of the trend line If we hold here and I see a bearish engulfing candle down I will be looking for sell opportunities. However, if gold goes ahead to break here Whoosh like breaks full erection candle break ladies and gentlemen gold is heading for brand new highs Okay, so at the moment this area is going to be our area of decision I feel that this market is most likely going to pull into here Once we get somewhere around here Whatever the market decides to do from here, it will now dictate what exactly we're going to be doing After you know after now So I'm expecting us to pull into here definitely if we have a bearish engulfing candle down here Allow something like this If I see a bearish engulfing candle allow something like this Sells to the downside if I see a bullish engulfing candle break We're going to be seeing some buying opportunities all the way to the upside either way. We have fantastic trading opportunities Let me just clone this bad boy. We have fantastic trading opportunities at our disposal if we break to the upside I'm going to be looking at buy situations all the way up into $2,000 per ounce if we Hold here first level tanks are going to be here. So we have pips either way So, but we need the market needs to tell us what exactly it wants to do Before I go ahead and come it. So guys, you know, that's the euro and gold in a nutshell GBP USD is still playing around. It's still acting like a sport brat Doesn't want to commit in either direction like I was saying GBP USD is a very straightforward situation If I draw my trend lines like so we have broken. This is a major level We're broken out of this major level. Do you want to head higher or have you broken the trend line? Okay, if you want to head higher, you need to let us know if you want to come lower You know, we need to take out this level but for the thing about the Paris is Guys, January, February the market was just going We're just going to take it off April the market slowed down to consolidate Okay, this consolidation started off in last week in February So mark last week in February March April up until now we've been consolidating Neither here nor there for those of us who made money on the up You know the market going to the upside if you've made money to the upside Try and hold your capital. Okay, because what tends to happen to most traders is they make money In an impulse leg and then because they're so impatient and they just want to keep trading They eventually lose the money back to the market when the market starts ranging Don't forget for every impulse leg for every push to the upside There must be a resultant sideways movement It's just the way the market just the way the market works the market works in waves when you read about Elliott wave This is the waves Okay, so if I know that there's always going to be consolidation after every impulse move What do I do I chill I take advantage of the impulse waves and I chill during the consolidating state because when the market is consolidating we don't know The highs and the lows of the consolidation. We don't know where the market wants to stick between the range We just don't know anything and I don't like trading blindly. This is why so this is why you notice that for the You know last couple of weeks, you know, it's been difficult for us to gauge a proper direction Because if we say it's going to go up next thing we know it's coming back down If you say it's going to go down next thing's going back up Why all these are all characteristics of ranging times and I'm very glad I'm here To go through this ranging period of you guys so that I can teach you guys and show you guys how to comport yourself How to behave yourself? And for those of you who haven't grabbed the forex mastery program I suggest you strongly suggest you do so it will teach you how to sit on your hands during times like this It will teach you how to analyze the market properly and how to sit on your hands during times like this. We only like to trade We only like to trade in the direction of the floor of the river We only like to trade when the market is trending during sideways movements. We're confused We don't know what to do and that's fine.  It just means that the market is confused How can you tell somebody what to do that is confused? This guy doesn't know what he wants to do until he commits All he needs to do is one weekly bullish engulfing candle break a couple of levels and we're good. We're good Home run it's time for a home run, but for now Don't get sucked into the consolidating stages. This is a major problem for most So we're going over jbp.  Okay Impulse consolidation rally to the upside. We're moving sideways during this time. Do we go up? Do we come down? We don't know for now. So we need to wait. Are we gonna break lower? Are we gonna break higher? This is already looking like Like a head and shoulder. Are we gonna break lower? If you want to break lower We need to take out this neckline for further downside if you want to break higher We need to take out this level and then rally all the way to the upside So guys, this is the analysis pretty much in a nutshell I know you guys don't like being like listening to me when I say be patient But it is what it is you have to just chill and allow the market come to you spend time with your family spend time doing other things Watch a couple of my other videos. I always speak about multiple streams of income How to get multiple streams of income so that you can distract you From times whereby the market is not exactly cooperating And for those of you who haven't grabbed the forex mastery program and sure to do so The link is going to be down there below and I'll catch you guys in my subsequent videos I'm actually in the process of shooting about 30 Guys. Yes, this is content creation month for me in may So I'm matching the process of shooting more videos that ultimately going to help you guys make more money Make more money in the forex market and generally make more money on the internet. So guys Stick around while I take you to my other screen. I don't know if there's any pair. I'm missing now cgbpjpy for a bit Everything is constantly dating after every impulse where we have consolidation. Everything seems to be constantly dating at this point To be honest, everything just seems to be constantly dating So there isn't really much going on except you want to be trapped inside You know, the thing about it is one hour time frame traders.  Oh my god That's not the way to trade We need a clear direction to trade and the forex mastery program will teach you guys how to do so guys Stick around.  