The last class, we were talking about subjective, objective evaluation with run it a bit fast because we wanted to get an overall picture. We did not go into details of some of the things which may be of interest. You may be wondering for example, what are the type of questions that are asked to expert driver and what is he supposed to know and answer? How does he answer? All these things the details we just skipped it. We said that you can refer to the paper and the thesis but let me just take you through a few at least a few of the questions which is which was posed to these drivers. We said that there were you know seven drivers who are asked and one of the key things in this is also the correlation of the answers to the drivers. There are two things in this. One is the correlation of the answers to the drivers and the correlation of the questions itself. You know the questions require similar you know response from the driver and whether these questions were I mean similarly responded. So this is also important. We also said that the experimental car which Chen and Ash used at the Leeds University, they had eight vehicle parameters and then these eight vehicle parameters were changed and 16 configurations were arrived at or 16 different cars were the ones which were tested. Of course Adam's model has been used as well in order to get the objective rating and experiments were conducted in order to obtain these ratings as well. So let us now look at what are the type of questions and I am going to just read it out so that you understand. So the type of experiments are two things. One is a number of experiments were done. For example steady state turning or steady state cornering is an experiment that was done in a smooth road as well as in a rough road. So you have that steady state turning which were run in a rough road and in a smooth road. So there were a set of questions that were asked and in order to determine the cornering behavior. So for example the question is something like this over smooth roads progressive behavior with increasing lateral acceleration. How does this vehicle behave when you increase the lateral acceleration? Obviously when you say increasing the lateral acceleration you mean that the speed okay the two speeds which were chosen and as the speed increases how does this progressive behavior with lateral acceleration how does that driver feel on that? The other thing is that over smooth roads is with which this line is held. You know does he is it very easy for him to take this turn hold the line in other words hold the path or is it that he had to make constant changes in his you know the way he drives and so on. Then other thing is that what is the amount of body roll or degrees of body roll okay which the driver feels third one. Fourth question is that progressive behavior with decreasing lateral acceleration okay. So the progressive behavior of increasing as well as decreasing lateral acceleration okay and an indication of the feel of available grip okay and so on. In other words these are the type of questions that were asked and that these were rated as I said before in a one to seven scale of rating okay. If you go and look at this paper you see the spread of answers. In other words it is not that every driver is going to agree okay on that marks okay there are spreads and it was found that a few of them okay it is the spread of the answers or in other words the if you take an average as well as the spread of this you would see for some of them it was small and some of them it was large and so on. In other words it was not very easy for drivers to agree you know exactly on every question on these things okay. So that is why a very detailed statistical analysis was done. In fact in order to extract information things like neural network was done and so on. So the first thing is the steady state turning and the other as I had said is I mean this involved totally about 14 questions. So this involved about 14 questions. Then we had this power change as I said on or off we had already said that power change is going to look at the understeer and the oversteer characteristics of the car and figure out it is an exercise when there is a power on would there be more understeer characteristics or power off would it be less or vice versa. I leave it to you to think about it basically because this involves what? Low transfer okay and when low transfer happens what really whether it is going to be understeer or oversteer I would like you to think about this okay. So this power change involves I think 14, 15 to 20 that is so six questions then sudden braking in a turn okay. So what happens to for example during this case what happens to your response what is the roll stability what is the wheel lift and so on. So these were the questions which were asked when sudden braking in a turn okay transient cornering okay again there were a number of questions on transient cornering. So the the the third one sudden braking in a turn it went from sudden braking in a turn went from 21 to 24 okay. So then transient cornering straight line direction stability and so on. In other words a total number of questions that were asked was 49 was 49. So very large number of questions were asked. Now it was not that all these questions were relevant okay when compared to handling and when compared to subjective objective evaluation that's why later out of this 49 questions a few of them became I mean important. So the first thing is questionnaire was set these things this we had already seen okay. So out of these questions a few of the yes There are two purposes to this one is to quantify how good your vehicle is from a pure technical view point and the other is how what exactly the user wants. But in that case why can't it just subject the user to conditions they would normally face why do you want to put them through test like this. I don't know the the user band may be so high. No but it makes no sense to test them in the scenarios in which they would normally be operating and you could even use a steering robot or whatever to quantify how the performance. Okay okay two things one is that if the vehicle performance at the limit is good because most accidents if you see it is at the limits if it's limit is good then handling characteristics of the vehicle is supposed to be good okay. More importantly steering robot okay is today used for getting input for the objective metrics okay. Now here what are we trying to do ultimate all one of the important key things which in my experience we have done lot of work. We have seen that when it comes to handling when it comes to handling the drivers are very sensitive okay very sensitive to changes that take place. Alright that is the reason why for example when you have that pressure of driving as you for example accelerate in a corner okay and the vehicle feels that acceleration in a corner okay gives you a sort of a good feeling of the car. So in other words the feeling as you drive the car is brought out by this subjective evaluation right. Now the why are we okay let's put it like this. I have objective ratings okay objective parameters okay. First of all I do not know suppose you remove the the drive a subjective drivers. First of all I do not know what can be this this list what can or what should be this list look at the list you know there is so many things which we had seen yesterday. So what can be this list in order that I would satisfy a good behavior of the vehicle okay I don't even know it. So that is why I want a subjective to objective correlation okay and the the car is tested at its limit because I do not know you know how it will be used right I mean we are not talking about cars being used only at say in our roads where you can't go beyond 40 or in any city road where you can't go beyond 40 kilometers per hour. We are not testing cars just like that okay they are tested for different purposes. For example there is a city cycle the city cycle is used in order to to find out what is the fuel consumption okay. For example our roads we test the cars for very sharp transient manoeuvrabilities okay. So which is also reflected here. So in other words the city cycle it has its own use to evaluate the car especially from a fuel consumption point of view. But when you want to look at the performance of the car say suppose you take this in a in a highway okay and we know in our highway suddenly there is an obstacle that comes okay and you you do a double lane change under very severe conditions. So we are travelling at 120 kilometers I don't know whether you have driven this highways in Indian highways today people drive at 140 kilometers to 160 kilometers per hour. We know that some of the buses for example we have done lot of survey on entire lives we know that buses average 105 kilometers per hour okay. Those speeds are extremely high extremely high. So at those speeds at those speeds okay we do not know how the vehicle is going to behave. There have been issues when the vehicle touches 110 kilometers per hour okay. There are countries in which there are restrictions on speeds for example United States okay. In our country we do not have most instances we do not have restrictions on the speeds okay. In many countries like Germany you do not have restrictions on speeds. So you do not know what speeds people are going to drive. So that is why all these things are tested. Simple fact is that the drivers also do not want surprises okay. When you change when you do a transient understeer or transient oversteer the drivers also do not want surprises. So that is why we do such a subjectivity. So once I do a subjective and I do a subjective objective correlation also my design becomes simple. Now if I tell you that my yaw rate gain at 0.7 hertz is important then my next goal which you will do in the next course on our vehicle dynamics lab as to what are the design parameters which are going to have an effect. We have seen this with a simple bicycle model right. But there are other parameters which may have an effect. In a very detailed models there are other parameters which may have an effect. So it becomes easy for me once I have that kind of range which we defined okay that kind of range which we defined then it becomes easy for me to also design a vehicle. Clear? That is why. So what are the important things? How do you design a questionnaire is important okay. What are the type of questions or relevant questions are you asking okay. That is why the questions where objective metrics are found to model majority of the driver ratings are given here okay. Go back and look at the thesis batch you can do more I mean more about these questions. So from these 49 questions a few of them become important okay and tomorrow you want to test a car it is good to have or to model this or to have a questionnaire, design a questionnaire based on these questions okay. So it is a big topic I do not have time to go into each one of these questions and how it is related and so on that is why I have given you a reference I would like to move to the next topic okay but just want to spend a few minutes on what this subjective rating questions tell you right. Of course ultimately when you want to buy a car you are going to drive it that is a different thing but this is useful for the designers okay. At least now with the vehicle dynamics course you will also know how to test a car right. So that is yes okay you can do a test drive okay. Post that you are going to buy a car go and do a test drive and say that I will take I will tell you a decision after couple of days. Do not give your cell number to him because he will keep calling you right do not do that go and do this test okay fine. Anyway we are going to do some few tests in the next course on vehicle dynamics lab we will know more about these things right. So we will move away from this subjective objective correlations we will move to a last topic in lateral dynamics which is roll over yes. No no no I told you right I mean memorable plot is the easiest because I