Okay, thank you all for this wonderful week that you have given us, as we start our week with this lesson which is about to understand everything that you want us to know. Thank you, David, thank you for leaving us. Thank you, David, thank you for leaving us. And welcome to think some first join later. So thank you for joining in. We will pick up from where we left. I think we have completed one chapter four in the last class and the way John writes it's a little. What do I say? You know, the way Paul writes, you have a continuity in what he's saying but John seems to be a possible John seems to be somebody who had some themes in his heart. And he wanted to make sure that they are communicated to the people. So he touches on the team. He talks about something else and it kind of comes back to the same team every now and then.  So we must be pure, you know, God is holy so we must be holy. So who God is because of who he is we can. Okay, so that seems to be something common in what John is sharing. And then you see that there is an emphasis on living the life, not just talking the talk. Okay, talking the talk is important. And for believers for us to claim that we are believers and what has happened to us in Christ Jesus. Yes, that's very, very important because that is a spiritual reality. But the positional truth while that is, that is there, the life has to testify. The life has to demonstrate that there has been a change that has taken place positionally in the life of a believer. So that spiritual reality has to become a natural reality also. So you find that John is addressing lifestyle issues and it's a very, very important thing because for us as believers sometimes we can just focus on the spiritual. Okay, I'm praying and reading the Bible and doing all these things which is great, which is also supposed to bring in that life transformation. But if there is a disconnect between the spiritual reality and the kind of life that the believer lives, you know, that's very dangerous. And you find John reminding often, you know, walk in love, walk in truth. Okay, so the life of a believer must be an example. And that is what he say. So apart from that, you find that John is talking about the relationship with God, okay, which believer must maintain. So we saw we must abide with God, we must fellowship with God, we must fellowship with the God there. And so you have the Father, the Son, the Holy Spirit with whom we have that unbroken, in sync connection as a believer. And that is a privilege which we have. So, you know, that fellowship is something that a believer needs to maintain and he needs to recognize. And of course, because of that kind of a connection, there is a flow of that life happening through the believer. Okay, so we've seen these are the kind of themes that are going on. And okay, just to add to that, so the upward connection is one thing. So he talks about us being connected really well connected to God at all times. But at the same time, he talks about the horizontal connection where we are relating to people. And we saw, I think last week only we saw this truth that he says, look, if you say that you love God, but you don't love your own brother. You know, how are you demonstrating that love of God in and through you? So, most of what we see here is about the love of God, understanding God's love for us. And then revealing that love and releasing that love through our lives. So, in many ways you can say, you know, for some of us we may feel, oh, God is love, love, love. You know, he's talking about very philosophical things. Oh, what manner of love the father has, you know, showered up bestowed on us that we should be called the children of God. So, it may sound very philosophical, it may sound very, you know, out of the normal practical life. But there is a connection with John is trying to make and say that, look, this is the reality. And if we have accepted that spiritual reality and if it is working in us, real life, practical life will be a response to that. But if the everyday life is not the testimony to these spiritual truths, there is a disconnect. Okay, so our connection with God is something we can boast about. But when our connection with people is not proving that, that's not good. So, he has words of encouragement here and there. You know, you've understood, you've seen, he talks about one subject and then he kind of comes back to the same subject in a couple of, you know, a few breaths here and there.  So, that's the style in which John is writing. So, I hope you don't get confused because it's just a manner of a style of writing which John has. If you compare it with other styles, maybe, you know, maybe Paul, who very theme by theme, issue by issue, he takes up matters in that way. Of course, we know the background, right? Paul was trained by Gamaliel and he's a very well-learned man and therefore his style of writing is very different. But in John's case, you know, he's trying to hit the same key points time and again so that the believer will not forget. And there's a lot of repetition. Another repetition was about us living victoriously. Cretus was in me that he, that is in the world, right? So, that is also something we saw, that he wants the believer to live a victorious life. And there is a mention of, you know, the Antichrist, the spirit of the Antichrist to be careful about false prophets, to test all spirits. So, there is an encouragement to live right, to abide with God and also abide with people in a good manner. And at the same time, there is a warning. You can say that there is a warning. What warning? Warning to identify the wrong spirit and not to give it to the wrong spirit. So, this is kind of what we have seen so far. So, we will now look at chapter 5 and then we will be in a better position to move on to the next book that John wrote. So, beginning from verse 1 of John 5, you know, once again, he uses here the term, born of God. So, he says, anyone who is born of God, whoever believes in Jesus Christ is born of God and everyone who loves him, who begot, also loves him, who is begotten of him. So, you know, the theme of the Trinity also runs commonly through what John is writing. Once again, he says that anyone who believes in Jesus Christ. Now, remember, in the previous chapter, we saw he was warning us about the spirit of the Antichrist. And, you know, he said that when we don't confess, because the spirit of the Antichrist will not confess Jesus as Lord. But opposite to that, he say, when we confess, Jesus is the Christ. Jesus is the Christ meaning Jesus is the Anointed One. Jesus is the Messiah. So, when that confession is made, whoever believes that Jesus is the Messiah, obviously they are born again. Remember, we referred earlier also to what John wrote in the book of John, John 1-12. We know that anyone, if you believe in the Lord Jesus, you become a child of God. You believe in him, you receive him, you become a child of God. So, again, he is saying the same thing. This is about the born again experience. So, when you believe in Jesus as what? As the Christ, then you are born again. So, born of God is what? Nothing but born again. And obviously, Jesus explained this in John 3 and said that this is the work of the spirit. This does not mean that a man, you know, gets into his mother's womb and has to be born again. No, but it is a spiritual birth that takes place as a work of the spirit. When somebody accepts the Lord Jesus as his personal savior. And he says, once again, the emphasis here is about the love and fellowship with the Godhead. So, he says, when everyone who loves him, okay, him who we got is the Father. So, one person of the Godhead. So, if you say that you love the Father, then this person who is born again, who believes in Jesus, must also loves him, who is begotten of him. So, that word begotten, that is born. So, here there are two born. One is the human beings who accept Christ as their personal savior, who are born of God. But begotten refers to the Lord Jesus Christ. Now, we know that there is only begotten Son of the Father, which is the Lord Jesus Christ. So, he said, if you say that you love God, then you must also love the Son. And that is the emphasis there. He says, by this we know that we love the children of God, then we love God and keep his commandments. So, you see, his way of communicating is a little overlapping here and there. So, he says, by this we know that we love the children of God. Again, he has already made the point that we must love people as well. He has already made that point. Now, he said, you should love the Father. If you are born again, you should love the Father. You should love the Son. Now, he is adding here, you must love the people of God. Children of God is who? The people of God. Or in the terms of the apostles, when you read John writing or Peter writing, they use the term brethren. Or the people who are in the family of God, who are all born again. So, he says, by this we know that we love the children of God when we love God. So, he has earlier said that in the other way, when he said that if you say you love God, you should love the people. And now, he is bringing it in, basically rubbing it in. How sometimes you just rub it right when you are cooking the salt, you put it in and you just rub it inside. So, it is kind of like that. He is saying, look, if you say you love God, you should love the people. And since when you love the people, you love God. So, do not miss the point this way or that way. And he moves on to say that we must keep his commandments. So, the action is always translating into something practical. So, he says, if you love God, then God is, you know God. If you love people, you know God. Because you are showing that love, you are releasing that love to the people. And now, in this case, he says keep his commandments. So, isn't it unfortunate if believers, right? We as believers, we say, hey, I love God. But we don't keep his commandments. Now, you might refer to the 10 commandments and say, oh, I'm keeping all the commandments.   So, basically, he sums up everything within that.  