So let's go to my other screen All right, guys. So there you have it. Thank you for staying to the very end of That very brief trader talk now guys like I said earlier, there isn't really much going on in the market You just need to chew. I know you've been hearing me say this for three weeks, but it is what it is I'll rather preserve because I made it significantly. I probably made about 30 something percent At the since the beginning of the year up until now. I don't want to give it back to the market So I have to wait about 40 percent of my account of return So I don't want to give it back to the market. So I have to wait. I have to be patient I have to ensure that the market is ready. It's right to give me the opportunities that I need to make this It happened. Okay. I don't want to give the market any of my money. So I'm being extremely careful Um, so yeah guys, so if you haven't already grabbed the forex mastery program, I encourage you to do so It will keep you sane. It will keep you consistent. It will teach you how to analyze the market once Place your trades and go and spend time with your family This is what I stand for and this is what the forex mastery program stands for The link is going to be in the bio down below and don't forget to drop me a comment if you found this video helpful I remember sharing a video at the beginning. I remember sharing a testimony at the beginning of this video about a guy called Michael and I'm still He's made me happy He's made me truly proud because I remember him. I remember the day he signed off for the program I remember him sending me a message on telegram, you know complaining about his issues and all that And I said the graphic program if you can implement the things on the program You're very you're you're you're gonna be on the right track and the guy comes back to me Um, just on friday and he's telling me all this amazing story of how he's made 60 back on his account And how he's about to secure some half a million dollars in investment after taking The forex mastery course so shout out to every single one of you Obviously, there's amazing traders on the telegram group that make the telecommunity fantastic Forex mastery students on the telegram group. I love you guys very much I see every single one of you keep striving keep pushing and yes at the end of the day You will come up tutorial. So take it easy Um, that's it for me that will is I'll catch you guys on the subscribing videos Like I said, I'm currently in the process of shooting more fire Fire content. So guys watch out for some more. Take it easy and I'll catch you guys next week Adios and peace out


If this one that we just put up there were devoted solely to telephone service, 90,000 conversations at the same time. Stand by, Mr. President, the signal switch poison. Hello. Well, hello to Hank and both Mike and Steve, Judy and Charlie. Sounds like a little community of town you've got going up there. Listen, we're following your exploits and you're doing a great job. How's it going? Any surprises so far? Well, any surprises so far? Well, you don't mind if I think that over. Listen, I want you to know that the men and women in the Navy at a huge aircraft were thrilled by your perfect deployment of SINCOM. That communications satellite is going to help all of us in this country and believe me, we're grateful for your great part in getting it up there and getting it launched and now as of this morning, a little while ago, you were three for three with the launch of the AT&T communications satellite. All right. Listen, you know, I know that previous astronauts have now then been able to pinpoint various things down here that they can see from the vantage point of space and how do we look from up there? You've seen anything unusual or things that you're going to be reporting on? Yes, of course, this has been a season in which some of the earth that shouldn't be covered with water has been covered with water too. Listen, your work up there is helping to make it easier for the people of the earth to communicate with each other. So on top of being space men and a space woman, you're doing some very good work for your fellow citizens of earth and we're very thankful and we're also very proud. May I ask, is Dr. Judy Resnick nearby? Judy, how is it your first flight? How's it going? Is it all that you hoped it would be? Well, as for that, what does an electrical engineer do in space? Listen, I also want to wish a happy 36th birthday to Charlie Walker. Now, I know the birthday isn't until Wednesday, but I have the feeling that you'll all be so busy and he'll be busy as you'll all be finding a parking place at Edwards. So I just thought I'd send the greetings now. Happy day and listen, what you're doing is so exciting that you mentioned about myself being up there. As I say, I'll have to think about that for a while and then see whether I can appoint myself as passenger. But our thoughts and our prayers are with you, believe me. And I say that for myself and Nancy and I know for all America. But there is one thing I'm hesitant about making any suggestions to all of you up there who know so well what you're doing. But if you will remember to just now and then build some downtime so you can just sit back and watch the world go by. You know, there was a wonderful flyer once. His name was McGee. He wrote a poem about the freedom that he felt flying above the earth. He'd fly as much altitude as he could get and as he put it lose the bonds of gravity and hurtle through the clouds and as he put it in one line of his poem, touch the face of God. I hope that with all that you're doing up there I hope that you will have time for a moment like that. We're all very proud of you. God bless you all. I'll go along with that. And now I'll say goodbye and let you continue with what you're doing and we'll all be watching you on TV. Goodbye. Did you hear him? Yeah, it sounded like they were in the next office, yeah. It's amazing. Her answer, if they play this thing at both ends of the conversation I had her answer when I said, what is it? She said to me up there, she was saying about to be up there with the crew of the Army and the Navy and the Air Force and all of them arguing about which one is best. And so when I said, well yeah, what does an electrical engineer do? She says, whatever they tell me. I don't really have an urge to join them up there. I like it just about horse high. Yes, you can get off the horse. Okay. I guess Kathy, is Kathy going on a trip? I believe she is. Did you find the address? We'll get it, sir.