have only four parameters okay that seems to correlate well to a great extent in my opinion we have a great I have also done some tests it correlates well okay except that when the vehicle has a lot more oversteer characteristics then there is an anomaly. In other words what we said is that within a limited range the sentence that as the area of the rhombus increases gives a better drive or a right I mean handling is valid. But then this work further work after memory after all it was in 90s early 90s so there were lot more parameters which were included okay. Now those are the parameters which we had put down sometime back right and the difficulty as you add parameters is that I want to now be within that range then it becomes difficult whether I can have all those parameters within a range within that range. That is exactly see that is why this subjective how will you predict the range there are two things one is predicting the range the other is getting the value in a design. The predicting the range is that subjective objective correlation that is what I have been talking you know subjective objective correlation gives you that range okay clear. So in other words that is why drivers are asked to drive look at their answers then what are what are those cars which they have said very good what are those ranges and so on you know. That is why you did or people did in the Leeds University did a factorial experiment okay. So this range is obtained from that correlation there are number of ways in which they have obtained this correlation okay. So range is different from design then you have to go and design a car whose for example natural frequency at yaw is between these two 1.7 and 2.1 okay. So this is applicable to a range of say a sedan okay up to SUV right but may not be applicable for say trucks type of thing okay. So this range is for the vehicles tested which is which is sort of sedan SUV type of vehicles this range is valid your question is well taken. That is why if you are working in a car company you would like to have your own these numbers okay so that you can fine tune it. So this will be very useful for you to fine tune your vehicle. You can predict the range see this you can if you when you design a car you will get the values for these things. You will get the values the range is predicted as I keep telling between subjective objective correlation. It is just it is like how the car is when you don't face like that. So there what we did was we asked to rate it as 1 to 7 okay. In fact that is why this paper I don't know much time 980226 SAE there is a table say figure 4 rather okay. Figure 4 you get effect of objective metrics on subjective ratings is completely given there okay. Go and have a look at it for example effect on subjective ratings is in the y axis and you see that very many number of objective metrics are given in the x axis okay. So when you change this parameter say for example natural frequency of yaw at 0.7 yaw or yaw gain at 0.7 what is the effect on subjective rating is obtained okay. And he had also defined whether there is a uniform agreement or the drivers have unequivocally said that this particular parameter is important and so on right. So that is how this is arrived at change it for example I mean in simple words I change the configuration. So let us take one thing I change the natural frequency okay let's forget about the rest of it just as an example okay. Very good statistics is involved but let's forget it for a minute just to make you understand I know that students you'd be wondering why we are doing these things. So let us forget about everything I will say natural frequency I am going to take say 3 cars or 4 cars okay whose natural frequency at yaw varies from 1.6 okay 1.8, 2 and 2.4. Let's say that I take this cars and I give it to the drivers okay and ask a number of questions which I had listed okay.  And I am going to ask them a number of questions. Now then if I consistently get that drivers say that your car which is 1.6 okay is not good or his ratings for the questions are low for 1.6 and becomes high for 1.8 and 2 and again low for 2.4 okay right. Then I would say that look this range consistently if they say it and there is a statistical significance there are number of statistical significance test go through this thesis. Then you would see that with 95% confidence you know there are R what is called as R squared values in statistics and so on. Forget about all that jargons just say that these two values okay consistently people say it is good. Then I would say that look if the natural frequency at yaw is between these two people say that it's a good car and so you should keep it like that okay. Now we can't change okay let's say that I change similarly damping and so on I keep changing one by one and I want to find out each factor that's one way. But I can't do that because there are so many factors I can't do so we do a factorial experiment to understand okay the interactions and between the drivers feel and this and arrive at a set of values clear. So once you arrive at it you go and start working in your design okay. Now so natural frequency of yaw how is this going to be related the first thing I'll do is to go to a bicycle model you already know the formula for it okay. So you look at your vehicle where do I stand what is my natural frequency at yaw okay simple first cut okay maybe 2 degree of freedom or 3 degree of freedom where do I stand yes looks like it's fine okay. Like that whatever is possible for me to get okay yaw velocity gain or lateral acceleration gain okay phase and so on all these things I have simple formula and first I'll check okay what are the parameters. Maybe the mass of the vehicle will have an effect CG location may have an effect moment of inertia may have an effect lateral compliance may have an effect so many things may have an effect on these things. Okay then my job as designer is to optimize this and see that my vehicle lies in those ranges that's a challenge it's a good optimization problem which will do that in the next semester. I assure you that we are going to do a complete sensitivity parametric analysis okay. We will take a car we will change various parameters we will list down okay various parameters and then we are going to change them and see how these parameters are getting affected. So you can come to a very optimized car okay so in other words if you produce this car then and give it to this ratings of the drivers who are very important okay then you will get good ratings from them that's the fundamental basis yes. At some point I took someone to identify what these parameters are that is probably the toughest job because even now you are not sure of whatever. Absolutely that is that that's the that's a too good PhD that's why I took that in this course too good PhDs we were done a lot of work okay in my opinion that's an exhaustive work that's done right that is the you know the two good PhDs from Leeds and that's what. They had done but the problem is it is not one to one correspondence it is not that for that one question there is one objective parameter it's not like that it is that is why the statistical base I keep on telling that that becomes important. Yeah correct if you are not if you are in that I would say range okay this will be valid that's why I said that mostly if it is a sedan okay or SUV this would be valid okay so yes the validity has to be checked we are not questioning that but generally because of the range that was done okay this likely to be valid. Okay this is not something as a design rule we are saying that's why we are giving a range around this value looks correct looks value. Yeah correct so that is where again I want you to go through the thesis we will do that you know next semester in another course okay we will go into details. See we are only scratching the surface in this whole course we are only scratching the surface vehicle dynamics is a huge topic okay the questions which are still not answered is I said that with there been some answers and I am not convinced that every metric has been answered from very I would say use again the word in a very objective fashion. In other words some of them you may know that the response of the vehicle is in that frequency range and so the phase becomes important and so on but for some of them you don't even know. Say for example why is it at 0.4, 0.6 if you go back and look at it the list of for example metrics which they have studied okay which is given in their table 2 in this paper so you would see that the metric is studied at say for example 2 and 4 meters per second plus or minus 2 and 4 meters per second and that the peak lateral acceleration response time is taken at 2 and 6 meters per second squared lateral acceleration and so on okay. So in fact the authors themselves agree that this kind of you know why is it I wrote down a formula. Why is it that it is 1.1 multiplied by something minus 0.5 multiplied by something plus you know that is still not clear right. So that is why it is purely 2 data sets connected by statistics okay this is just a parameter identification okay some have meaning some do not have meaning okay I do not know why it is 1.1. Say for if you look at say I mean just like that I have given a formula I do not know why it is minus 1.1 into your rate gain at 0.4 hertz I do not know you know that is what the statistics throws out at you. The regression analysis throws out okay and that is the value if you ask me why 0.7 just a statistical output that is all I know I do not know more than that why minus 0.7 into this I do not know more than that okay. So in other words subjective objective evaluation is still in the realm of statistics okay it is still in the realm of statistics you are correlating it through statistical means clear okay. It is a challenge to produce a good car and you learn okay that is why many of these car companies have a huge data back okay. So let us shift to the next topic I know this is an interesting topic because it actually impacts design of the vehicle itself as I said vehicle dynamics we are scratching the surface. It is a huge topic extremely interesting I know that so much of interest the students it is an extremely interesting topic we cannot complete all the things maybe you need a couple of more courses on advanced vehicle dynamics. In fact I am guilty of not covering many things connected with vehicle dynamics for example the lot more vibration aspects and we are not covering the effect of suspension steering and so on. There is no time because of the limited about 35 hours of lecture we let us at least get a view of because it is an introductory course get a view of what happens okay. So let us get to the next topic which is rollover before we follow or we go to vertical dynamics where there is still a lot more to cover on vehicle dynamics as far as the vertical dynamics is concerned and so we will go to rollover. Rollover is a very important topic starting from SUV onwards you would have seen lot of accidents in SUVs sports utility vehicles where the vehicle would have rolled over the sides one and you would have seen huge trucks tractor trailers are some of them. Okay there rollovers you would have seen it a number of times you will be surprised to know that recent statistics shows that in United States 15,000 vehicles rollover a year okay so there is a lot of them. Okay in our in our country we have had cases where there are number of rollovers in fact we had looked at some of the cases where there are rollovers of huge trucks which take cars okay which are manufactured say around Chennai. They are huge vehicles which take over which take the cars right and usually the loss is upward of 5 million rupees okay the because of the cars that are involved unfortunately in this country we still do not have a law on how this kind of tractor trailers are designed. In fact how what is the height and what simple ratio which we will we will see in a minute you know these ratios are not followed and so on. Okay so