When you say commandments under the New Covenant to live for God completely. That's what is required of us. That is important for us to live the life. So, without us wanting to live the life, if we claim that we are born again, if we claim that we love God, if we claim that we love people. You know, it's, I don't know what to say, but it's very sad, right? That we're not, basically, it means that we're not working in God's ways. And yet we claim that we love God, that we love his people. Okay. And we find in the writings of Paul, he addresses very specifically certain issues. And he says, look, there are the works of the flesh, right? There is strife among you, there is division among you. There is sexual immorality among you. He points out, okay, these, these, these things are there. And again, you know, he points out, and he says that when you do all these things, such people will not, fornicators, adulterers, right? Sodomites, he lists out, and he says such people will not inherit the kingdom of God. And, and he says, it's so sad that these things have to be named among you, right? So, basically, believers not living like believers.  And you find the apostles addressing that issue in different ways. In the case of John, he just puts it this way. He says, when we say that we love God, you know, we must keep his commandments. For this is the love of God that we keep his commandments. And his commandments are not burdensome. So, again, like you would look at this in this way. When we love God and keep his commandments, he says. So, you know, it is understood, right? Like if you have a child and you think that the child is wanting to make the parents proud or the child is obedient or the child understands the perspective of the parents. You will know that, you know, the child is doing his or her best to study well in school and not to do, not to get into the wrong things, right? Because when they love their parents, they want to listen to what the parents have to say. And similarly, you know, we as children of God, when God has spoken his word and he has given us certain boundaries and commandments, then the natural response when we say, okay, I love God, it should be to obey the commandments and to basically walk in his ways. Remember, we said, as he was, so we are in this world. So, the way Jesus was, we want to walk pure, we want to walk holy, we want to demonstrate the power of the Spirit, live righteous, be just and all of that. So, when we say we love God, we must keep his commandments and he adds here. He says, his commandments are not burdensome, okay? His commandments are not burdensome. Now, when it comes to loving, okay? Ask a mother who has had a baby, right? She could have had her first baby and before, excuse me, having that baby, she was not the kind who had a lot of energy to take care of the child. But once the child is born, I mean, in general, you find, right? Not just mothers, even fathers, you just find them going the extra mile, letting go of their sleep or making additional things because the baby is not eating this or eating that. They need to cook up other, you know, cook different, you know, whatever it takes to feed that child and, you know, then the baby grows, but you see them investing into that child and you might want to ask the parents, doesn't it feel tiring to take care of this baby? Would you rather just rest it out, right? And not want to take care of the baby, but they will tell you that they are serving tirelessly because they love that child, okay? So the parents, they can make any effort to go to any extent because they love the child. So when there is love, right? Our labour doesn't seem much. A tide will just fly away, isn't it? So we are ready to do something for the ones we love. So, you know, if you are ready to do whatever it takes, take care of the family, be there for the spouse or similarly if you are taking care of our parents, maybe sick elderly parents and you feel like how can this be done? There is love involved. And it's not that, I mean, for the onlooker, it may seem very difficult. How is this person doing so much? You know, they are not getting tired of taking care of their loved one. But you know what? It works like that. When there is love, it's not physically, we may feel tired, but overall it's not exhausting us. That's what it means. So his commandments are not burdensome. When we love him, we keep his commandments. And his commandments are not burdensome. So we don't feel that God is weighing us down with the law. And more so in the new covenant, because remember Jeremiah prophesied in the book of Jeremiah, we read this under the new covenant. We are told that God will write the law on the hearts of the people. And in the new covenant, we know that Jesus said that he has not come to burden us. He has come to reinforce the law, but in a different way. And in the new covenant, the beauty of it is we have the Holy Spirit. We are inspired. Greater is he that is in you than he that is in the world. So we carry that conquering spirit. So when the commandments are given to us, it's easier to actually walk in them, be obedient and be victorious. I don't know how many of you heard Pastor Sermon yesterday, but it was about this law of the Spirit. This law of the Spirit, when the law of the Spirit is at work in us, we are overcomeers, we are victorious, we are triumphant. And that is why John says, look, we love God. So we keep his commandments and his commandments are non burdensome. Additionally, in the new covenant, we have the empowering work of the Holy Spirit in us. So all the more a believer, you know, it's like trying to convince the believer, live victorious. But the reality is that the believer is already victorious. You know, it's amazing. It's amazing that the apostles have to do this. But what they want the believer to do is renew their minds that look, this is what God has done for us. He has already given us everything we need for a victorious life. And we can be victorious. Now moving forward, he says, whatever is born of God overcomes the world. It's the same thing that I'm saying that we are victorious. Let's renew our minds to that. We are victorious over everything. We are victorious over sin. We are victorious over Satan. We are victorious over sickness. We are victorious over death because we are born of God or we are born again. And he says whatever is born, meaning every believer, any believer is victorious and can overcome the world. So, you know, when you see the world out there, there can be different challenges. And we've seen that in 1 John chapter 2, where he talks about the temptations that this world throws at us. But for a believer, it's just a question of overcoming anything that comes this way. So wherever we are positioned, the families, certain things are happening, we can overcome. In the workplace, certain things are happening, we can overcome. In the environment around us, certain things are happening, we can overcome because it's so clear here. Whatever is born of God overcomes the world. And this is the victory that has overcome the world. What is it? Our faith. Okay. So just now I talked about the love and I said, hey, when there's love, everything is possible. So when we love God, we will know how or rather we will be willing to make every effort to live according to His commandments. Now, if you go back to 1 Corinthians chapter 30, where these three things remain, faith, hope, love. And John seems to be speaking of that in his book here. Love, he has mentioned. Another aspect that he's shown here is the faith aspect. And he's saying, see we can overcome the world. But you know what element is necessary for us to overcome the world? Faith. Okay. Faith, when we become born again, the Bible talks about saving faith. We need at least that much faith to be saved. So anybody who's born again, they are born again only by faith. They had that saving faith to be able to come into the kingdom of God. Now in addition to that, in addition to that, they can carry faith for very many things in life. And faith, you know, it's an entire subject here in our Bible college. It's a full course. So there is so much to talk about faith. But when we live by faith, what is the benefit of that? We overcome the world. Right? So at any given point, you know, we will be standing at a place in our lives where we think, hey, I have nothing. Everything is gone or I feel like there is a loss that I'm experiencing. But as you look ahead, you know, if you have faith, the path ahead of us will begin to open up. Because where there is faith, we can overcome. But if there is no faith, even if you have all the resources without faith, it is impossible to please God. So what is God looking for? God is looking for faith in us. And when there is faith, you know, that becomes the source of a victorious life. So think about this. God has already done everything we need for us to be victorious. And he's calling us to just walk by faith and we can overcome the world. Who is he who overcomes the world? But he who believes that Jesus is the Son of God. So again, he goes back to that spirit of God. Remember, we said the Antichrist will say that, you know, Jesus is not the Christ. And we saw one of the beliefs that was there during John's time, where there were Gnostics who said that Jesus was not man. But John addressed it in the last chapter. And he said, no, he is very much a human being because it's only when we know that Jesus was fully man and fully God that we are able to establish that he is the Christ. And when we confess that he is the Christ, you know, we can only confess that by the Holy Spirit. Now, he's moving on to kind of bring in a slightly different subject here. So he starts talking about Jesus. Okay. Earlier, a few verses earlier, he said that a believer must love the Father, but the believer must also love the Son. Okay. Now, he is talking about the Son here. And he says he who came by water and blood. Okay. So he who came by water and blood, there are many ways of looking at the meaning of that. So some people say many who came by water and blood, would it mean that Jesus was baptized in the water and Jesus shed his blood on the cross? But