In my last video I sat here and I asked the question. What is going on with Nintendo? It was a matter of days ago because we hadn't heard anything about Metroid. We had no idea what was happening with the switch this year past Xenoblade Chronicles and maybe no more Heroes 3 and in the last few days a lot of things have happened. A lot of really well things have happened. I was gonna say really exciting. I'm gonna rephrase it. Things have happened that I'm excited for but I can totally see why people maybe still are a little hesitant to get excited just yet. First up, welcome back to the channel. Thanks for being here. Subscribe if you haven't already. We have fun here. We have good times and getting close to that million. Also, brand new microphone. It looks the same as the old one, but trust me, it's more expensive. So let me know if it sounds better or if I just wasted like half a grand for no reason.  You know, you're here for one reason and one reason only. That's for the hot news. That's for the hot goss out on the street. I don't know what I'm saying. Very first up, we had that I woke up this morning as I was sipping on my cup of Joe to a new Paper Mario, which excitingly wasn't just an announcement that one was coming at some point soon. Maybe who knows when. No, it actually has a release date. And I if I remember correctly, July 27th. All right, so we went from not knowing about any Nintendo stuff in the coming horizon past Xenoblade Chronicles 2 an entire Paper Mario game in a couple of months. Nintendo is so good at keeping secrets. It's insane. The entire Last of Us 2 was leaked months before the game came. Has the game's not even out yet? We can already go see that whole game. But Nintendo manages to be like, oh, we have a full Mario game coming in a couple of months. So that's cool. Let's take a look at it. I looked through the trailer maybe like 17 times already. My keen eye is mostly looking out for gameplay because that was the biggest issue everyone's ever had with Paper Mario games since Thousand Year Door and the combat. Oh, it's interesting. OK, so I have to say, I think it looks very nice. I really enjoyed Color Splash for its story and its visuals. The gameplay obviously much like most of you. Very repetitive, very lackluster, very not exciting at all. But the visuals and the story were excellent. I'm feeling the same way about this one. However, I can't help but laugh a little bit at something I saw. A lot of you might know, Arlo is a huge Paper Mario fan. And someone shared this on Twitter and it popped up in my feed and it's too good. And then Nintendo gives us a direct announcing Paper Mario into the fold and it's all about Origami. My heart can't take that kind of thing. Yeah, it just can't. I love the little. It just can't. OK, so that was a video a year ago. It's like Nintendo almost waited. It's almost like Nintendo heard that and immediately went. Origami biggest fan, Arlo was going to love this. Much love, Arlo, but I feel bad for him right now. I think my biggest complaint with this trailer. I mean, I try not to judge things before I have them in my hands, but this trailer isn't really telling me much. Like I get that it's about Origami and there's a few screenshots of some pretty looking areas. But I mean, Color Splash had some pretty looking areas. Obviously, it seems like completely got rid of the cards and the stickers to a lot of people's extreme joy. So this is the gameplay. It's on a ring, which gives a whole new meaning to a turn based combat. So, yeah, I don't know. You kind of turn it to line them up, which doesn't seem like a very complicated mechanic, but maybe that can obviously be fleshed out more if you have a lot of enemies on the ring and they can all be lined up in one turn. That's all we got, though, which I think is criminal. That's all we have to work on. But I hope a lot of people, Mario fans are really excited. I hope Arlo can find excitement despite what he said a year ago. That'll be an interesting reaction for sure. OK, well, there's that. I have more, though. I have I have I have a few things more before we talk about Metroid Prime 4, which I'm really excited about. That one I'm excited for. I don't know what that noise was. There's some cool developments happening there.  But before we dive into that, I don't want to pass over. I want my opportunity to talk about the PlayStation 5 gameplay reveal really quickly because I don't wait. Because there's something really exciting about it that I feel like a lot of people it's not really sinking in. A lot of people it's not really grasping the full concept of what just happened. And I did talk about the whole Xbox lineup event thing that happened. So it feels wrong to not talk about the whole PlayStation 5 thing. The Summer Games. Are you liking it so far? Because it's actually been kind of cool. Instead of an E3 this year, it seems like Nintendo are just going to be dropping trailers for games like they did this morning with Paper Mario, which was cool to wake up to. And then Summer Games is a thing. It's hosted by Jeff Keely. First thing he did was announcing Tony Hawk one and two remastered thingy with the hawkster himself. Tony Hawk Broskater one and two is the bridge that manages to connect gamers and non-gamers. Just everyone loves that game. It's I don't know universally loved. So we had that and then the next day he revealed some PlayStation 5 gameplay, which technically was PlayStation 5 gameplay because it was apparently, as I said, running purely on PlayStation 5 hardware. However, what they were showing, it wasn't a PlayStation 5 game. It was like a test demo built within Unreal Engine 5. And Unreal Engine isn't by any means a PlayStation exclusive thing. And that is what I feel like a lot of people are missing. And that is what I feel like is really exciting here. That's the big key. Triangles. Oh, triangles. If you were a square guy, this trailer was not for you because it was all about triangles and lighting. That that is a lot of triangle before we can really dive into what Unreal Engine 5 means. We have to take a look at Unreal Engine itself. Guarantee you that there is a game you love, at least one, but probably multiple that were made with Unreal Engine. I mean, just take a look at this list. Crazy diverse this engine is and how fantastic this engine is, how easy it is to work with and how great games end up looking if you fully utilize the engine. One of the best examples I can think of of recent years, most all the Gears of War games have been built with Unreal Engine and the newest Gears 5 was