there is a lot of scope to work on on rollover and in recent times control strategies have been used for rollover prevention. As I said again we would not have time to go into the control strategies for rollover prevention but let us let us quickly understand what we mean by by rollover. The simplest analysis is what I would call as a steady state analysis where we considered the vehicle to be rigid okay and sitting say for example very approximate diagram and let us say that that is the centre of gravity location sorry. Let us say that that is the centre of gravity location. Let us say that these are the centrifugal forces that are required okay in order that the vehicle takes a turn right and that is the corresponding D'Alembert's force okay or the centrifugal force okay which is MV squared by R or I would call that as M into Ay. Okay now of course there are reactions at the front and the rear okay and that we call that as the track width let us say that that is the track width which I would call as TW okay and of course the weight WX. Obviously you see the roll you know as the vehicle takes a turn let us say that this is the outer tyre that is the inner tyre just call that as outer tyre and inner tyre and the FZ that is acting here is FZ outer and FZ inner. Let us define I am defining it let us define that vehicle rolls over or we say that vehicle has rolled over once this FZ inner how is it going to roll over I am going to take now what am I doing I am going to take a turn to the right okay where will it turn over which side to the left right. So I assume that the roll over condition is achieved when I lose contact of the inner tyre with the roll okay this is the condition which I am assuming right. So let us let us just calculate what should be the critical Ay in order that this is you know this lift of the inner tyre takes place let me call that distance as H okay. Now take moments about this outer tyre okay and tell me what should be this Ay M into Ay into H minus W which is M into G into TW by 2 is equal to 0. We talk about steady state we are not introducing the time derivatives okay the no this FZ inner that is what I told you know so this is not there is nothing here there okay. So Ay is equal to G into TW by 2H very famous ratio T by 2H ratio as it is called or Ay by G usually expressed as the simplest formula okay is equal to T by 2H. The first thing that our commercial vehicle guys who carry those lovely cars have to do is to check what is their T by 2H ratios. We would be surprised we have done this calculation we would be surprised to know that this is 0.22, 0.23G in other words T by 2H is about 0.22, 0.23 very very low. So that is the level at which okay lateral acceleration levels at which this will roll over the typical car would be about 0.7, 0.8 and if you look at a formula one cars it will be more than 1.5 very high okay. So the very first thing first equation that you look at is what is called as the T by 2H ratio there are two things that we left here. There are a number of factors the number of factors which would now change T and H what is the assumption that we have made we have assumed that this whole thing is rigid not true. Actually the vehicle the body what is called as the sprung mass is actually going to roll right there is a roll center we have seen that and the vehicle is going to roll. So as it rolls say in other words as it rolls okay about the roll center the center of gravity location is going to change is going to change. So one is that H is going to be affected by the roll and hence due to the suspension and so on okay. The other factor and the roll is also this is one of them the roll is also due to the stiffness of the tire the tire stiffness is also going to have an effect okay. In other words you can imagine that FZ in this in the inner is going to go to 0 okay the whole of F the FZ that is the normal force will be transferred to the this tire. Yes sir I am coming down we will do one by one okay. So let us both of them are going to be affected okay there are number of factors which are which are going to affect both right agreed wait wait I know I am very happy that you are so involved but we have to go step by step right okay. Yes so that is also the roll also is affected there are two two rolls here. One is the roll of the unsprung mass which is basically due to the tire stiffness because of which there will be say let us say that let us look at the suspension system or this axle system okay which is a rigid axle system which is there in most of the commercial vehicles. So because of this this is going to be affected and the second one is that because on top of it is going to sit this our sprung mass okay and that sprung mass is now affected by the roll stiffness. So in other words there are factors which affect this there are factors which affect T okay there are factors which affect T. T is affected by the by the kinematics and compliance of the suspension system. For example it is affected straight away even without going into the details of kinematic and compliance system is affected by the tire lateral stiffness okay straight away tire lateral stiffness. It is affected by the camber it is affected by the camber change okay how does this camber change and so on. It is even affected by the torque that is produced due to the gyroscopic effects. So a number of factors affect this and this which we will we will list down in the next class okay and so usually if you design a vehicle it is if this factor is T by 2h is equal to say 0.8. This factor usually is the actual factor is less by about 25% okay number of these things are going to have an effect it is going to be less by about 25%. So there are at least 4 factors which have an effect. The major effect or maybe even 25-30% you know and so on the major effect is because of this role because of this role. So my first job here right now is to find out what is this role and how that affects this this H. So let me consider two of this role in role simply means that it is going to be an angle okay two of them one I would call as alpha 1. We are going to follow for this derivation the reference is that road vehicle dynamics by George Rill by George Rill road vehicle dynamics is very simple derivation which takes into account this. And if you want slightly more detailed and I will give you one more reference again due to okay which I will maybe next class I will give you that reference I do not have it right now. So there are these are the couple of references which talks about this but one of the things which we have not done here is that we have not considered actually the dynamic effects. You know in other words I have to write down a differential equation based on phi double dot i phi double dot and so on that we have not done you know that is the next step. The more interesting part is okay let us just finish this I will come to this okay one is this alpha 1 the role of the unsprung mass and alpha 2 which is the role due to the sprung mass. Okay we will do this to we will do the detail derivation next class and finish this topic. I just want to tell you that what we are doing is actually not dynamics even when I include these two we are not doing dynamics okay. So we have to do dynamics in other words we have to understand the dynamic behavior and role and that becomes very important in order to design okay. Control systems for preventing role okay. There have been number of papers and thesis on how to write down these equations. In fact goes back to the 50s write down these equations and then the recent attempt has been to rewrite the equations in state space and use a number of standard controls strategies okay. So we will talk about alpha 1 alpha 2 and its effect on on this parameter in the next class right okay. So any questions we will stop and we will continue in the next class.


Express yourself to find yourself Look, learn about myself when I get to rapping My tactics steady getting better with practice I'm asking how do I map my passion off track From these pasts that lack an asterisk that's so abstract Don't just follow with footsteps, it's right sometimes Don't forget to look left, you should bet on what you could do best Invest your time, watch timeline designed by your own minds Confines deep within, that's how you really live Independent of thinking what could have happened if time is now No time to waste, only thing I fear is here in the same place So I keep a faith in the process Staying modest, but honest, I'm headed for the uncommon Provided I can get the pace with the progress Every second I move, affecting my mood Talk about a break, man, you begging to lose, I never chill Sit still like I'm on a hill, like a reverse Thinking of the ways it can improve, I get immersed Even every rap, I try to snap on every verse Matter of fact, every word deserves to be heard Not to be knee-jerk, Steve, the beaver I got you saying, damn, now I got the fever It was just the beaver, but I'm blonde Going dumb, feeling numb, like I'm drunk Bump the rhythm in the midst of Learn about who I want to become From the inside out, I just want to be loved The inspiring one, I just desire something higher Get admired for lighting a fire under those tenets The motivation, little bit of patience goes a long way Following your passion ain't the wrong way Maybe just the wrong day, just go hard, don't wait Or if it got me tripping, slowly drifting to the distance Pushing my limits, closing my eyes and I feel nonexistent My brain taking over, I'm just as insistent I'm spitting like nobody listening I'm in position, I find out what's missing Explorer, can't be ignored Finding myself, Jason Bourne What else is in store? I bet it gets weirder for sure I be chatting up with my own brain And we catching up like we old friends And we be reminiscing about the tough decisions But the tough is yet, it's where to go next And I be so stressed, trying to plan it out Think of big, hope to plan it out Hard to express what I'm talking about That's why these lines getting long new phone In town, I'm feeling crazy, but I don't fight it Just write it, wave your lip, I've decided I'm decided, I'm gonna try and I'm frightened But still delighted, hitting every negative When I'm minus, now I'm plus sighted Fact is, not appealing to the masses Still trying to make the track lit Type of shit that make you run it back, kid Hold up, I need to hear that again It's like you peered in my head A little fear, I can't articulate the feelings again But at the same time, that is when I'm feeling my best Got too much to say, I'm trying to express But doing my way, reduce more stress Focus on my breath, meditate Be the master of my fate While I'm living life to the maximum I got goals, of course, but I'm detached from them Cause that's the way it works in this universe Trust your gut, and it all will come And I'm learning that, expressing myself Feels like it's my purpose, these urges cannot be curbed That's why verses keep getting murdered Look, I just want to let them know You could do a lot, you could do way more than you think That's the thing that you think, thinking on the wrong door Baby, just run, don't stop, push your heart, push your heart But it's locked, maybe think it deeper, release your right To the key that you need, then it's easy to turn the knob Good job, and that's all in love And that's a good guy, mine I really messed up the last couple bars I just want to let them know, you could do a lot You could do way more than you think That's the thing, gotta think Pushing on the wrong door, maybe not wrong, just lock Pushing hard, but it's blocked Maybe think it deeper, release your right To the key that you need, then it's easy to turn the knob Good job, that's all in love That's a good guy, gosh darn