it says like he who came by water and blood. So the most accepted meaning of this is that Jesus was human. Okay. Jesus was human. So again, remember in the earlier passage, he addressed that issue that Jesus was human. Again, he's saying he who came by water and blood Jesus Christ. And he says, not only by water, but by water and blood. He's reiterating that Jesus came in the flesh. And he says it is the spirit who bears witness, the spirit of truth. And he says that the Holy Spirit is the one who bears witness about Jesus. And he's the spirit of truth. Now these words, you could take it straight off with Jesus's mouth. In John chapter 14 and John chapter 15, John himself, he writes about this. When Jesus said, you know, the spirit of truth will come. He will glorify me. He will take off what is mine. And he will, you know, give it to you. So he's describing the primary task of the Holy Spirit. And he's saying the Spirit, what does he do? He bears witness. That's what Jesus is Christ and that he's the spirit of truth. And we are quite clear about that. Now, he also says there are three that bear witness in heaven, the Father, the Word and the Holy Spirit. And these three are one. So he throws in a subject on the Trinity over here. And it seems a little confusing because he says there are three that bear witness in heaven. And there has been a lot of, like, you know, study on that. Why does he say there are three in heaven? However, in the Greek, apparently, it does not really say that there are three in heaven. So that term heaven, you know, seems to be an addition in the later translations. So a more accurate way of reading this scripture from the original Greek would be for there are three that bear witness. So not to get drawn into that heaven, which is mentioned over there, but there are three that bear witness. And I think that is plain to understand the spirit. I'm sorry. There are three that bear witness. Yeah, there's witness. The Father, the Word and the Holy Spirit. Okay, that's the Trinity. The Word is nothing but Jesus. And there are three that bear witness on the earth, the spirit, the water and the blood. And these three agree as one. Okay. So yeah, so we do understand that it's all basically testifying, testifying together. In the first context here, Father, the Son and the Holy Spirit, we know that is the harmony, the unity, the love and the fellowship of the Godhead. And they all agree. They are in agreement. So the Holy Spirit will not say something which is not in line with the Word of God. Okay. And Jesus never did something which he did not see the Father do. All right. So in that manner, they're all very much in agreement with one another. And we find here that the other three that bear witness is the spirit, which is the Holy Spirit, the water and the blood. Okay. So these three agree. Just a minute here. Okay. So the water and the blood simply has to do with the Lord Jesus again. Okay. And the Holy Spirit obviously is the witness of the Lord Jesus also. So we see the unity of all of the Godhead and the water and the blood of the witness that talk about the Lord Jesus. Okay. So any question on this or any doubts on this before we go further? That is clear, isn't it? Avokala, are you hearing me? Yes, ma'am. Yeah. So any doubts or any question? No. No questions? Okay. So then should I just move forward? Yes, ma'am. Okay. Fine. All right. Okay. Yeah. So we've seen the witness to the Christ. Now from verse nine. So if we receive the witness of men, he says the witness of God is greater. So why is he talking about the witness of the Godhead? Why is he talking about the witness of the spirit and the witness of the Lord Jesus himself? Because he says blood and water, right? Because he's trying to make a point about us receiving the witness of God above the witness of men. So now he's coming to that. He says if we receive the witness of men, the witness of God is greater. So we must listen to what God is saying and especially about Jesus Christ. The witness of God is greater. For this is the witness of God and she has testified of his son. So what witness is God giving? Or here when we see the term God, it generally refers to the Father. The Father is bearing witness to the Son. We just saw earlier in the previous verse that the Holy Spirit gives witness. Okay. But now the Father is giving witness to the Son. He who believes in the Son of God has the witness of himself.   That Jesus is the Christ. Jesus is the Redeemer. Jesus is the Savior. And you know, he's the one who has become that atoning sacrifice for us and we reject it, right? The rejection of Christ as the Christ. When we do that, what are we doing? He says, God is a greater witness. We are ready to believe the witness of man, but who's greater than anybody else in God? And then we reject the person that God is trying to reveal to us as the Christ.  Have you seen this earlier?  You search and tell me. Do you see this anywhere earlier in one John? That you made God a liar? Okay. Okay. I believe that as a homework for you. You just check it out. So in this case, if you don't believe the witness of God, that Jesus is the Son of God.  So because you're rejecting what God is confirming. Okay. And the testimony which God has given about his own son. Okay. And this is the testimony.  And where is this life? This life is in his son. Okay. So this eternal life or the God kind of life, the zoe life, it is in the sun.  Now those who are born again. This is again for us to rejoice in a truth which we can rejoice in. We are told that when we are born again, we have the sun in us. And meaning the life of the sun in us. He who has the sun has life flowing through him. And he who does not have the sun, he does not have life. So this is more about the spiritual life. Basically the spirit man we know from other passages of scripture that when somebody is not born again. What happens? They are spiritually dead. But when we are born again, we are awakened. Our spirit man comes alive and we are awakened to the spiritual realities that God has stored for us. And we are being told that when we have the sun, we have life. What kind of life is this? This is eternal life or it is the God kind of life. Which is flowing through us. And that is the beautiful testimony of the father. Because the sun is the Christ and we who accept the sun. So we have the life of God flowing through us. And so he says these things I believe in the name of the sun of God that you know. That you are having a moment. What is this energy that you know? You have accepted Christ.  And that you continue to believe in the name of the sun of God. So the believer must know in other words. See here it is just a mention about the life that we have eternal life. But overall he is saying we know the benefits. The spiritual truth, the spiritual realities of what has happened to us. Once we have received Christ Jesus and we know that we have become so many things in Christ Jesus. So when we know these things and we know that created is he that is in me that is in the world. And we know that you know anything that is whatever is born of God overcomes the world. It causes the believer to live a victorious life. Causes the believer to live a God kind of life here on the earth. And whatever John is saying about following the commandments about loving God, about loving people, about living the life. Everything is possible because of who we have become in Christ Jesus. So he is basically giving the assurance. The assurance of having a wonderful God kind of life in the believer because of the son of God. Now moving on. It says now this is the confidence that we have in him. And if we ask anything according to his will, he hears us. What a beautiful verse over here. First John 5.14. It says we have the confidence or we have the assurance. We don't have any doubts. When we ask God and we ask him according to his will. Because that kind of asking will give us a result. So the end of the verses he hears us. So it's about a believing prayer. When we believe and when we pray, what do we receive? We receive the answers from God. So a couple of things that he points out in this believing prayer. He says look, you already have a life of God flowing in you. And that is amazing in itself. Now let me add to that. If you are not happy enough, I will tell you what else is amazing about being in Christ. He says that we have been given the privilege to ask. And what to ask? He adds to it. He says anything according to his will. So what is the most effective way of praying to receive answers? What do you think? I think the answer is in the verse itself but I am just asking you. How to receive answers? If we ask anything, are you all with me? It's a simple answer. It's there in the verse. Okay, great. So when does God hear us? One is we should ask. If we don't ask then we can't expect any answers. But when we ask, how to ask? According to it well. Very good Alan. So this is a key to an effective prayer life. One is there should be a prayer life. Ask. If we don't pray, then how can we get an answer? But when we pray, how to pray? Pray according to the will of God. So when we ask anything according to his will, then what happens? He hears us. So that's what he's saying. Look, believer, you must be excited. You have the life of God flowing through you. Eternal life. He who has the sun has life. Now in addition to that, you can have confidence that even God answers your prayer. Wow, what a privilege, isn't it? What a privilege. So he's talking about victorious living. In every aspect, you can overcome the world. You can receive answers to prayer.  