built with Unreal Engine 4. That game looked gorgeous. The dynamic lighting effects. Oh, it's just there was so much going on in that game. But I mean, it expands so far, Borderlands 3, even Daemon X Markiner on Switch. That is why Unreal Engine 5 is so exciting. Not because this is an example of what one game, whatever this test demo might look like. It's not an example of what all PlayStation 5 games are going to look like. It's just an example of what an engine that the next generation of games can use and utilize to its fullest extent. Like what is possible with this engine that will then go on to be used in hundreds and hundreds of games that we all love, no matter what kind of gamer you are. There's just so many possibilities here and that's what they're showing off. Like that truly that is what they are showcasing here, what this engine can do in all the different ways that it can do the things that it can do. A lot of people ask the question, where do games go now? Because especially getting late this gen, things are getting more and more realistic. And the biggest one is those dynamic effects, like lighting and atmosphere and things like that, because those things can add so much into a game to make it feel real, to breathe life into it. That's what's really exciting about this. And I wanted to call attention to it. It's not so much, again, what the PlayStation 5 can do, which it is obviously cool to see this running on a PlayStation 5. It's what this engine can do. On, of course, the triangles. Metroid, Metroid Prime. I don't know why I'm such a little kid. I clap when I'm excited. Yeah, things are finally happening a little bit behind the scenes. Metroid Prime, it was in development. We had no idea what was going on. Then it got completely scrapped. Who knows what that game initially looked like. Who knows what Nintendo had planned for the game, what their vision was. They decided, ah, we can't do this. Let's give it to Retro Studios, the company that originally made the Metroid games. However, that was years ago. Retro Studios, it's it's arguable, but they're not the studio that they once were. I mean, it changed. It changes hands. People come and go. Essentially, there was different people working there. So, yeah, it's in the hands of the original studio, but who is actually making Metroid now? Like, who are we trusting to develop Metroid? And that was a little bit scary. In my in my eyes, Metroid is in a way the halo of the Nintendo universe. I mean, it's really our only first person shooter that we get from Nintendo. And every and Metroid one, two and three were all stellar games for their time, the visually gameplay wise, especially for Nintendo at the time. But we finally have some information on who is making the game. So I don't know what's going on with the game, what it looks like, any of that, but we know who is involved with working on the game. Retro Studios has high, oh, they're Texas based. So it's happening somewhere around me. I don't know where. I need to look that up. They have hired a new visual effects artist, the same guys that worked on Battlefield Hardline, Shadow of the Tomb Raider and Borderlands 3. You can actually, if you go to this, I'll link it below, but they've actually linked to all their portfolio, their work or whatever. It's really interesting. Like this Borderlands guy is showcasing specifically like weapon effects. This is really interesting to see because this right here is a little bit similar to Samus's Plasma Cannon. Then with Shadow of the Tomb Raider, you start thinking of the other visual effects of the caves and the atmospheres and the lighting and stuff like that that was in Tomb Raider, Battlefield Hardline. I haven't honestly played that game, but I have heard that there was some amazing visual effects in that game as well. And then this is on top of their previous hires. They had the developer at Playful. He worked on Newstrupper Lucky's Tale, which I really enjoyed that game. The level design was really creative, really well thought out. James Beach, who worked on Crystus 3. And then Stephen, who worked on Donkey Kong Country Tropical Freeze, which is, oh, and Halo, which is really exciting. Tropical Freeze being, in my opinion, the best Donkey Kong game, but in general just an absolute, amazing, brilliant platformer. Obviously, working on Halo, like that's a pretty big experience to be going into a new Metroid game. I think it's really exciting. I mean, you have a lot of puzzle pieces coming together, a lot of really talented people. And I think it's pretty safe to say at the very least, whatever game this ends up being, it's going to look fantastic. It's going to look visually very pleasing, which again, the previous Metroid games always managed to look incredible for their time, especially on Nintendo Hardwares. Depending on how long the Switch's lifespan lasts, this could be the best looking game on Switch. I'm pretty confident there. All right, guys, cool. I know usually when news hits, news drops, I jump upstairs and I do it up there. But I did that last one a few days ago, sitting here with the sales, and you guys seem to really like it. And also having my computer right in front of me so I don't forget anything and I have my notes is really handy. So I'd be interested to know what you guys think. Do you like me doing these news updates sat here? Or do you prefer it when I'm up in my game room bouncing around with all my games behind me? With all that said, it's like a million degrees in this house as always. Oh, I hope you're all doing very well. I love you all. See you in the next one. Subscribe, I want that million. And it's up to you. I can't do it. There's only one of me. Bye.


An intrauterine contraceptive device is a T-shaped implant impregnated with copper or hormones. It is placed in the uterus to prevent pregnancy. The procedure is done on the fourth or fifth day of the menstrual cycle. On the day of the procedure, you lie down comfortably with your knees bent in an area where your privacy is respected. The doctor will gently insert an instrument called a speculum into the vagina to see the cervix after which the cervix is held with an instrument. The IUCD will then be put in the uterus and you may feel my discomfort while it's being placed. The procedure takes about 15 minutes. Post procedure, you may experience slight vaginal bleeding and cramping for a day or two. Please contact your doctor if recovery is not as expected or if you experience anything unusual including heavy or missed periods, unexplained fevers, pain, severe headache, etc.