Yeah, actually you can just John says I feel like I can close my eyes and just trade the flowmaster Curtis and I have tried that in in testing our testing phases when the markets are fast. It works So speed high Audio box on you can trade with your eyes closed. I curse and I did that experiment. He beat me we tried to see if it would work and we we did it for a while and you know, we were scouts on or that we weren't looking and At the end you're like, okay, how'd you do it? I'm like looking over. I'm like, ah, man I did 11,000 now. Like, well, what about you? He's like 13,000 Curtis Curtis outbeat me. No, mind you. We were doing sim and whatnot just to mess around us to see what we could do But when we were before we had released audio box to public Farting around in market replay eyes closed only in what would you with eyes closed? Basically buys and sells just being able to press the buy button when you're hearing buyers Sell in your sellers type of thing or making a decision whether you think okay That was an absorption sound and then you go the other way, you know, basically there's a little bit of discretion in it But not much right But yeah, we tested out that theory like could you could you trade with it? Yeah? I wouldn't do it when the market slow, but if it's fast sure make sure you got a decent ATM It's already got your stop set and your target set for you


Don't even know the time frame at this point glock.  I already come out that bad Proud of you man.  They were like man We were listening to some key glock in your car, man.  No, it's not it's no below. I appreciate it. I appreciate it I'll be seeing it.    I see you riding the success of your recent successes What you gonna pivot into next? I Just got a another tour setup. I'm going to Canada this time next month Yeah, I got a whole Canada tour.  No, I just got back from a Europe tour How was that? I ain't a lot. They different But I'm they go for the music over there. No for real. They really do this. They shot me. I didn't think it was gonna be like No for sure they like they energy different like they the way they show love is like it's real different This is what I was gonna ask you man You just went out here and rocked the stage for a good 23,000 people and for you to be so chill right now How do you how you turn it up like that so high and then come right back to just chill and block after that? like This shit real like I ain't faking. I'm just being me. Yeah, it's just glop This is your first time at the one music thing. Yeah, that was my first one Yeah, what you think of it so far.  It's smooth.  I don't even know who I'm on the lineup May you should have been here last night Janet Jackson was up in here She had the thugs crying out here, bro.  I think I know what you tell me Man, but it's like I don't care who you are Some people are just on another straightest way whether you came here to see Kodak black or who or Megan the stallion When when Janet Jackson hit that stage, it's like the whole Atlanta turned around, bro It's hard. It was dudes out there like man. They might be just a little sister. She need them flowers. She just got there the faith Need them flowers and she really had like a production. You know what I mean? I'm excited. I want to see maybe like feature wise but like as far as myself No, I'm gonna stay in my lane I don't know I'm saying I'm gonna be honest.  Like I said, if it's a feature. Yeah for sure Send it to me.  You seem to be extremely busy It's all about who you know, you know, like this and that's what life period is all about who you know Yeah, yeah for sure Man, it's been super dope back here.      It's legends all around here, bro No, oh young up and coming everybody been around the music fast, bro. Sure How do you prepare yourself for gotta keep it so many moves apart?  It's like what's your process now that To do you doing your follow-ups because I know it went from you could just You know, whatever I want to now.  Yeah, it's It's really like a flicks.   Like it's really like that Like really having my way man. It's just it's dope to see you keep that going, bro And it's like to keep that same energy and that same flow and know that you still got those fans Want to make sure you good. I still I see them on your page all the time Still sending you love and condolences and stuff like that, man.  You know what I'm saying?   I made it. It might not be for everybody else, but like I just want to make sure I locked that one in for my own Personal life success All right, I'm so cocky and self-confident ain't nobody gonna make me feel like that Like Just just just for real Yeah, that's that's that feeling you get when you get into his own man.  We're from down south, bro. Down south But we we're gonna get a Christmas album or Christmas table something you might get a Thanksgiving. Who knows word Word that's always been one thing that you've been consistent on is like you drop a nice volume Of music. Yeah, what's in the vault? The vault got a vault I Got I got more than enough music like I can I can stop recording for the rest of this year And don't record none next year and still drop five tapes onto my solid tapes I want to ask you this about because you know It's a movement coming out of Memphis right now It's driven by the music But the joking has been going crazy viral with like it's coming back. It's coming back, bro What you think about that?    He stayed in my grandma cold. My grandma had a cold his name was EJ he Like he was a part of this little little group and everything like that's all they did Like he was the first person I seen do it. He was the One of the best persons I seen do it in person too. So, you know what I'm saying my boy EJ That's what's up, man. Yeah, what look at us? Can we expect from Keith like man? No, you like I said, you don't sit down the line. I'm being key dropping. I ain't no lie. I'm foot on the gas right now Flipping flip What's up, man? Yeah, like we appreciate you stopping through the backwoods lounge, man We got to make sure we get you some of this dope ass merge one of these hoodies one of these gift bags of uh one of these uh So let them in jacket, man. You got the fashion line.  So don't worry about man. Take that room, man I'm gonna make sure I got your info. I gotta make sure I get you some of the new shit anyway Yeah, I'll love you to stop by the studio again and follow up next time you in the city Man flying deep and DC and chico is there, man And let's take it up another notch man much love and success to you Do appreciate you stopping through the back one honey my boy Much love 85 south show backwoods lounge. None other than key glock The love is a beautiful miss brine and we out of here


Hi, I'm Zor. Welcome to Unisorification. I will continue solving different problems related to parallel lines, triangles, and quadrangles. This is the series of problem number four, and I have them here on this paper, so I will go just one by one. I'm sure you have already read all these problems and tried to solve them yourselves. If you didn't, they did successfully great. This is just yet another opinion about these problems. If you don't, well, then I'll just suggest my solution. All right, locus. Okay, so a couple of problems about locus. What is the locus? Locus is in geometry, at least, whatever I'm using it for. It's a set of points which satisfy a certain criteria. So if I'm asking what is the locus of points that, and then specify the criteria, it means that you have to find some kind of a line or a curve or area on the plane, all points of which satisfy this criteria. What is the locus of points that are dividing all segments connecting given point with all points in a given line into two congruent parts? So you have a point, and you have a line, and you have all the different segments which connect the point to this line. Now, my question is, where are the midpoints of each of these segments lie? Well, you obviously know that they lie on a straight line, which is parallel to this one, and it's equidistant, so I will draw a perpendicular here, so equidistant from point and line. So if you draw a perpendicular line, and through its middle, if you draw a parallel line to the given line, that would be the locus of all points of all the midpoints of all the segments which connect this point with the segment. Now, how to prove it? Well, very easy. So let's start with constructing this line. So let's say I have already drawn this line through a midpoint of a perpendicular from the given point to a line. Now, let's take any other segment which connects the point to a given line. Now, since these lines are parallel, if you consider a triangle ABC, so this point M is a midpoint of AB because that's how I constructed this line, and the line is parallel to the given line because, again, that's how I constructed it. So MN is a line drawn parallel to the base of the triangle ABC through the middle of one of its sides, and the theory which was proven before was that this line cuts the other side in half as well. So all these segments will be cut by this particular line in half, and that's the proof that all the mid-segments of all these segments which I can draw from a given point to a given line are on this line. Okay, next. What are the locus of points equidistant from two parallel lines? Well, obviously, you know the answer. If you have two parallel lines, then the point which is equidistant from it is supposed to be on a perpendicular and in the middle of this perpendicular because how to measure the point, the distance from a point to a line? Well, the distance from this point to this line is the length of the perpendicular, and from this to this is the length of this perpendicular. Now, since these are perpendicular to parallel lines, they basically coincide. These are because they are containing this one line. So these are two perpendicular, actually, which are coinciding with each other. So this is a straight line, and that's why the length of this piece is equal to the length of that piece, which means this is the midpoint of this particular segment. Now, if you will take any other point which is equidistant from both lines, again, it lies on the neutral perpendicular, cutting it in half. So if you will connect all these points together, well, let's connect only these two points. Now, what do we have about this figure? Now, why is it parallelogram? Well, because the A, B, C, D is a rectangle, since these are perpendicular, and opposite sides of the rectangle are congruent to each other, which means caps of these opposite sides are also congruent and parallel to each other, which makes M, N, C, G also, well, at least parallelogram. It's actually a rectangle. And so is A, B, N, M. Now, if that's true, it means that M, N is parallel to C, G. And then if you take any other point somewhere, let's call it T, and draw the perpendicular, it will, again, be parallel to any one of those guys, which means it will be parallelogram. And if it divides in half, again, this will be equal to this. But since these are two equal to each other, P is supposed to lie exactly on the line M, N. Because line M, N is dividing every neutral perpendicular in two halves, two equal halves. So the line in between, that's the locus. The locus of vertices of all triangles with the given base and altitude. All right, so you have a base and you have certain altitude. So the triangle in this case will be like this. But so will be any other triangle which has these vertices on the line parallel to the base in the same distance as this. So this is the same altitude. This is the same altitude as this one. And this one is also the same altitude. Because altitude is always at lengths of the perpendicular dropped from the point to the base line. So since these lines are parallel, we already actually proved that the distance between the two parallel lines is constant and it doesn't really depend on the point. So every point here will actually have the same lengths of the altitude. So all the vertices of all these triangles lie on the line parallel to the base of this triangle. By the way, it would be actually more rigorous I would say to prove that any other point not lying on this particular parallel line has a different altitude. And it's kind of obvious. So if you have two parallel lines which are on a certain distance from each