Now we have the life of the spirit flowing through us. And all of this makes for the believer to live a life of dominion, to live a life of authority against the evil one in this world. So what we'll do is, at this point, maybe I'll pause. If there's anything you want to add to it, any questions you have, you can discuss that, and then we will take a break, come back and move on to the following verses. So any thoughts right now, if not questions, anything that has touched you, you're thinking about it, you could just talk about that. I have a question. Oh yes. If God is not, yes, you told that we should pray according to will of God. We are praying according to will of God, but we're not getting answered in what to do. Okay. And when noting how to know, how to know, how to know that? Is the will of God. Yeah, what is it? Are we going according to will of God or not? Okay. So see Manu, it's quite clear how to find out if it's God's will or not. One is by the word. So whatever you're praying for, is it all right according to the word? So if the word says that yes, it's fine, then it is in the will of God. Okay. Now, more specifically, the witness of the Holy Spirit. So as you keep praying about something, which is in the, according to the will of God, according to the word of God, God can give us their witness in our spirit and confirm that okay, fine. This is what God wants for us. So the word will confirm and the spirit will confirm. And we just saw that the spirit, there's an agreement. They all agree. So the Holy Spirit will not try to compete with the word of God and go in a different direction. So that's what you have to make sure, but by the word and by the spirit, what you have, what you're praying for, that is very much accepted by God. So you know that, hey, it is in the will of God. Then sometimes when you pray in the will of God, I'm just giving you two reasons. There can be others also. I feel one is faith. So if we are struggling with having faith in prayer, then also we may not see answers to prayer. Okay. And the second thing is if we have faith and we are praying, for whatever reason that could be a delay, maybe it's not the appropriate time for something to happen. So we just have to trust and we just have to keep pressing in. Yeah. So two days. Okay, thank you. Is that fine, Manu? Yes, ma'am. Okay, sure, sure. All right. Okay, thanks. Good question there, Manu. On that note, let's go for a break and we will be back in about 10 minutes. So it's 9.51, back around, oh, 9.52. So 10.02, we'll be back. Thank you.


Going on everyone Sam here with late in sports cards been 10 box Tuesdays 10 box Museum of Chrome baseball makes number 188 random team style Here's a look again at your random results as always you find those on the website under the results tab as well as the link in chat So good luck everybody. Oh, let's get after it. Why not 13 to go and hoops that is an x-break We're gonna start off with a that's 10 bucks basket That wouldn't work because there's no there's no multi-sello Yeah start with bowman chrome mega Real quick Sizzling in a cell They're selling to Kale Martin or Cody whichever one of these I'm not sure I think it's Caleb right Think so yeah, yeah Fading the box from now on Yeah Who did you want to put on the two other oilers the oilers on the two days? It's gonna open up to write a book right now Yeah, open up hard rock nice Ethan solace nice one there for the Padres I don't work on the first Rainer Arias not bad so far.  Not cello, but choice exclusive pack. Congrats on that one There you go at Red Sox Kevin Aru and first of Raymond Mola. So first four first in a lot that will work On health to pay it off. That is as Waldo Osario pink of Luis Serna to 1.99 Hendry Chevilli and Brandon Maia That is that is true Vaughan. Yeah, true. I'll do finest flashbacks next box Oh finest flashbacks just average 20 and 10 on the heat Good company to be in for sure see the see an auto and out of this box. Why not some by Kyle talker Feel like you just try the all-time score against the heat. Do we use them? Up that's awesome. I'm gonna give me like 27 and 22 or something like that 20 20 is insane. No, they really do losing. I mean losing drew and drew his perimeter defense is tough for sure Silver of Vaughan Grissom on the uncommon.  No one Ryan finest franchises That's on that one there ranges ranges William Contreras Still 13 on hoops everybody to get that filled up. That is hunter green Will Benson finest intimidators. That's a number Devon 12. Ow, that's it. Oh, wow That is a kunya. I know Santiago sports. They pulled one yesterday. I forget who They pulled one last night Greenrod finest gamers Do you hear that too? Yeah ghost Bring it on you want breaks box out there as long as how my hockey says this three go through love Bubba shut nice one there Jayrod finest sterling on the refractor nice one there congrats to the Mariners Gonna get one refractor her box in finest flashbox That is a gold Riley green finest there and All right, nick eight with a 10 box football spot. Thanks nick appreciate you, buddy Um, I'll do 19 bowman chrome hobby next 19 bowman chrome hobby Yeah, hoops 12 or 13 to go on hoops almost in the single digits on that one, which is awesome Vidal Bruhan Aaron judge Arizona fall league or Arizona fall league alumni Aaron judge. All right, rookie First base auto quit and torus costa Congrats on that one there at brew crew Scorpion on his helmet Yeah, probably the uh scotch Oh, yeah Refractor to 499 Miguel heraldo on the first Vado and kinsler. That's a name red sock legend Ian kinsler Hans crouse keeper gris cano and otani second-year otanis That I suppose Juan Pablo Martinez dj stewart and my trout Yeah, I onto the second mini box now of some 19 bowman chrome hobby God jeremy with the eagles and donruss barry g with five in the select mixer. Thank you barry Alexandros with a hoop spot down to 12 and under 20 now on the select mixer. Thank you guys really appreciate that Thank you all. That's awesome 12 to go on hoops everyone Brave mitch hannigan first base auto patrick sandoval. I swung there for the angels grads of los angeles Slash hand on josh hater charlie blackman Chuck nasty purple shimmer is kyle moeller Pitalonzo rookie and fernando tatis junior rookie Uh, george soriano, awson cox mason. Patrick bailey. That's nasty logan al. I saw logan allen too I didn't see patrick bailey. That's a that's a big one. That might be the biggest one pulled yet so far bobby dullbeck rowdy telez and louis bootie us Jake bowers rookie and illoy rookie. Oh well, uh on to the next one Got barry g with two in ten box football We've got nicholas s with the giants on friday and hosé with a spot in ten box football alexandros with another spot in the mixer as well spots are flying in everybody Thank you all. Thank you all 12 to go on hoops breaking next 12 to go 12 to go Thank you. Kyle We're dropping that link much appreciate it. All right. We've got, uh 2023 chrome choice. We'll do that next 2023 bowman chrome victor is turris first base auto Nice one there. Congrats to the guardians. We've got a uh, nice one here. It's going to be a green lava to 99 brian rin cone for the fills What'd you say it's a kobo on your maggie She's thank you ryan p picking up a spot in gold standard Uh ryan g also with a spot in the select mixer and angerem with a spot in ten box football You guys are killing it right now. Thank you all out Incredible and javier valdez the 299 on the white speck a lot. Congrats on that one braids. That's one bravos Bravos, um, I will do 2020 bowman now 2020 bowman. Where's anthony at? Come on anthony It's your time time to shine We got a gold gold shimmer Grant little to 50. I just won there. Congrats on that. Uh, pondrace Very nice very nice Tend to go on hoops. Let's go man Thank you all Diaz and base Think the spots there mr. Alexandros with a ten box football Alexandros with a ten box basketball mad s with two two Spots in hoops. Aha hops. Ah, that wasn't me. Aha. That was pile Tend to go on hops basket. Oh, that's pretty funny. I didn't see nothing It's trey playing pickleball dude. Why don't you focus on basketball, bro? Hey chill, chill, chill Jeremy Pena if you want to play pickleball, we'll unplay pickleball It helps the agility helps the cuts and everything, you know helps the jump cuts You know how we you know how we do don't cease Uh, that is a jade arm first paper meaning there'll be a volt be right there. Yes, there is Uncle g coming in with five hoop spots. Let's go. Greg. We're down to five Five to go. Thank you. Greg appreciate your brother as always as always You are the man, uh set the beer to 125. Nice one for the d-backs and base Barley, jaren duran and josh young to 75 on the yellow Hops basketball. I love it. Five to go on hoops. Thank you. And thank you everybody Uh base auto mario feliciano. Nice one there for the brew crew.  Greg with two and gold standard. Thank you, Greg That's down to I believe it 16 to go now Yes, I am Greg talking to me and the heater selling again. What's up heater selling again back to selling We need that we need those. No, not plus What's up goblin? yo That is a Eric Rivera at a 499 refractor auto Rats on that Haha, what's up sin? What's up sin? paper We have like a 50 chance. It's usually sin at our force night. Yeah, sure bobby witt first paper for the royals bobby witt first chrome For the royals again Not very good D. Hi, may All I need to do is have them score it lovely Hell yeah, it's nice to be fun, man pack a 2020 bowman It's often so Alvaro sejas to you at 250 on the purple paper and boss more a Jason a with three spots and hoops. Thank you, Jason. Greg with another spot in each 10 bucks. Thank you, Greg And brand the nature of the spot in hoops and a spot in gold standard. So thank you guys. You guys are destroying it right now. Thanks be One to go. I think yeah one left in hoops. That's it. That's literally it With the Patriots, what'd you buy into sin? I'm 23 chrome hobby bowman chrome hobby for the definitive A or G's based off of John Perone Oh, or since gold mix gotcha gotcha gotcha gotcha gotcha. Yeah, he did uh, he did cover the name. I sort of though. Oh, yeah Yes, he did Randon cone nice one there on the Invicta Yeah, they are I I I saw your order like Like it was either one or two nights ago in Jose I saw it for uh for Yordi and I put it at the end for you. Yeah, I got you. I'll put whoever whatever name you put in Alphabetic order, uh Hunter brown to 190 as long as it's in the order note shouldn't be an issue because I know you're one of the 10 boxes So yeah, I got you. I got you. No worries Uh, Zach vene mean green vene machine Shema of Xavier Isaac Cheerio and Luciano I think you should honestly I think you really should Greg God, I would love that First base auto Davison Gutierrez. Nice one there for the mess base and base first failed miserably True green man Machado to 99 Nice one there Select mixer at 16. Very nice. Thank you all. That's awesome again 75 a spot three boxes select day two, which is kind of juice this year and um Three boxes select hobby he would it would make for some good content No, that's not how that goes. I don't know all these That's different. It is a little different. You got a little fancy. Maybe interesting Uh gold munitaka Murakami nice one there to 50. That'll be a random to all It's the guy from the show That's on that again. We'll random that one off at the end of the break. That's actually a pretty solid card I mean I'm Murakami coming out for the 10 box football spot. Thank you, Kevin Um, all right. We'll do chrome update hobby next Not the chrome updates now Dude, what are you doing? It's gonna be a long game Come on. It's gonna be a long game. Hell bro What is the meaning of this? I do not know Who's Gonzaga playing? Drexel? I guess it'd be Drexel. Oh boy We need Damian Liebeck. Yeah Regine with the last hoop spot. We're not sold out on hoops. Guys are nuts. Thank you all I made a strong move. Sold out on hoops. Thank you guys 16 to go on the select mixer now Drexel might put up a better fight. Oh boy. Who was I playing then? Oh, is it Florida State?  