Welcome back, and thanks for hanging with us here at AppSecVillage at Defconn 2020. Before we get to our next speaker, I'd like for you to take a moment and take a look at AppSecVillage.com. Out there you can find this year's t-shirt, which is incredible. This is last year's t-shirt. This year's has got more color, it's got an awesome design, I just got mine in the mail a couple of days ago. Check it out. It's a great way to support AppSecVillage and make sure that we can bring you the same kind of content and application developer security focus that we've brought the last two years. So that's AppSecVillage.com. And now for our next talk. It's entitled Local Ghost, escaping the browser sandbox without zero days. Parsea Hakameum is a senior security engineer at Electronic Arts. He works mostly in video games and their surprise mechanics. On a different continent, he was a sea developer. You can find his rants over at parsea.net or on Twitter at atsigncryptogangsta. Now remember, crypto stands for cryptography as everybody over in the cryptography village would tell you. So with that, welcome Parsea to the AppSecVillage stage. Hello, everyone. Thanks for giving me your time. Today I'm going to talk to you about how we can jump the browser sandbox using localhost web servers without any sort of old days. This is part of the AppSecVillage on DEF CON 28 in the year 2020, which has been a very, very long year. My name is Parsea. I am a security engineer at Electronic Arts. Mostly work with video games. The shorter guy in the picture, not the other one.  Now when I moved to Canada last year from U.S., people told me they don't have it in Canada, but they do. So I would like my money back. This is my second time at DEF CON. First time at the village, I was here on DEF CON 28 team or talked about Enterprise Blockchain. I play a lot of video games, which is good because I work for a video game company. Now this is a slide that I put on all my presentations. It is here to tell you what I'm going to talk about so you can decide if this is a talk for you. So your time is valuable. I don't want you to sit to the end of it and say, this is useless, or I already knew this, you know, I would consider this a favor if everyone else did it too. So I'm going to talk about why modern desktop applications use local host servers to do inter-process communications and how this is bad from a security perspective because JavaScript and browsers can connect to these websites. Usually there is no authentication and it can get some really easy remote code executions using this. I was also discussing browser concepts and bugs related to them and finally I will talk about remediation and how we can fix things and not just point and say something is bad. So these local web servers are like ghosts in your machine. You think you don't have any, but go to your machine, run net stat and check and you will have at least a dozen of these. I cropped the screenshot, there were more. I can see and these are like normal, typical everyday use apps like Discord and Dropbox and Apple and iTunes and Nvidia, I mean, all of these have them. Why would Discord or Dropbox have a local web server? It's usually used for inter-process communications. So usually you have an electron front end and the electron front end talk to a local web server and that serves content to it. Sometimes you have a Windows service running as system, those are fun and then there is a front end app that talks to them and they talk with each other. Sometimes you have a local host server that allows you to talk to different applications like Discord and Overvolt talk with each other. Another use case is using seamless inter-transition from a web site to a desktop app. Video conferencing apps used to do this, you would go to a meeting page, the JavaScript in the meeting page would talk to the local server from the desktop app and the desktop app would bring up the video conferencing app and connect to the meeting. Seamless interaction, great for user experience. Dropbox also does this. If you have the Dropbox desktop application on your machine and you go to the web interface, sometimes you have an open button in front of a file, let's say it's a Microsoft Office, like a doc file. You click on the open website, open button in the website. The website talks to the local Dropbox app on your machine, the Dropbox apps opens Microsoft Office and opens that doc. Great again, great user experience, but is this really secure? Let's see. Another thing that websites do and gain a lot of traction was port scanning. Someone went to the eBay website and saw that it's scanning a lot of local ports. For example, to see if you have learning a local VNC server or the remote desktop application like certain ports, banks have been doing it for like four or five years. I remember I went to a bank website in 2018 and was doing the same. This is part of the fraud detection thing. It grabbed the results and feed it to a complex fraud detection algorithm and it decides if your machine connected to the website is part of a botnet or is being remotely configured, remotely accessed or not. Should they let the transactions go through? Should they lock your account? So on and so forth. Typical stuff. If these websites are doing it, what prevents bad websites from doing it? Your app is internet connected because of that. Raymond Chen is a Microsoft employee and he has been writing this use very, very useful blog called The Old New Thing. And one of his blogs, which starts with that quote, it's rather involved beings on the other side of this airtight hatchway. And by the way, this is a quote from Dr. Saddam's book Harker's Guide to the Galaxy. It's an amazing book. So Raymond talks about three privileged levels and a typical Windows machine. You have a remote attacker who's not on the machine. You have a local attacker who is a standard user.  Now browsers can be remote attackers, although they are running on your machine. So the JavaScript in the browser can talk to the local web server or talk to the local web socket server. And then the remote attacker can gain privilege on your machine. He also talks about how your app is internet connected. And this is from 2006. He says, if you have an app and it handles website, I'm sorry, handles files, people can create network shares on a remote machine somewhere else. And then they can pass it to your app and now your app is internet connected because it's grabbing the resource from a different side, although it wasn't in your threat model. We've talked a lot about browsers and how browsers can be remote attackers. Let's talk about how browsers want to keep us safe, but they can, but they cannot, and what protections are there and how we can bypass them. The first thing is called same origin policy. It's probably the most important part of the browser security model. So an origin has three parts. You have a protocol, which is HTTP, HTTPS. You have a domain, which is something that example.net. And then finally, you have a port, which is optional. If you don't include the port, the default port is used. Some browsers, for example, Internet Explorer, don't care about the port in your origin. Pat is almost always ignored. Usually, one origin cannot talk to a different origin and grab resources and read them. So for example, if you open example.net, sends a request to facebook.com and grab some data. Browser doesn't let example.net read the response, absent some other things, or cores, but we're not going to talk about cores today. And that's a really good thing, because otherwise, example.net would have all my Facebook data. So reads are usually not okay, but writes are. So if I open example.net and sends a post request to Facebook to change something, if there's no C-surf protection, it goes through, as a result, C-surf exists, which is not really so great for us. So the SOP protects us in some cases, but not in every case. But SOP also has this problem that just because the browser doesn't let you see the response to the request, doesn't mean the request is not sent. So browser sends simple requests. Simple request is a request that has some requirements. The HTTP verb can only be get, head, and post. It cannot have any custom headers. And it cannot have every header, only some headers are allowed. And of those headers, the most important one is content type. The content time for those headers can only be one of those. So one of the tricks that we usually use when bypassing this, if you have an application slash JSON request, you change the content type to text slash plain, see if it becomes a simple request and goes through it.  