other and you have a point outside, then this distance would be greater than this distance. Why? Because these pieces are equal and this is extra. So that's why any other line not lying on a parallel line is not making the same altitude if you draw a triangle. So that actually is, you know, it's a more rigorous proof because not only you have to prove that whatever your locus is set of points which satisfy this criteria you also have to prove that this is all the points which satisfy this criteria which means any other point does not satisfy the criteria. So that's what I did. So basically to proving that a set is a locus it's kind of two theorems. All points within whatever you point as a set, whatever you decide is a set. They do satisfy the criteria and whatever outside of this set points do not need to cover all the different points which satisfy the criteria. That would be a more robust proof. Construct the third angle of a triangle if two other angles are given. Well, look, this is just a simple thing. So if you have a triangle, you know that three angles are summed up give the hundred and eighty degrees, right? If you know two angles what you have to do, you have to subtract from a hundred and eighty degrees angle, you have to subtract these ones. Now how to do it? Well, actually it's very simple. So first this is a hundred and eighty degrees angle, right? The whole thing. Now how to subtract an angle, let's say this angle. Well, you just build a triangle using this side here and this side and this side giving this point. So you get a triangle by three points, right? By three sides. So this is an angle which is congruent to this one. Okay, so we basically subtract it. So from the entire hundred and eighty degree we subtract it only this part and whatever is left is the difference. Now we have to subtract from this angle this one. Okay, how to do it? Well, let's just forget about this piece. We have already subtracted this angle and now this one. Well, we do it very similarly. You take this radius, put it here, take this radius, this radius make this and this make it this. So again, you have a triangle this, right? This is equal to this and this is equal to this and this is equal to this, right? So now you got this angle. So from this angle, whatever is a remainder after the first subtraction, you can subtract the second end and that's what's left. But basically this angle is congruent to this. So basically it's an exercise for subtraction of angles. That's easy. Construct an acute angle of a right triangle if another acute angle is given. Well, same thing. If you have a right triangle then you know that two acute angles are summed up as 90 degrees. Right angle, right? So sum of these two angles is 90 degrees. So what you have to do is if you have one of those angles, you again have a right angle, that's 90 degrees. And now you have to subtract this one which you have to basically build a triangle like this, right? So how do you build it? You take this side and then using typogenous and another leg, you just have two different semicircles. You get these points, you got the triangle. So this angle is congruent to this one. So whatever is left is supposed to be this angle. I'm using any triangle basically here. It doesn't really matter. I don't want you to have an impression that I have a triangle. I don't have a triangle. I have just an angle basically. But if I have an angle, I can always build any right triangle with this angle as one of the acute angles. So basically whatever is left, actually probably the easier way, not actually the easier way, but just another way what you can do is if you have an angle, you can just take any point and drive perpendicular until it crosses another side of this angle and whatever you have here is basically the second acute angle. But to draw a perpendicular is probably not easier than to subtract the angles the way I did. So just two different solutions in this case. Right, construct a straight line parallel to a given straight line and position it from it on a given distance. So you have a straight line and you have some kind of a segment which constitutes a distance which you have to draw another line parallel to this one on this distance. Well, how can you do it?  How to draw a perpendicular through a line I'm not really discussing. You're supposed to know from previous lectures. So that's easy. By sect an angle if its vertex is not reachable. Oh, that's an interesting point. So consider you have an angle which you have to bisect. Well, basically you know how to bisect the angle. You can just choose for instance any radius, have two marks with the same radius here. You can have another radius a little bigger then you can draw something like this and it will be a bisector and it's very easy to prove basically because this side is equal to this side, this side is equal to this side, and this one is common. So you have a couple of triangles basically equal. That's actually besides the point. This is an old problem which we have solved before. You have to know the vertex in this case. But what if you don't know the vertex? What if you have from this angle it somehow cut and you don't see this piece? Well, what should you do in this case? Well, you can't really have the same construction. You can't have these equal segments from the vertex because we don't have the vertices. So what should we do? But if you remember we had a problem before, the problem like this. Let me go back to my original drawing. If you have an angle and you have two parallel lines on the same distance from the angle, from the angle sides. So this side is on the same distance as this one. Then the bisector is the same for both angles. So you can basically go back to the lectures where the proof actually is. But you feel that this is right actually, right? So if you don't have this vertex, if it's not reachable, it's easier if I would just erase everything and draw it again. So if you do not have, so you have one side and another side of an angle. So if you will be able to come up with a way to draw one parallel line on some distance, doesn't matter on which distance, what matter is that it's supposed to be the same for this side and for this side. So for this side and for this side. So if they cross somewhere on this part of the plane which is accessible for you, then you can just have a bisector of this angle and that would be a bisector of this as well using that theorem which I was just referring before. So all you have to know is basically what kind of distance to choose. Well, this is actually easier. What you can do is the problem basically to make sure that you hit the right distance. Because you see, if you use a small distance, let's say this one and this one. Again, these lines will not intersect in the known part of the plane.  So how to choose it? Well, here is something which I can suggest. I'm sure there are many different ways to do it. Well, just connect two points. It doesn't really matter which ones. From this point, you draw a parallel line to this one. Then you measure this distance and using this distance, draw a perpendicular here and draw another one. So this distance is equal to this distance. These lines will definitely cross in the known part because you are actually going away from it. And having the crossing point, you have an angle which you can bisect and you know it will be a bisector of the whole angle here. So what's the most important part? To find basically the distance large enough so these two parallel lines will cross in the known part of the universe. I hope I'm not too fast. If I am sending an email and I repeat something. Given a straight line, point not on it and an angle. Straight line, point not on it and an angle. So there is a straight line, point and an angle. Okay? Construct a new line that contains a given point and forms a given angle with a given line. So we have to construct basically the line which has the same angle as this line. How to do it? Well actually it's very easy. First of all, instead of angle, let's just make it a triangle and do the triangle here. Have this piece, then radius and another radius have another point. Do the triangle by three sides. So this angle is what you need. Now from this line, you can always draw a line parallel to this one and since they are parallel, these angles are corresponding with this transversal. So this line parallel to this one will be the one which we need. Given an angle and a point inside it. Okay? An angle and a point inside it. Construct a line intersecting both lengths of the angle and containing a given point such that the segment of this line between its points, the intersection with the left, is divided into two congruent parts. Okay, so it's something like this. So we have to find the line which goes through this point in such a way that these two are equal to each other. Alright, so what can we do about it? Let me think. What if you draw a line parallel to this one and parallel to this one? Will that help? I don't know, let's think about it. These two triangles are obviously the same. So these are equal sides. So what can we build based on this? So you have an angle m x and we have p. This is not m, but we have to find out which. These lines are known. This is something like m and this is r. Okay. So basically what we know is we have the angle and we can construct two parallel lines so we have the parallelogram. Okay. What else do we know? That's not the way to do it. Yes, this is the proper way. Now, that I understand. You see, since triangle, let's consider this particular triangle, call it what, AB. AB x. In this triangle, AB is divided in half by point p. The line p r is parallel to line A x, which means it divides this, A xB into two congruent parts. So if you know the point r, you can always take this distance and make exactly the same segment here and the end of the segment would be the point p. So how to construct it? You don't really need this line actually. You don't need this line.  This is an equal distance and that would be the point p. Notice that I did not really prepare myself for these problems. I'm just trying to solve them on the way and I'm thinking basically together with you if you're following me. All right. Okay, this is the last one. Given a segment, two parallel lines and point in between. Two parallel lines, point in between and some kind of segment. Construct a traversal that intersects both parallel lines contains given point in such a way that it's segment between the intersection with parallel lines is congruent to a given segment. Well, in this particular picture you belong to segment I guess. Something like this. Okay, so we have to construct some kind of a line which is intersecting both parallel lines contains our point and the length of this segment to the length of this segment. Well, it's actually easy. You pick any point, any other point on one of the lines using this as a radius mark a point which makes this particular segment congruent to this one and now all you have to do is from this point draw a line parallel to this and since these are parallel it's a parallelogram so they are congruent to each other and congruent to this particular segment. Well, that's it. That was the last problem in this series number four. I still have other four series. I think I have eight all together. All right, so don't forget that Unisor.com is an excellent source of information for advanced level mathematics and a certain number of relatively rigorously proven theorems and properties and parents and supervisors will have the ability to control the educational process of their children and students by basically signing in as a parent and enrolling your child or your student into this or that particular series of lectures and exams which you can check how your student actually did with the exams with the score basically and decide whether to repeat the same course again if the score is not high enough or just pass it and go forward. For home schooling it's excellent. All right, thanks very much and good luck.