Uncle G effect is real man. It is real rep 80 That needs to be scientifically studied tovar cal state bakers field. Okay. Wow. That's not a good one Good lord. Riley green Yeah, I saw some really weird matchups today. There was one I never heard of the team. Yeah, oh hoppy It's like uncle Joe's or something dude Bob Jones really that's a school that that's bob jones christian university. Bob jones playing winter. They're down 40. Wow They didn't even have a money line on it That bob jones is known as like the strictest school in the country really yeah in terms of like In terms of like I was thinking of the uh here at hill Oh nice diamond dominance masataka Yoshida Congrats on that one. They're red socks and a green kasey schmitt to 99 Set of st. Joe's it's uncle Joe's Yeah, cal state bakers field. There we go join liles. That's a match. Oh, I probably bet on the bakers field before in the past Carlos Vargas the 399 Nice game versus like Portland state or something I'm in on the Vikings. No, it's Cleveland state like it's michael bush Uh, Joey Weimer bass auto nice one there for the brewers Yoshida Jake urban And bass all right. We'll do the jumbo now Riding with the zags tonight Probably not not a bad idea. Thank you. Jose picking up a 10 box basketball spot really 27 and a half I'm in on it lane. I'm in on it Update jumbo now What are we doing letting Kevin love What's this guy doing with this? What's game doing sitting out with nothing on? Looks like a I don't know. He's he was playing That's not good. You better keep playing Yeah Better get better shake it off and get back in there Jayrod j rod and ellie hernandez refractor rookie jones, dude joining walker bob evans Tusting that same thing Uh shintaro fuji nami nice one there to 499 for the orioles grab the baltimore urie perez refractor rookie gold garret michael to 50 nice one there for the brewers Jared shuster adley and nick fortez Uh, let's go urie perez Nice. Hell yeah, man. Congrats marlins On the let's go super short print Let's go Who's got miami jason a let's go jason. Congrats, man That's awesome super super short printed Prism of josh young max scherzer and brice myward stick Take that. Oh, absolutely. We'll take that base auto evan lee heavenly evan lee for the gnats a miller refractor rookie By somebody bro. He's calling them out. Who is urie?  I guess he's too strong riley green for that Uh titans of mookie justin steel all star game rookie mookie and robby grossman base auto nelson belasquez rookie for the Royals nice one there casey michael harris action stars and joey orteez refractor rookie Like zero cards in this Yeah, a couple of those Weird adley prism of corbin lanzo and matt mclean refractor rookie The redemption in this one was up I'm gonna make it up for the redemption in this one.  Let's go hawks There are plus four and a half I should hand her the next makes her like ten and a half point favorite, so bossing up 16 that happened quick. Yeah mind we just took the lead salesman dude salesman and jim on a stereo james paxton They might find their way onto the trash list before the night's even over posh bradley carlos rodan and joey wymer purple edward julian to 250 Nice one for the twins 2199 is gus varland for the brew crew Radiating rookies. No one gorman. Nice one there. Congrats to the cardinals miguel amaya youth quake Nice corbin carol bass auto that'll work take that all day. Congrats to the uh dvax jonathan l Nice one there, buddy that plays all day long And then blue bendeluzio to 150 on the true blue on card auto for the cardinals again Uh charlie p with a spot 10 box football. We've got marco t spot in 10 box basketball It's 10 box basketball. That's almost sold out. I believe might already be sold out. It's that uh, it's not just one to go One all right finish off with museum. Good luck everybody. See a case hit come out of one box I'm all sweet riley green for the tigers Austin riley josh young nice one there to 399 rookie jersey auto. Congrats to the rangers There you go. Texas tejas And uh vladdy g to uh 50 laddie jr. That is nice one there blue jays Redemption come on come on museum framed autograph silver parallel Of anthony rizzo nice one there for the yanks That'll work w riz on that one 15. I believe so. Yes now 15 Yep, nice one john k. Good stuff john On the rizzo. So we did hit a case hit out of this very nice Sean I'm cosplaying you today. Yeah, he's got the magic chain on Don't look like you John karlo stanton the 299 Ozzie smith and christian yellich gross patches on that one of 10 nice one milwaukie Two color two color three color two color. That's awesome, dude. That is so awesome. Very nice Now you look like sean we've got um Munitaka murakami nice one there on the gold Big fan of that card. That is so sweet man Sean All right, everybody gonna roll the dice whatever teams on top after nine times. We'll get the murakami one two three four five six seven eight and nine go to the cardinals congrats cardinals You got it. Thanks, sir. Very jealous of this murakami. He's a stud 30 of 50. All right Quick recap here everybody We've got christian yellich to 10 And vladimir guerrero junior autos. We had anthony rizzo corbin carol Nelson, alaskas evan lee joey wymer davison gudieres johnny perone marco feliciano victor is turris patrick sandoval Quentin torres costa chase meijer off fujinami eric revera a Javier valdez the 299 250 bendeluzio green and 99 brian rinco gold to 50 grant little And josh young to 399. I'm down. Sean abby on mobile and urie perez. Let's go nice one there super short print That'll do it for the break everybody. Thanks again for the fill up next is hoops


Hello, and welcome to the 3 o'clock Track 3 talk. You have one new opponent, hacking proprietary IACalendar properties by Eugene Lim. Before we begin, I have two announcements. Number one, please wear your masks while you're sitting in the room that they're still required. And number two, please don't sit around or stand around the edge of the room. Please come in and find a seat. Come on a little closer and check out the stock. Welcome, Eugene. Hi, everyone. Thank you so much for coming. I know it's day two of DEF CON, so you guys have survived.  So thank you very much for coming, and I'm really excited to speak today. I'll be talking about you have one new appointment, hacking proprietary IACalendar properties. And before I begin, I just want to give a quick introduction to myself. I'm Eugene, and I go by Spaceracoon Online. That's my Twitter handle, because someone has a Twitter handle for Spaceracoon. So if you are that guy, come up to me. We can work something out after this. You know, I can't pay much, but we'll figure something out. I work at the cybersecurity group at the government technology agency of Singapore. So I'm from Singapore. And what I do is mostly DevSecOps. I work on protecting citizen data and government systems and applications before they get out into the public. Yeah. So how many of you guys have gotten an appointment reminder in the last week or so? Maybe a ping, a mobile notification. Yeah, most of you guys do, because especially in the COVID, post-COVID, well, you know, we have a lot of calendars, invitations kind of floating around, reminding you to go for something or another. And you might be wondering what's going on behind the scenes, right? When you get an invitation and you have that little convenient button in Outlook that says accept the invitation or decline the invitation, what's happening, right? Or in your Apple calendar or your iOS device, you might also have that convenient button. So what really happens when you get an invitation and it pops up? And you might also wonder what happens if instead of just accepting an invitation or checking out an application, an invitation they've gotten, what happens if you started doing something strange, right? Your mobile phone starts having a few pop-ups. You might start a call. Something might be going on in the background. And you don't start the meeting, right? Instead, a shell or something might have started. So what really goes on behind the scenes when you have an invitation like that is that you have an email with an ICS attachment, which is the iCalendar attachment. And before we carry on, I just want to clarify, I think maybe a misconception some might have, is that iCalendar is not explicitly an Apple format because you might think iPhone, iPad. But the iCalendar format is actually the name for a standardized format defined by RSC. There's interoperable between various email and calendar clients from Microsoft Outlook to Google Calendar to Apple Calendar. And it's something I'm going to dive a bit more into because for those of you in red teams, you might be pretty familiar with using calendar