And that brings us to our first bug. This is a bug by Tavis Romandi from 2016.  He's part of the Google Project Zero. He installs Trend Micro antivirus. That antivirus has a password manager. So the way password managers usually work is that you have an extension in the browser, and you have a local web server, a web socket server. The local server is responsible for storing the passwords, updating, and a bunch of those. The extension in the browser, for example, you go to Facebook.com. The extension in the browser talks to the web server and says, gimme my username and password for Facebook.com. And the web server gives it to it. And then the extension fills up the username and password. In the case of Trend Micro, the local web server was unauthenticated, and you could basically do remote code execution with a simple regress request, as you can see on this slide. You could say, OK, run this URL in the default browser, which in this case opens up the calc, runs the calc manually instead of opening it in the browser. If you go and read the bug from the URL, from the link on this slide, you can see that Taviso says, yeah, we can see the response. But the get request goes through because it's a simple get request. So damage is already done. We can see the response, but who cares about that? Another thing that is used for local IPC are web sockets. A web socket is different from your typical HTTP request. In a typical HTTP request, you create a connection to a server.  In a web socket, you create a web socket, and you keep it alive. You can write to it. You can read from it. It's great for real-time data thing, real-time data updates, like chats, video games, and stock trackers, I guess. But the web socket doesn't come out of the blue. It comes, it starts with a get request. That is a normal handshake. So the get request is your typical get request with some special headers. Now remember, the get request for a web socket is a simple request. So it always goes through. On the response side, the other side basically says, here are the things I agreed on. You can, yes, we can make a connection. Here's a protocol. One mistake that developers usually make is that they think that sec web socket key in the request and the web socket accept key in the response are based on security. They're not. You can usually put something, anything in there, and it usually goes through. It doesn't really matter. That's not a security control. So don't care about that. It's always there. It goes through. Doesn't really matter. And if you can see the response, you can see that there's nothing really needed there apart from how we can make a connection. And as a result, the browsers are not bound by the same origin policy. Because there's nothing in the response that the browser doesn't already know. So if you send a get request and there's no cores, you can see the response, but the browser makes a connection for you anyway. So if you have a local web socket server, everyone can connect to it and talk to it. We can't rely on SOP or cores or whatever, any of that. And that brings us to our second Abysso bug. As I said, this guy is smart. This is from 2018. And he wanted to rebind his mouse key. It was a Logitech mouse, so he installs an app called Logitech Options. Logitech Options runs a local web socket servers on point 10,134. As I said, web sockets are not bound by the SOP. And the web socket server didn't have any checks. The only authentication it had was when you sent a message to it. You had to provide a process ID of a process that the user owns. A process ID are like three, four, or five-digit numbers. And you can brute-force them quite easily in a few minutes until you find one that works for you. Fortunately for Logitech Options, he couldn't get remote code execution. You could create crashes. So imagine you have this app running on your machine. It's always running because you have a Logitech mouse. You go to a website, and the app crashes. You go to the other website, you have crashes. That's not really useful. And that makes our experience really bad. On the plus side, he couldn't get remote code execution, so that's really great. The next situation of the app, similar app called Logitech Hub, it runs two local web socket servers on port 9010 and 9100. Now, this iteration checks the origin header, which is really great. The origin header is a forbidden header, which means the JavaScript in the app cannot set it. Only the browser can. There are other forbidden headers, like the host header, for example. And the origin header is always set by the browser for every cross-origin request. So request goes from one origin to a different origin. Browser sets the origin header to tell the server on the other side where this request comes from. So what Logitech Hub does in the web socket servers is if you send a request with an origin that is not part of their allow list, then they just say, we can't connect. And when the browser sees a response like this, which is not a 200 OK response, it says, well, I can't create a web socket connection. So websites cannot talk to Logitech Hub web sockets, so this is a great thing, and this is a good thing that Logitech has done. We've talked about local web servers, local web socket servers, but we also want to talk about how frameworks can help us get remote code execution. And I'm going to talk about one of them, which is called Electron. Electron is probably the most popular desktop application framework out there. It is based on Chromium. Chromium is the open source version. I'm sorry, the open source base for a bunch of browsers that Google Chrome and Microsoft Edge. So everything in an Electron app is a browser window. So if you open Visual Studio Code, you're looking at a browser window. Yeah, I know. It's silly like that. And Electron is very popular. As you can see these apps on this, there are so many of these apps and these apps that you see on the slide, you probably have at least one of them on your machine, none of Slack or Discord or Visual Studio Coders or Skype or whatever. The problem with Electron apps is that if you get across that scripting, it might lead to remote code execution. So in an Electron app, you can write Node.js code that is run in the browser and can do stuff. The way for this Node.js code to run is if you want this Node.js code to run, so you flip a switch. The switch is called Node integration, which is set, which is off by default for a good reason. So if you set it to true, the