So I'm going to try to give you some good content today and something unique and kind of new too as far as disclosure. Just a path that I took that I found that worked pretty well and I hope you enjoy that. So just moving on here, here's the obligatory speaker side and just worked for Cisco Systems with the stat team there, internal product security testing, that's kind of where I cut my teeth in this industry and worked with some great people there. After that it's tipping point and work with some nonprofits and independent security research. Now I work with the University of Florida and the Health Science Center which is a teaching hospital and we face a number of tremendous challenges there, especially with medical device security and patching and upgrades. It goes way beyond compliance issues in that environment. So I founded the MedSec group on LinkedIn and if you've interest in medical device security I think that's going to be a very interesting area over the next few years. And we'll see how many lawyers come out of the woodwork when that stuff starts happening. Just a brief overview, I did some past security research on VoIP phones back 2005, 2006. And if you saw HDM's talk which is actually going on now in a skybox, so that's a consideration too. Just some basic VX works that he built on which is great. And just a quick rant, so it's really nice to see some ladies here. Big hand for the ladies.  We are missing so much by not engaging women and bringing women into this field. We're missing so much. Just really try to consider that and reach out to women who express an interest in security. I'm not just trying to get laid here either, I really mean this. So we're going to talk today about electronic door access controllers and I refer to them as EDAC, just a short acronym, trends, landscape, some of the architecture and major vendors and I'm going to go through a real world analysis which has been going on for, you know, with the full disclosure process and everything up to about a couple months ago and it started in October of last year. So that device is the S2 security net box and this is just one device in this industry but I think it's representative of a lot of the technology that's out there. And I really kind of beat up this company and I pushed it to the edge as far as them, you know, threatening to lawyer up on me and it got a little hairy at times.  If you're looking for something sexy, this is really the wrong talk.   So I'm going to talk about, you know, some of the tax and vulnerabilities and then get into countermeasures and recommendations too. So here you're learning outcomes and, you know, you're going to gain some awareness of what these systems are, who the players are. There's specific pen testing knowledge and additions to tools that are out there that I've submitted signatures and what not to. So you'll be able to actually do pen testing on this particular device and be able to find it after this talk. So my idea is about research and testing methods. Some of this has to do more with soft research as far as reading up and accessing specialized databases, more than just, you know, regular web searching. And the twist to DEF CON here is benefiting the EFF via ethical hacking. So here's some choice quotations. And I'll start with this one at the bottom first, which is, you know, one that's often been quoted in the security industry and that comes from Attorney General Janet Reno. Now the context for this was GAO, Government Accountability Office, did penetration testing on their physical locations. Several offices back in 1999, 2000 timeframe. And this is an oft used quote in security about, you know, anytime I think you expose vulnerabilities it's a good thing. So this top quotation is from the S2 security CEO and it's when hackers put viruses on your home computer it's a nuisance. When they unlock doors at your facility it's a nightmare. I would certainly agree with that. And that article goes back to 2004 and I pulled that using specialized databases so it's not the kind of thing that you'd find out on Google. What I'm getting at here is that when you're kind of butting heads with a company it really helps to have this kind of information and that you can pull this kind of quotation that they stated and say, well this is what you said. And I've sprinkled that throughout this presentation so you'll see more of that as we go along. So just kind of a broad overview of the technology here of electronic door access controllers. Really looking at a trend towards using IP. So a lot of this is used proprietary protocols and closed systems in the past. What they're trying to do is leverage all these other systems that are in place. So you've got your cameras, you've got DVRs and they're also adding in other building functionality. So you've got elevators and alarms and HVAC systems, temperature control. So it feels kind of hot up here right now. I hope we don't have one here. I think it's just the light. Another thing you'll see is some of these are integrating with LDAP systems. So where they want to go with this is that, you know, somebody gets fired in an organization or they quit and they can just go to the LDAP directory and move that entry and that will populate out and disconnect their email, disconnect all their access and disconnect their badge too by communicating with the system. This particular system doesn't use that, the S2, but there are others that do. There's a lot of vendors in this space and the phones are starting to appear. So Cisco made an acquisition last year, Richard Zeta and that's an embedded controller system and just about a month and a half ago they released a number of vulnerabilities on that controller. Any other names you'll recognize up here such as Bosch and Lanelle and Honeywell and HID. Just for clarification here, I'm not talking about attacking the HID readers themselves. These are the backend systems that have database functionality and which are the controllers for those controllers. So this is a little bit of a dig on facilities people, but I actually have a big thanks to a facilities person who was coming into the company or actually when I was working at this company, he came to me and he said, you know, we've got this company coming to push this new controller system for our doors and I don't like this interwebby stuff and can you take a look at it. So that's really where this started. So a big thanks to him. But here's what you see with these is, you know, long deployments, they're managed by building facilities people and they're kind of stuck in a closet and just forgotten and you get pushback from physical security people too. So where I work, they don't even let me near these things. So I've been working my way into that, but it's a tough crowd. And then patching upgrades, maintenance, policies, all those kind of fall by the wayside with this because they're just out of sight, out of mind, even though they're used every day. One big thing is that you'll see third party local service contractors, they'll do the management of the system. So nobody in house really has an idea of what this is. This guy kind of comes in once a couple months or once a quarter, does some stuff, adds some people, maybe has somebody local who adds the people and that's about it. So if anyone had really questions about the importance of this type of security, this Yale murder happened last August in Yale University in Connecticut. And this guy here, his name is Raymond J. Clarke. And that's the arrest affidavit, a screenshot of that. He killed that young woman below, Annie Lee, in the lab. And he was allowed to, by the police, to stay there and he was cleaning up and he was taking care of these animals in this animal lab. And he was actually taking steps to cover his tracks. So he was scrubbing stuff. He, it was awful story, but it's an amazing story, but it's awful. You know, he took this woman, he strangled her and he stuffed her body into the wall of a men's room at Yale in this facility. So what I'm getting at here is that they really start to focus and hone in on this guy as a suspect because of the building access control system, because they knew that people needed IDs. And then here, if you can see this, if you can go through this, it'll, this is analysis conducted on Clarke's electronic key usage. And it shows all the different rooms. And then they show the times that he and Ms. Lee were together in the same room. And then the last time she used her badge. So this is really how they honed in on this guy. Good afternoon. You guys were doing so well. I was so hoping not to have to come up here and do one of these. Somebody, or other several somebodies, are stiffing Katie's. They're walking out on $100 plus bills. Let's apply social networking rules and make sure that doesn't keep happening, please.  They're treating us really well, they're taking good care of us.  Please don't do that. If you did do that, please go back and pay your bill. Okay? Thank you. And it's not just once. This is like seven or eight people have done this. Okay, a little bit of a bummer. I got intimidated by him coming up on a stage.  And I would say that there's video of all this too around here in case you all weren't thinking and you were just dumbed up on booze and a hangover and had a hacker con. So this whole place is videotaped. Every move. So they may just very well go back and track you guys. So go beg for forgiveness. Okay, moving on. So like I said, I'm focusing on a particular vendor. I actually thought that they were coming up to tell me that lawyers got involved and I was pulled. Because we all know how well that works out, right?  Perfect. I'm going to start looking at boats. So one thing that's interesting in this space in this industry is that there's a lot of rebranding of these boxes. So this box is sold under multiple brand names. It's built by S2 security and marketed as a net box. Then it's distributed by Lanier and rebranded as the Emerge 50 and 5000 platforms. And then it's resold by Sonitrol, which a lot of people are familiar with Sonitrol. You may even have that at your house as a service. And it's rebranded by them as a commercial door access control, physical control service. So they come in, they manage the box, they deploy it. This is the actual box itself and it's really not much to look at.  And that's really what I focused on. So it's probably not much different than this badge in some ways. Thank you, by the way, EFF for this. And I'll get to that, too. But the application modules are what tie into the HID controllers. And again, you know, I focus on the network controller piece. This is the IP side that I'm attacking. Much smarter people than me, like, you know, Chris Pageant, for example, are working on the HID stuff. And that's just great.  