invitations as a phishing deal. And that's something that a lot of people have done. But what I was more interested in was looking into exploit scenarios with the iCalendar format, ways that it could be used and abused, ways that passes can be broken to get an exploit out. And this was fairly fruitful research, even though I threw the net pretty wide. So this kind of covered a number of vulnerabilities from VMware Boxer to Synology Calendar, Apple Calendar, Microsoft Outlook, Google Calendar, and NextCloud Calendar. So if you look at the list of targets, it's actually a fairly broad range because it went from mobile to web to desktop to IoT devices. And this really shows you, even from a very brief survey that I did across every single client, I could get my hands on, I didn't really go too deep into one or another, that you can find a lot of interesting things. And this brought up a few interesting ideas. So we really have to begin, I think, about 24 years now, back in 1998, when the RFC 2445, which is the Internet Calendar Object Specification, was first published by two guys, Dawson from Lotus and also Stanerson from Microsoft. And what these guys came out with was basically a format for the iCalendar specification, which would define an event or calendar that could be shared between various office applications. And back in 1998, the context was that it was a huge office wars because all of these companies were coming out with their own office suites. They were creating their own specifications, their own way of doing things. And they're not all compatible with each other. But this is a terrible thing for the end user because it doesn't make sense if you as a user have an event and you're inviting someone, and it doesn't matter what kind of client they're using or what kind of application they're using, you want them to be able to accept, to invite, and attend it. But if you're all using different formats, that's not going to work out. So that's what these companies did. They came together, built a format, and they decided to use that as a standard operating format between each of them. And so that's really the plan they have for today. I'm going to give you a background to the iCalendar format, some interesting things that might have came up in my research and what people might have exploited before diving into standard implementations of iCalendar that are not so standard. So even though you have a standard, I think you'll be more than familiar that companies don't do things that way. They have used it in very interesting and strange ways that have led to vulnerabilities. And then I'll move on to proprietary extensions to the iCalendar standard. I'll talk a bit more about that later. But basically the iCalendar standard supports a standard way of doing non-standard things. So companies can add their own extensions, their way of passing, and that's going to be supported by the format. And then finally, I'll talk about some protocol interactions, because iCalendar doesn't exist in a vacuum. When you respond to an invitation and email is being sent, so it's working with the SMTP format, there's also the CalDEV format protocol, which helps to update and create calendar files on the web service. And that's all kind of things that add additional complexity to using iCalendar and has led to vulnerabilities. And I'll give some quick takeaways, mostly for builders. But also for breakers, if you're interested, I'll be also putting up a small database of these stuff that I found that you can also take it a bit further. Because as I mentioned, I've done a really broad survey, found really kind of surface level stuff. But from what I've seen, I think if you want to take it further, there's definitely a rich source of bugs. All right, so let's start with the background for the iCalendar standard. So I showed you the 2445RFC that was way back in 1998, and it was kind of superseded by what is 5545, which was in 2009, done by someone from Oracle. And more recently, we have seen also a couple more updates. The most recent one also from Apple, engineer from Apple. But you also have a bunch of other RFCs that kind of update or add kind of interoperability, things that basically extend the format to more platforms. But when you think about the iCalendar format, you really want to go with IRC 5545, because that's a core specification that tells you exactly what goes on into this format. All right, so that's enough of talking of the IRC. So what actually goes on in a calendar? You get a calendar invite, what's going on? You get an email with an ICS attachment. And what does that ICS attachment look like? So that's what it kind of looks like. It's a pretty interesting format, a very simple format, something that you might come up with back in 1998 when you had a lot of space and network restrictions. It's a text file, common delimited and new line delimited. And it's a bit similar to, say, XML, because there are some opening and closing texts. You have the opening of a V calendar, and you have opening of a V event. And those are things that are similar to XML. But it's also different from XML, because it also has key value pairs, right? You have stuff like the date time start, the end, the location, the URL. And these are all standard properties that help describe the event you're attending. And in the background, what the clients are doing are essentially passing this transparently to the user. So as a user, most of the time, you're not gonna see an ICS file. You might have seen that if you have been sending an invite to a separate email client, but you're sending it within the Outlook ecosystem, for example. What you're gonna see is a very streamlined and transparent kind of user interface, right? And what these clients are doing is that they're doing some propriety work in the background. They are passing it differently from other clients. They're also adding their own extensions. And this creates more features because these companies, they want to differentiate their products. So you might have gotten a very convenient join online button if you had a team meeting or a Skype meeting. And what's going on back there is that Outlook is actually passing, for example, the URL property, or maybe the custom proprietary property that defines a team's meeting URL. And that's gonna immediately appear in the GUI. So that's already pretty interesting because just by modifying some of these unstructured data, you can create changes in the GUI and also the behavior of these applications. You might have a flight scheduled tomorrow. I hope it stays on time. But basically when you have a flight and it comes in as an email, for example, Apple Mail is able to pass that intelligently, extract some of the features and suggest an event for you, right? And a lot of these data is actually gonna be Apple's proprietary data format so it can show you things like your travel time. It can do a bit of a tracking of the flight for you and the calendar. And that's all very convenient for the end user. But with that convenience, it comes some complexity. And for bug hunters, I think that's where the bugs happen. So back in, I think, 1998, there were some dangers by default stuff in the specification. And one of these is the V-alarm property, right? So you can specify an alarm or trigger that happens maybe 15 minutes or one hour before your event happens and you can pop it in different ways. The most obvious way is across the notification way, so it's just gonna pop up a box or something. But back then, they actually allowed for several other ways to create a notification. One of them is that you could specify an email that could also have an attachment from your local system. So when it's time for the event, it's gonna send an email to who knows what with whatever attachment you have specified in your local system. Or you could even play a sound, a special sound. So you could load that from an FTP server or a HTTP server and a remote server. And we can see why that might be an issue today because you could play something nasty or dangerous and you don't want that to be loading remote content without your consent. And that was something that would have been possible given the way iCalendar works because a lot of these systems, they just take in the iCalendar file and you automatically add that to your calendar without you even having to accept it. But that was back in 1998. And I think a lot of companies and also the new updated IRC, they have kind of noted these dangers by default stuff. They've kind of deprecated it. But there's still insecure implementations of standard IRC properties. And I'll go through some of them. They're really interesting. So the first one is the description property. And it's as simple as it gets. It's exactly what it says on the tin. It just describes the event that you're going for. And it's meant to be a raw text file, right? It just adds in a little more data about what's going on with your event. But even though it describes it as a raw text file, I think vendors implement this very differently. So Apple and Microsoft, they stuck to the specification. They interpret that as plain text. But Google and VMware, they actually interpret this as HTML. So if you can, you can actually include HTML tags and it will be passed as such. Google itself does have their own sanitization procedures. You might be familiar with those. VMware did not for one of the applications. As I mentioned earlier, the reason why this is a problem is just because of the way ICS works. For a lot of clients, they automatically add the ICS attachment to your calendar. So even if you haven't accepted it or declined it, it's going to appear in your calendar or your inbox, right? And it's going to be added as a non-blocking event until you respond to it. But it's going to be that. And because of that, you can trigger a payload remotely without any user interaction. Depending on, of course, the exploit scenario that you have as well. And that's something that's pretty concerning. And also what makes it tricky is that, you know, you have so many clients across different platforms, different frameworks, that makes it