JavaScript in your browser window in the Electron app can now talk to the Node.js APIs and for example, spawn processes on your machine. And as a result, if you have this switch set to true and you get cross-site scripting, now you have remote code execution, which is really bad. If you have an open redirect, which means that you can click on a link and the browser goes to a different link or you can do something like that. You can embed remote code execution payloads on your website that you control and then you have remote code execution on someone's machine through an Electron app. This is set by default set to off. And as we saw, it's great for a good reason. Now I'm going to talk about one of my own bugs. It's a remote code execution in a tag surface analyzer, which is an open-source Microsoft application. And we're going to talk about version two of it because it has two versions. When the version second version was released, our CISO, who was one of the people who created the original lab, said, oh, I created and I worked on the original lab and I went and looked at and see what kind of app it is. And it's a very useful app for desktop security research. What you can do is you can create runs, which are basically snapshots.  And now you can compare these two. And you can see like what files were added, what registry keys were added if there were any open ports, if there were any new window services. So again, it's very useful for this kind of security research. It comes in two flavors. There's a command line interface and there's a GUI. I usually want to run this admin. In fact, if you don't run it as admin, it basically tells you you're not running an admin. You should be running as admin because if you're not running an admin, you can't see everything that happens in the computer. You can't see what the application does. You can't get the big picture. It's open source. The GUI is based on electron.net, which is again another open source project, which is basically electron, but for dot net, which is, I mean, it works, right? So after I created, I'm sorry, after I installed the app and ran it for the first time, I saw this pop-up. And this is a Windows firewall pop-up that says, oh, this app wants to listen on all interface and open ports in the firewall. And I was wondering why would a local application or a tax service analyzer want to do that? So I looked at the console logs for the app and I saw that here. It is listening on all interfaces, 0, 0, 0, 0 and port 8001. That's not really great. So I started to dig further. I mean, this was the cue to tell me that there might be something wrong with this application. So I go to port 8001 on my own, I'm sorry, on the machine that is running the tax service analyzer app and I see the GUI. So the way the app works is it has an electron front-end and a web server in the back. Electron front-end which opens this website similar to what is in the browser as we can see and it does the rest, which is I guess normal for electron applications. The next thing I did, I tried to connect to it from outside because it's opening the ports and listening on all interfaces, I might be able to talk to it. So this is from the virtual machine host. I went to the virtual machine on 8001 and it didn't work. I saw this error that says invalid hosting. So I was looking at it, what is wrong with that? I went and saw it's because the web server that is serving content is a Kestrel web server, which is an ASP.NET web server, I'm sorry, a web server written in ASP.NET. It has a host header filtering. So when you see the request, it looks at the host header, if it's not local host, it says, I can't do it, but here's the thing because we're connecting from outside. I mean, you're not bound by being in a browser on the machine, I can change the host header because I can create a tool that talks to this and changes the host header. To do this, to simulate this, I changed, I added a match replace ruling verb that whenever it saw the host header, it would replace it with local host and that means I would be able to connect to it. And next, so this is me connecting to the app from outside and doing cross-out scripting. The next thing I did is I wanted to check if there was a way that I can do inject drawer script because I wanna get remote code execution. Fortunately, the app only has one place to do user input and that's the name of the run or snapshot. Again, fortunately for me, it was vulnerable to your vanilla script alert one script, Java script. So when you start a run, you type the name of the run with script alert one script and then you start it at the bottom of the picture, you can see what it says status report for dot that the place before dot is where the script was injected and the alert pops up. So this is the in the web application from outside but I want to run JavaScript code on the electron app inside and I got really lucky because when you go to the, when you go to the electron GUI inside the app and someone has already started a run from outside, the alert pops up, which is really interesting and really useful for us because I can start a run from outside and I can get a pop-up on a user inside. And the way to create a run is a simple get request. And as you can see, it's a simple request. So it's always goes through, which is really great again for me. So I started looking at it and I was like, okay, so what can I do? How can I use this? So I created a payload and a proof of concept. I'll start the electron app in the virtual machine and I go through it from the virtual machine host from outside, I'll start a new run, I paste the payload that pops calc, which is again a simple get request. Now the run is completed. I go to the electron app and I click on scan and the calc pops up, which is the payload that I injected into it. And now remember, at XFS Analyzer was running as admin, that means someone from outside could connect to your machine and get remote code execution. Nice, right? So I reported it to Microsoft, I did responsible disclosure, they fixed it and then I did a write up after they said something is fixed and it gained a little bit of traction. But what happened is Taviso replied to the tweet and said, I hope they actually fixed the injection point and not just the synodinal interfaces because the browser can connect to it. And I was thinking and said, yeah, that's exactly it. So I created a web page that sends this get request, which is basically a way to pop calc in Node.js. And I want to do another proof of concept and see what is up. So I created a web page with that payload and then open the web page in the browser on the virtual machine to the right you have the browser, to the left you have the electron, gooey. I open it and the browser says, oh, I can't see the response because there's no cores. It doesn't really matter, does it? The get request is already go through, the damage is done, the run has been started. Now you click on the electron up and go to scan and calc pops up, yay. So if the injection had been fixed and only the webbing, I'm sorry, the listening on all interfaces had been fixed, then we would have had a problem. Imagine you're running a tax surface analyzer on the machine, we're buying it as admin, you open the website and the website runs code on your machine, literally jumping the browser sandbox and getting that to your machine. So really fun, one of the funnest bug I have found. Unfortunately, I found a different bug that was much better than this. Unfortunately, it hasn't been disclosed yet, so I cannot talk about