I'm just humbled to be in the same room. So here's an example of their S2 security architecture. And you see how you have this head-in box here. And that's tied in with the IP video cameras. And then here's a PC with a browser, which might be a guard station that logs in with a limited account. And so when somebody swipes in through, comes in, their picture pops up. And a guard has limited access and can view what's happening at that station. And then, you know, you have the World Wide Web here, VPN or WAN. And then might go to another site, a facility, too, where you have another box. And this box is actually a head-in to, you know, perhaps, oops, perhaps that one, or even the, so they can act independently or they can network together. So when doing research on this, a lot of times, you know, it's real tempting to just jump into the packets, right? Fire the tools, let's get the signatures. One thing I really want to stress is that it's important to go out and do your research and do your reading on the company. So go through their security documentation or case studies or press releases. Of course, use the search engines. But really, if there's one thing that I can stress to you taking away from this presentation, and this will work across any research that you do. And that's, it's well worth a trip to a college campus where anyone can sit down on a terminal and use very high-end subscription databases. LexusNexus, ABI Inform, hundreds of others. And this is a hidden trove of information that you can get to and anyone can use it. You don't have to be a student, you can just scroll into the university and ask the librarian for help. So from one document, I was able to determine, this is a case study published by SQL and S2 together. And from one document, I was able to get so much information. You know, I found out, okay, they're using SQL, they're using Samba, Linux distribution is the same as that Zorus hand-held from a few years back. Right? Kind of cool. Processor information. Now these last three items really caught my eye, and this is the kind of stuff that should pique your interest right away. If they tell, if they document, write down or say that it only took them 15 months from design to customer shipping, that's kind of scary. That's very fast and it's commendable. But, you know, there's obviously a lot of questions that come into that. They say they don't have much experience with open source. Okay? Definitely, you know, my ears prick up when I hear that. And then the key here is the MySQL is used to store everything. So the whole system is in that database. So that gives me a real target to focus in on.  And when I can come back to them and say, well, look, you know, on your website here or in this document, you say that it's safe to deploy this system across any network, even the public internet. Okay? You say that remote locations are easily handled. And you say that this thing can operate for years, years, without maintenance of any kind. Okay?  Yeah, that sounds great. You see where this is going.  So I'm going to dive into some of the components here of this NetBox. And what we've got here is an HTTP server and then MySQL and then later versions have Postgres. So obviously, as you know, these devices go through different builds and they add more features, they're changing things up a bit, but those are the two databases that they use. Then they have this NMCOM custom application that they wrote and I could talk about that a little longer or a little later, but that's a really interesting thing and I think you'll like what I talk about there. And then of course you see like FTP and Telnet on security devices, right? So their HTTP server is the go ahead web server. And in my opinion, it's a poor choice. So you're looking at 16 CVEs out there and there could be more, I just stopped searching after a while. I was like, well, what else? But not to beat up on go ahead too much, but it doesn't seem like they've been very responsive to these vulnerabilities. And so if you look at that CVE in 2002, go ahead was contacted on three different occasions in the last three months, but they supplied them with no meaningful response. Now what's interesting about go ahead web server is that it's open source and it's free and you can download it from them for no cost and I don't even think you have to register. But the thing is, is if you're gonna offer and serve up open source web package, do us the courtesy and try to maintain it. So here's one of those quotations on the bottom here and this is from John L. Moss, he's the S2 security CEO and this is data security is a challenge and unfortunately not everyone has risen to it. So when you look at the SQL server, I was like, wow, this is kind of weird, okay. Typical, you know, I was listening on TCP 3306, it was outdated and I was like, 4.0, that really sounds kind of old. I was like, how old is it? End of life, I go to MySQL product archives, forget end of life, end of download, okay. You cannot download this SQL 4.0 from the MySQL product archives and that's down here. So I mean, it's not even worth their bandwidth to host these, you know, even for posterity, even just for archival purposes. So that's in a production server for a physical control unit for your facility. That's pretty troubling. The NMCOM is at TCP service and what this thing does is, the service does is it performs multicast discovery of the HID nodes on the network and it's a custom daemon like I mentioned and then there's a patent. So this goes back to doing your research and looking at all those other information resources. So I go and I look for patents filed by this company and then by certain individuals in the company and I found this system and method to configure network mode. So there's a tiny URL there and you can go read the patent but it reads like an RFC and this is the perfect type of application that you want to start fuzzing right away and you can read through that and almost grep for must not in this patent. Just like you would do in an RFC, grep for must not and start focusing on that area for your targets. So FTP and Telnet. I mean clear text protocols for security device. You see this quotation on the bottom here. We see some vendors fitting their serial devices with Telnet adapters. We're simply sitting on the network transmitting unsecured serial data. In your own device here that you guys build, you have Telnet to manage it and by the way that runs as root and that's new, I haven't talked about that before but there's diagnostic tools that are built into this system that you can access as administrator it'll give you the tar ball of the diagnostic file that you would send to S2 for debugging and help. But if you go through that, you start seeing directory listings, you start seeing the permission setting on daemons and all kinds of stuff. So that's bad. Telnet's bad but then running as root is really, really bad. And then the security documentation you see here is they'll say this is a screenshot. So network administrator tasks on the FTP server create a username, password directory. A password is optional. The backup directory must be created at the root level on the FTP server. I mean it's like 1997 stuff that you see here. So what's really interesting about these and I alluded to this at the beginning is all these new features in this convergence. So that's the other thing we'll walk out of here. Think about, when you think about security systems, don't think of them as closed. Think about this convergence. Think they're tied into the cameras. There's gonna be communication information and configuration information that's in those cameras to make sure that they can talk back. If you get on a DVR in a network, what's that DVR talking to? There's a lot of network devices that are gonna be talking to these and depending on the configuration and the licensing scheme, you'll come across this. So again, that's increasing the attack service and you really gotta wonder like, how are they using voiceover IP in a system like this? The burglar APIs. So here's some features. You can pull this up and look at a building's floor plans. That's very useful if you're gonna go in and try to steal a server from them. Here's one of the vulnerabilities. This was the first one that I found and this is a remote unauthenticated factory reset via a crafted URL. You know, when I was putting these slides together, I was like, what else can I write here? I... I... You know, it's like the box. You know, it puts the box in a condition that when it arrived on your doorstep. Okay, it wipes everything. There's some back and forth with S2 about what the actual impact is. They say that there's some configuration that's pushed out to the nodes and to the HID readers and that there's not gonna be catastrophic impacts like your cards aren't gonna work on the doors. But again, I only had this for a limited time, about a week, hands on and didn't really have the chance to do that. But hey, it's a factory reset. I mean, there's not much you can say to that from no auth. Here's the other one that came out and this is the access to the backup database. So this is an unauthorized, unauthenticated attacker. You can download via HTTP the database backups. Now it's a nightly DB that's hard-coded, okay, and cron. So what that tells you is that you've got a file name here that's predictable, right? You know the time range that it's gonna run and then you know the naming convention. So you can do almost blind W gets for this across systems without knowing anything about it. And you're gonna just do those requests, which like is horrible logging on this thing. You really have no idea when you're getting attacked. So an attacker gets that backup database. Again, referring to that document that MySQL and S2 put out together, everything's in the database, right? Everything, all your cards, all your names, all your credentials, floor plans, employee photographs, everything is in the database. So here it is. You extract the admin MySQL 64-bit hash, okay? And that affects both the 2x and 3x series with MySQL and Postgres. And then you can crack that hash, which is trivial. And then there's the CVE for that. So once you have that, I mean, the attacker has admin access in the box. What can that attacker do? Well, how about opening some doors? Okay, everybody likes that. It can open a door right now and there's that smokers area down there, right?  Or you can schedule it for ODark 100 and come back with your crew. So here are the cameras, okay? So the cameras are in the database too, right? And this is actually a screenshot from their demo that was online and the license actually just expired today. So I can't go to it live, but this is from their demo box.  