really difficult to secure your implementation. So for VMware, that was an interesting case because only the iOS application was vulnerable, whereas Android has a different way of handling web views and that was able to kind of sanitize it and kind of block the exploitation. Whereas if you look at stuff like what Microsoft is putting out, they do have Microsoft Teams, Windows Calendar, Outlook, Outlook on the web. They have mobile, desktop, all kinds of things. And this makes it a lot messier for you to secure things at the end point. And this is something I observed as well, where it kind of pays to kind of test across different platforms and different versions in order to get what you want to see. What's interesting as well is not just raw text parsing. Apple does something really weird with this format because while they stick to raw text, they actually add their own special template into this, right? So it has a magic template, magic bytes. And if you're creating an application event with a FaceTime call, what it actually does behind the scenes is that it puts in this FaceTime format template and it transparently interprets that in your client. So if you're gonna look at that on your mobile phone or in macOS, it's just gonna show you a simple join button. At this point, you're kind of like, okay, yeah, custom URIs are also a thing. So Apple back then didn't sanitize it. And this is also a concern because I think in the start of 2022, I think Ryan Pickering had a really good UXSS or custom URI to RCE exploit on macOS. So this will have been a great delivery mechanism for that kind of vulnerability. And really I think when it comes to a lot of the properties I've seen that involve a URL, some of them do not check for the custom URI or protocol. And that's where you can also put in an exploit. Another interesting property for me was the attendee or organizer property. And what's interesting about this is that it's also tied to how you respond to it, right? Because when you respond to an email saying you're attending or not attending, it refers to the organizer field and it's gonna send invitation response to that organizer and then the server at the end of it is gonna accept the invitation and then it's gonna send an update to all of the invited participants. So according to the RFC, this value is a URI and has to be a mail to URI defined by another RFC, right? And sure, you're like, okay, that's fine. That looks good to me. But I think for those of you who looked at RFCs, my condolences, for those of you who read RFCs, you know, that's a valid RFC approved email actually because you put it between double quotes, it allows special characters and that's where you can also inject some of your payloads that are gonna be used by the application. So this was something I saw with the Synology calendar itself, so for example, when you add an event and I'm just kind of importing it here but you can have it synced from a calendar or from someone inviting you, that's gonna cause, you know, a payload, right? And that's gonna pop, yeah. And you can create a warmable event from this, basically because it's a calendar and then everyone's invited to the party and it's not a good party, it's the bad party, the kind that you don't wanna go to at, you know, I hope you're going to better parties, that's DEF CON. Yeah, and also some of the behavior that Apple does is also very custom, very proprietary, it's a non-standard way of implementing the specification that's really interesting. So for a calendar, they also have an attached property and an attached property basically defines, you know, most of the time it has to be a local to your email itself, but you can also sometimes specify a URL, most clients do not support that. But this URL specifies attachment to your event, so stuff like maybe a meeting agenda or a cat picture or something. And what Apple does is that it checks if this URL ends with .icloud.com and if it does, it's gonna automatically download that to your computer and this might be useful for red teams. I mean, I think it follows icloud.com but it also follows redirects so you can load any of your remote data into someone's computer remotely. So it's a zero-click download, I guess, and that might be useful for some red teams. It also does, if it's on .icloud.com, you can basically sign up for icloud folder and you can also upload that and that's gonna work with everyone. So it might be convenient for the end user because it helps them quickly attach stuff to icloud and send it to each other but it's also useful if you wanna deliver a payload. So that's it for kind of the standard properties that we've looked at. And one of the other things that I started to look at was the proprietary extensions to iCalendar and that really makes the meat of kind of what I'm gonna talk about today. I love it when companies do things differently because then bugs happen. And the RFC has a specification that allows for a standard mechanism for doing non-standard things and what that means is that if you wanna add your own functionality, you wanna add your own custom property that's not in the RFC, something a little extra, you can just add X in front of that and that's gonna be taken up as a non-standard property and there's no registration authority for this. So it's kind of the Wawa West, right? You can maybe add like X, I want to start an app and if your client is able to look for that property and it passes that property, that's good for you, right? It's just not gonna be compatible with other clients that don't support that property. And in the bad old days when the office applications were fighting for dominance, I think Microsoft went ham with this. So this was a really interesting custom property that I saw with Microsoft Office. They had this auto start check property, custom property and they also had the CollaborateDoc property. And what the auto start check property did was that when it's time for the event, it's gonna automatically start the video conferencing app, right? And the CollaborateDoc property, it just opens any file when it's time to start the conference. So this was interesting but it's no longer supported in more recent versions of Outlook. So I had to perform a bit of necromancy, right? I had to find Windows XP, get Office 2003 and it did work as described, right? A attacker would send an invitation of ICS file with these properties set and immediately trigger opening any file, even a remote loaded file on the victim's desktop. And you might see why that's a problem today because when we have Zoom or some other video conferencing applications today, that's a huge concern.  But this goes to show that even back then, there were different considerations for the properties that companies were creating and this led to some issues. So yeah, you're saying, okay, that's all in the past, that's all dead history, right? But we still have zombie properties coming up and they still exist because there's stuff like backward compatibility, the difficulty of dealing with legacy code makes it difficult to fully excise some of these old properties. So Microsoft does have another property called MWS URL, Meeting Workspace URL. And Meeting Workspaces, if you've used Office in maybe like five, 10 years ago, maybe have been a bigger thing, but basically it's kind of a previous iteration of the meeting stuff that Microsoft did. Nowadays we have Teams, we have Skype, but this was something that happened back then. And this had really interesting behaviour because when you have this property existing in your event and you respond to the event, what it's gonna do is gonna take that URL and it's gonna send a SOAP message to that and depending on how we respond, the application's also gonna behave in pretty strange ways. So that's something you can look at as well. Another thing is that it's gonna show this in the GUI as a View Meeting Workspace button and if you've kind of played around with Outlook in the past or Office applications, you would know that Microsoft actually sanitizes a lot of custom URIs. It does this automatically, it pops up in the alert if you're gonna click that, saying oh, it's not HTP or something like that. But this was able to kind of bypass the check, I guess because it was much older code in the code base. Unfortunately this was like two months before Fulina, so I wasn't able to use that for the full chain, but this is another example of where it'll be really nice if you guys told me your custom URI exploits, that would be really helpful. Okay, so that's Microsoft, Apple, Google patented their custom property. Google patented a way to iframe widgets in your calendars. So some of you guys might have used Calendar Classic, you might have used Google Homepage back in the day and that was really fun, adding random widgets to your homepage. And what Google wanted to do was that they wanted people to have a way to have a word of the day in their calendar or maybe whose famous, which famous person's birthday is it today because people like that. And when you can see from the graphic over there, that's what it's supposed to look like. It's basically an iframe in your calendar. And how that works in the background is that it is another custom property called X Google Calendar Content and that means you can load remote content. You can load image as well as an iframe URL. And in today's context, that's also a bad thing, right? When you receive an email, most of the time these days, the clients are not gonna load the remote content immediately because that is a privacy concern. We think about tracking pixels, we think about de-anonymization, but this was not the case for this. And also when it comes to iframes, iframes are also an issue because when you wanna securely display an iframe these days, most of the time you're gonna put them in a sandbox to disable scripts, stuff like that, but Google doesn't do that.  