it today, but life is full of disappointments anyway, so that's one on top of the other ones. As a product security engineer, I drew a lot of remediation. We have talked a lot about bugs and pointing at things and says, this is bad, this is bad and this is bad. But half of my job is talking to developers and telling them how to fix things. Or better yet, how we can eliminate an entire class of bugs together. This picture is from a YouTube video from a game design college ad, this is pretty old. So these two guys are playing video games and the boss comes in and says, have you guys finished this game? I need another video game designed. This guy says, we just finished level three, so we need to tighten up the graphics a little bit. Every time, I don't know for some reason, I love it. Every time someone asks me what I do at my job, I tell them that I write how to tighten up the graphics a little bit of level three. So it's a great thing. It's from a Westwood college, which has nothing to do with the Westwood studios who made the Command and Conqueror applications. I'm sorry, Command and Conqueror Games, which are now part of EA. So what can help us? Our most trustworthy friend in this case is a browser. Talked about how the browser doesn't help us, but the browsers can help us through the Origin header. So Origin header is set by the browsers on every cross-origin request. Example.net to Facebook.com, you have an Origin header. Example.net to Example.net, don't have an Origin header. It's a forbidden header, so JavaScript in the browsers cannot change it. So if you're a local web server, you see a request that comes in. You do not process the request before checking the Origin header. You have an allow list of headers that are good. You check. If it works, then you get to let the request goes through. Do not rely on same Origin policy.  Do not learn cross-origin resource sharing. We don't need to see the response. We sent a get request we got remote code execution. Check the Origin header before processing the request. Same thing can help us with web sockets. Again, with web sockets, they're not banned by the same Origin policy, but the handshake was a get request. So when you see a handshake in your web socket server, you do not process it, you do not respond. You check the Origin header. If it's something that you want, then you send a correct response. If it's not, do something like what Logitech hopped it, return a four or three, four or four or whatever. Anything that tells the browser that this request was not successful. That means a web socket is not gonna get created. One thing that I've seen developers do that is not useful is checking the remote address that's coming, that where the request is coming from. This works to some extent. If you have something listening alone interfaces and don't want local address, you only want local addresses, but that's not useful in browsers because if a request is coming from your browser, the browser is running on your machine. The request is running in the, JavaScript is running in the browser. And as a result, the remote address of the request coming from the browser from a website, example.net, is actually localhost because the browser is running on your machine. That's really useful. Don't do that. I know it took a little bit of time to wrap my head around this, but I finally got it. It's a simple check. So check the origin header. With Electron, there's a lot of advice, but I'm gonna give you some generic XSS advice. Don't trust user input because you don't want XSS. But more importantly, in order to eliminate an entire class of bugs, you set node integration to false, which is off by default. Don't set it to true if you don't absolutely need it. A lot of developers set it to true because the Electron app needs to run Node.js code in the back, in the back. And I don't really blame them because it's very convenient. What you can do is you can run your Node.js code in preload. So preload is a script that gets loaded in the browser window before everything else. Even if you have set Node integration to false, JavaScript in the preload has access to the Node.js API. So that means that you can run your own Node code and you can't have Node integration set to false. Even if you have XSS in this case, you have XSS, which is really not great, but on the plus side, you won't have remote code execution. But click on the link in the Electron.js website. They have a lot of useful information on how to prevent these attacks, on how to do things properly. If you use a local web server to serve content to an Electron app, enable, disable cores. So if you have a local web server, so there was this app I was looking at, third-party app, and it was running a local web server system that had a front-end Electron. They had enabled cores on the web server. So basically access control allow origin was star, which is not really great because that means any browser could talk to the web server and grab the results. There was no sort of checking the path. So any website could read all files on your machine and the server was running a system which means that they could read everything. And that's not really great. That's not something you want to want to do. So disabled cores, that means you are not leaking information to websites when they talk to it.  So this is crypto. He's a hacker character in Apex Legends, the video game. Crypto doesn't need to be in an internet cafe somewhere and directly connected to a machine to be an important hacker, a hacker machine. If you have one of these servers on your machine and you go to a website where crypto controls or if crypto has injected JavaScript into and he might get remote code execution on your machine. And as a result, he's now listening to what you are saying on the machine, listening to your Discord conversation, so on and so forth. So don't do that. If you have a local server, think browsers can connect to it and add them to a threat model, have your proper checks. As I said, checks are really simple. We can defeat it, it would be fine. So I've talked a lot about how to find things, how to fix things, but your next question is how do we get started in this niche? Practice is the best thing.  Start poking at those servers, look at the cores, look at the APIs they expose. The peripheral utility apps are really great candidates. So if you have a mouse that comes with a utility to control it, they are usually good candidates. Or you can go to that link on the Electron.js website which has all the Electron apps. Electron apps are usually to have the same thing. If we want to learn more about hacking Electron, there is a GitHub repository with a bunch of links, a lot of thought of useful information, a lot of great research, a lot of great bugs. And last but not least, read Taviso bugs. The awesome bug that I told you about that hasn't been this close, it was two Taviso bugs mixed together. So I combined two of them and it worked. So that was great. And finally, thanks for giving me your time because this is recorded, so I can't answer your questions on the fly in this presentation. What's gonna happen is I'm gonna be on the Discord and I will answer your questions there and then. To find more about me or if you wanna ask questions, you can contact me on those social media links, Twitter or my website or on GitHub. If you have any questions, I'll be happy to answer. Again, thanks for listening to my presentation and giving me your time. And fingers crossed, 2020 won't get worse than this. We can get through this. Have a great day.