And this affects the 2X and 3X systems and now the attacker owns all the IP cameras. So what's great here is I'm not just picking on S2 because there's this perception across the industry. So this quotation on the bottom is from Justin Lott and that's from Bosch Security Marketing and Bosch is in this EDAC space as well. And he says, most hackers don't care about watching your lobby. If they gain access to the network, they're gonna go after financial data and trade secrets. I don't know what you're talking about, okay? I think a lot of people who are trying to attack a building and go in there are gonna be interested in looking at the video and looking at the webcams. I would certainly be. So here's the DVRs and digital video recorders. The user pass to those is in the backup. And another thing is there's poor recommendations here by them. And so here it is, they recommend keeping the default user and password on this, right? I mean, it says right down here at the bottom, we recommend that you use these defaults. And then there's some more HTTP directory grief that I found later on because I was like, oh, I didn't check for this, I didn't check for this and node logs, which are the logs of the devices authenticating back in the nodes and the card swipes and all that fun stuff and then employee photographs being able to pull those directly. Now here's some remote fingerprinting that's come up and their Mac OID is registered to S2 security. So that makes it much easier to identify one of these devices just by its Mac address. And then as I know it before, I contributed to some of the open source tools out there. So there's an end map service fingerprint for this and end map 5.2.0. And then another thing is for every IP, for these devices, they left in a blank.html page. So that's another way to look for these and confirm that you actually have one and props to Skip Fish on finding that. Shodan, Shodan is a real game changer in my opinion. And I have to give huge props to Shodan on this because I was getting a lot of pushback from S2 about saying that they're difficult to find, that they're not on the internet and all that. And actually the two below that are direct quotations from that, which is it's behind a firewall accessible only by VPN, deep within the corporate network, whatever that means, right? The front line is everywhere, we know that. So the targeted search is for this, unique fingerprint and it's been going up. So back in March, there was 150 of these devices on the network that you could identify. Now there's 341 and then here's the search that I did today. So 341 and then here's the string that I'm doing. So here's the go ahead web server, right? Looking for login ASP, the no cache and the must revalidate. And then you see those strings showing up in the results down here. So I don't have internet access on this, I'm not gonna click on any of these URLs, but I'm very, very confident that those are all in that two boxes out there of some variant or another. So really getting some of the recommendations here, it's just not right unless you have a wall cat. Something that you don't think is a threat, you just bring it up and it's like an individual, right? So it's just some guy out there who got a hold of your box for a week, what could he do? What could he find? What impact could he have? How could he change our business processes? You never know, but you get your nose. It's a whole nother story. So I've made recommendations here for them to conduct security evaluations on your products. Better your deployment guides, your third party integration, right? Those web cameras, those DVRs, don't wanna see that kind of bad stuff. And then improving their logging. Like I mentioned before, the logging is really bad on this. I mean, there's just nothing there. So you don't even know. I mean, you can tell when somebody else logged in as an admin or another user and that's about the extent of it. Being able to offload those logs to a log server to try to maintain some integrity would really be good too. Use better HTTP daemon, HTTPS by default, and then I would always recommend to any vendor, you wanna keep yourself a moving target. So modify those banners, reduce that fingerprint. If you see your device is showing up in Shodan or other search engines like that, you don't modify it so that your customers can get some more protection down the road. And of course, you have to be telnet, move noses, secure protocols as well. Customers, customers gotta push back. They gotta demand better security. They gotta go all the way down the chain here. So starting from the vendors and then going to third-party resellers, all those local guys coming in, print this stuff out, hand it to them, and say, you know, what are you guys doing about this? How are you ensuring us? Gotta manage this stuff just like any other system. Security reviews, the patching, the change management, all that tedious stuff that is so necessary. And then, of course, the technical side. Isolating these and using VLANs and Mac-off, VPNs, restricting IP, good stuff. So one of the outcomes of this, and this was actually sent to me, this was sent to me by a competitor of S2. And I said, hey, did you see this letter that went out to the integrators? And I was like, oh, that's interesting. And it's from John Elmas, the CEO to our system integrators. I have had a number of questions recently about how to secure network physical security systems. And I'm writing to address this important subject. So the threat. This may sound like paranoia, but it's not. There are thousands of people you don't know all over the world who are actively trying to break into your new typo security systems right now. In a physical security world, we are not used to dealing with invisible threats from malicious people who don't know where we are and thousands of miles away. We have them. So it's great to see this kind of recognition from a company and reaching out to their integrators. But this was forced recognition of the problem. This letter is a result of me going out there, me letting CERT know about these vulnerabilities, communicating with CERT. Huge props to CERT, CERTCC and US CERT, because I couldn't have done it without them. And those guys pushed, too. They pushed these guys, and it was great to see. But a problem with that, not with CERT, but with this letter, is that it goes down, it continues on, hackers, hackers bad. And then here's protecting your system, right? Which is great. So put your systems behind a firewall, change your passwords, use strong passwords, VLANs, VPNs, maintain your software. So that's great to see. But then up here, how we deal with vulnerabilities. And he says, S2 works with CERT, a non-profit organization that responsibly handles vulnerability resolution. CERT, funded in part by DHS, learns about vulnerabilities. Well, the thing is, is they reference US CERT here, but I coordinated mainly with CERTCC.  So that's the kind of thing that we wanna change. We wanna make sure that when a company puts out a statement like this, that they actually are referring to the right people, security people who have assisted us in driving these issues to resolution. Gotta give them the respect in where it's due. So back at CarolinaCon, which is actually a great conference, very intimate, highly recommended, and those guys did a great job there. So they recorded me and it found its way onto the web. And what I had made there is an offer, an open offer to any vendor in this space. And here's the offer.  In turn, in recognition of your donation, this isn't a quid pro quo, in recognition of your donation, which could be an amount based on going back 10 years ago, the line was people spend more on their coffee budgets than they do on security. That's definitely not the case anymore, but with product security, it is in some cases. So I say, okay, give your coffee budget to EFF in the donation, or I'm also considering the political contributions done by the top executives, okay, that's public information and it's also free speech on their side. If you're not following that at all, corporations now can give political contributions and it's free speech and there may not even be any disclosure at that. So come up with creative ways here of setting a price point. I'll sign an NDA and then I'll do an eval in the box. I'll do a report and an out brief and I may pull in other engineers under this type of testing and have them under NDA as well. So I've done this with a colleague at work and the John Sawyer, who's right down there and throwing the support and it's great because having two minds is always better than one and he compliments a lot of my skills. So I'm not coming in here with an ego on this stuff. It's like, obviously there's gonna be things I can miss. If I can bring in another smart person, that's fantastic and all the better. So we set this up. I'll do an eval box, report and an out brief and then planning here is additional advice for product security response. So when talking with these vendors, do a security page, have an email, point of contact, your PGP key up there, all the good things that we like to see. I mean, how many times on the mailing list are we seeing does anybody have a security contact for X company? It's tedious and in this day and age, we just don't have the time for that. Introductions to cert, CC, US cert and then suggesting strategic security conference support.  So here it is so far. So far, I've been approached by two EDAC companies and the process has been talk, establish a trust, which is everything, right? I mean, you gotta have that trust and that's taken some hand-holding and back and forth but there's some trepidation. One when it was, hey, Sean, this isn't gonna end up on some blog post, is it? And those are the kinds of fears and concerns that you need to assuage with these people and say, no, we got this under NDA. These are the objectives. I'm not looking to make money off of this. I'm looking to better the security. It's good reputation building. It's good experience for me too, of course. So the first company donated to EFF and they enabled me to win this contest. There was plenty of other great people who supported me in that set up for two. Props again to John Sawyer. He threw the flag out there and got some folks to contribute but together we raised $2,560 for EFF just from this one evaluation and from the support of folks. Got the room, got the nifty badge, met some really cool people through this and I think it's just kind of a unique way to enable some security testing. So I kind of went quickly through this and maybe a little faster than I wanted to. Too many mountain do's but I'm certainly open to any questions and don't feel obligated to come up here now. I mean I'm gonna be around so feel free to grab me. My contact information is here and that's it.