There are still parts of Google Calendar that still use this, that still display this. I think they're patched this, but this is on Google Embedded Calendar. And various parts of the Google, you're gonna find this pop-up and it's gonna work. And that's great because say for example, if you're gonna view the calendar, that's gonna pop some dynamic scripts or content for you, right? And that's gonna be an issue as well because end users are not gonna be aware of what's actually happening. And as I mentioned earlier, you can load this all fully remotely without user interaction. One interesting thing that Apple is also doing with custom properties is that it's actually gerry-rigging its own data structures onto iCalendar. So while browsing say one of my scheduled events, flight events on my iCalendar, I noticed a couple of things. I noticed X-Apple properties, one of which is the pipe-delimited format that added a bit more rich information to my event. But I also noticed X-Apple structured data. And that was basically a base-64 string that decoded into the binary property list format. So for those of you who are more familiar with macOS internals, that is basically a proprietary Apple format that can be decoded further into the property list format. And the property list format can be decoded further into XML, right? So you have four layers of abstraction, four layers of parsing, and four layers of decoding in iCalendar. That is pretty interesting. And if you look at it, the XML basically contains your flight reservation information. And there were some interesting things you could do to tweak what's displayed on the calendar. But basically this also is supported remotely.  And this leads to a lot of problems. So I've been dug too deep into this, but I would definitely fuzz this a lot more given the various layers of parsing. And I would definitely recommend that people look at this. And next, I'm gonna talk about interactions with SMTP and CalDef. So given that the iCalendar format has all of these properties, it doesn't actually work in a vacuum. So as I mentioned earlier, when you accept an invitation on say Outlook or another application, what it really does is that your client is going to send an email with an ICS attachment via whichever protocol it uses. Most of the time it's gonna SMTP, but maybe if you're doing it on a web app, it's gonna have its own custom API call to HTTP. And it's gonna send it to the organizer property. And the organizer is gonna parse that in their server. It's gonna update their own calendar invitation and it's gonna send it out to all of the other invites so that they know who is attending this event. So my good friend, Indy, when I was discussing this with him, he's really has done some good work in the mailbox space. You might wonder what happens to that organizer property. So for that property, it's gonna be an email and it's gonna paste that in an SMTP conversation. SMTP commands basically have a new line delimited kind of commands. It's kind of like a FTP session, if you think about it. It starts with the handshake, it starts with a mail from and it's gonna paste that organizer property value into the receipt to command. So who that email is gonna go to. And Indy had this great suggestion. He said, how about new lines? When I heard that, I was like, yeah, how about new lines? Because if you deal with protocols and formats, this is kind of this first thing you kind of look out for. And it's true because you can craft a RFC compliant email address with new lines. And this allows you to inject basically new SMTP commands. So instead of just when a victim kind of accepts the invitation, instead of sending an email to the organizer, or so they think, what's gonna happen is that you can inject their own SMTP email so they can send an email somewhere else, they might forge an email on your behalf and so on. So thanks Indy, that was a nice one. And the impact of this really depends on the SMTP server support. I guess because some of them do have a soft failure mode, some of them do have additional commands that you can use. But generally speaking, when it comes to SMTP injection, you can modify say the sender, the receiver, the contents of your email. And this can lead to some pretty interesting or terrible interactions with your victim. Another interesting protocol that iCalendar interacts with is CalDef. So CalDef is a superset of WebDef, which is itself a superset of HTTP. And if you intercept the request from your iPhone or maybe your Mac OS, you're actually gonna see a lot of this because Apple still uses CalDef to sync calendar objects between your phone and its servers, the iCloud servers. And it's really kind of a legacy format because it was used back in the day again when the syncing between servers wasn't proprietary and people wanted to make it work. Maybe you might have one email client from Yahoo Mail and you wanna sync it with your Outlook Mail, right? So all of them use CalDef back then. And companies didn't like that. They don't want things to be compatible nowadays because they have market power. Google tried to deprecate it, I think about five years ago and basically the developers kind of rose up and complained about it. So they said, okay, we won't deprecate it. We'll try it next year. So in the documentation, they've been saying they're gonna deprecate it for a couple years now. Hasn't really been totally phased out, but it's still there. Microsoft itself, if you're familiar with Azure and stuff, they work with the graph, the new graph protocol, and that basically creates objects using JSON. But they still use CalDef in some of their back, their backward compatibility with clients. LockSuite is an application created by ByteDance and they do have support for CalDef, but it's read-only. I think mostly because they use their own proprietary APIs to update events, but they use the read-only CalDef in order to have compatibility with different mail clients. So when you look at it, CalDef just provides you with additional way to inject your properties. When it came to say Google, it was a bit difficult for me to bypass, say, their HTTP API to inject some of my payloads into a calendar object. But when I used the CalDef protocol, I was able to just inject it without much problems. So if you're working with CalDef and you're working with iCalendar, you might also want to consider using CalDef as a way to deliver your payloads without having to deal with the hassle of some kind of proprietary API or file format. And that was something that was really interesting to me. Yeah, so that kind of sums up the number of the bugs that I've put out there. And you might want to think what can you do as a user or a creator, a developer of the iCalendar format? So in my opinion, it seems like what Vendors are doing is that the evolution of iCalendar is gonna be more Jerry Waking, right? What we see here with Microsoft is kind of a bridge between the iCalendar format and their graph API. So basically it's a JSON nested in iCalendar. And that's basically another type and that's basically another key value format embedded within another key value format. A lot of these companies are doing this. They're basically adding their own ways of passing a special templates, special encoding that's being put in the value format. So it's no longer just a pure Vortex format. But you can see again, how this is an interesting attack vector because once you have these additional passing, you can also do pretty interesting injections depending on what's going on back then. And you might also think, how can you secure this? Right, given that you have so many clients from so many different platforms and frameworks. And for Microsoft, what they've done is they've created their own internal passing standards. They call it the iCalendar to appointment object conversion algorithm. And it basically is a standard way for them to pass these from iCalendar into a calendar or event object. And this is, I think, not a bad way to do things, especially if you have a huge number of clients and most of your customers are gonna be using the clients anyway, not kind of bridging between different clients. Another option is to contribute to open passing standards. And this is something that I would recommend people do. I know the Apple's engineer has pushed out a couple of IRFCs in this front. But this helps to kind of secure things across the entire ecosystem. And because I think the IRFC for calendar, iCalendar, is not yet complete. There's still a lot of things missing in how you're passing or dealing with the iCalendar format that needs security considerations, especially since it was written in 1998 and 2009. There are a lot of things that are missing in terms of modern privacy and security standards. Now, of course, I think as a developer, you wanna stay frugal with non-standard behavior, right? Back in the early 2000s, companies went wild with custom properties because they love widgets, we love all of these kind of shiny extras. But what I've seen is also that a lot of these things are really hard to get out of your system once you support it, right? Because you need to have backward compatibility. You also need to have some of your legacy code that might be hard to exercise. And I think Google was a kind of case in point because it might not exist in a modern Google calendar, but it still exists in other parts of the website that other people can still access and it's not ideal. And so for researchers, there's still a lot more properties to research. I have open-source database right now for some of these properties. I've only put up a couple right now, but I think tomorrow I'm gonna put up the rest. I would really appreciate any contributions to this as we dive into our calendar standard, especially since for the end users themselves, they might not be aware what's going on behind the scenes and that's always a concern, right? Because it's doing all these flashy stuff. It's not always compatible. Most of it is not compatible. Most of it is gonna break when you move between standards and a lot of it is not documented. So I think it really helps to kind of document some of these custom properties, whether if you're a builder or breaker, that's gonna help us out a lot. So yeah, that's my URL and hopefully I can see some contributions. So thank you very much. I really appreciate your attention. I have some, thank you.