Yeah, the overview effect is this sort of overwhelming experience, also a sort of change of mentality that astronauts can experience when they look at Earth from space, and many of them have reported on this when they came back. I must say not all of them, some of them sort of seemed very immune to the experience, but a lot of the astronauts come back a little changed, having seen how Earth is actually, it's not a collection of all different places, it's a unity, it's like one animal, it really changes your life.


The total mission is to build a bridging site, a bridging training site, I should say, for our 12 Charleys, which are our bridging engineers. Our scope of work in this project is to build the pad that you can see behind me, and you can just, well, you would be able to, when these machines move out of the way, you can see the start of a road. It was about 540 linear feet from the edge of the pad all the way back up to the roadway that exists here. The intent here is to provide a permanent site for those bridging units to come in to be able to provide training on those pieces of equipment and to provide force rejection to all of our allies overseas. We started with scraping out road 1 to lead into the gravel pad that's behind me, and we put about 6 inches of base course gravel down, graded that out, padded it down with the roller, and then we put 3 inches of fine course down, and then lead it into this pad and put about 8 inches of base course on this whole pad, and now we're doing the fine. The 492 got tasked with building the bridge abutment for the bridge builders to conduct their training. So from the top of the abutment down to the top of the footing, that's actually 3 feet deep. So here we got about a foot to 18 inches exposed, so at least double that going down. The abutment's 23 feet long, 6 foot 8 feet wide. That was a total of about 18 yards of concrete. Below the abutment, it's sitting on a footing, which is 7 foot 8 inches wide by 24 feet long, 1 foot deep. I believe we poured that at just under 7 and a half yards. Inside the abutment is hundreds and hundreds of lineal feet of rebar, running horizontal, vertical, perpendicular, and that's all tied together, and that's just going to hold this thing together when it gets all that weight pushed across it.


will be able to pick up his first points as Bradford manager as they take a swing in front of Carey. Following his surprise appointment as Derek Adam's successor, he was given a rude awakening in the first match in charge, going down 2-0 to Mansfield. There's much to be done to make the bouncer to get to the course. Twisted arrive at West Yorkshire in the next form, with a 3-0 losing to him at a 6-0. He's still clear with his own discrimination.  Bradford with a big chance, well blocked by Wollacott. I'm the star for the Vantimes, came to Callum Cook. Wollacott got down in time, sent in by Folds, all the way to the back post, and it was Andy Cook with the chance there. Folds his ball in, it was an absolute cracker, went past four defenders. Swindon haven't had too much of the ball thus far. Not this man on the ball as often as possible, Johnny Williams. I don't know if he's going to pass balls like that. That's a good challenge though. Head through to McCurdy. Ronnie goes, Harry McCurdy, and it's just about cleared by Yan Songo. Folds can't get it away, crosses sent in, and Gallup by Alex Bass. They start to this game, Swindon now coming down the other end, and there danger man McCurdy. Not sure he was trying to put it in the back of the net.  Here's Gillied, back to Folds. It crosses in, and it's a great finish from Gareth Evans. But by someone who has been out to the cold recently, Gareth Evans gets his first for over a year. A hopeful ball in by Folds. Almost bashes his teammate out of the way, but for good reason. What a finish. It's whipped in, Bradford can clear. More consistent to keep up their playoff charge. Here comes Johnny Williams in by Williams, and there is McCurdy. Swindon's Talisman, he's at it again. Bradford show their frailties. Williams with the space to cross. That's a really deft finish. Afflict with the outside of the boot. Some positives from this performance so far. We could have another Gillied shot saved by Wallachop just well. Forward at least, Bradford. Afflict really good in this first half. Gillied's shot was saved. Amayo's throw. Pass does find Johnny Williams. He's got some good support. It's a high ball in by Yandolo. And the shot is cleared off the line. It's going to be a booking for Lewis Reed. Down the other end. Sidefoot volley, cleared by Claudio Conner. Sent in by Laverie. Can't prevent the corner. And it's hit the crossbar. What a chance for Bradford. This time a left foot delivery. It's hit the crossbar again. Believable from Cork. It was folds the first time. Save man to deliver. Get the song out. This turn to rattle the woodwork. Bolts. Laverie. Support from Watts. Sent in by Watts. Oh, was that a hump? There's a whack of the finger. The referee isn't interested in the protests. Decepted by Watts. Great pass forward. Curdie. Oh, and it's a really good stop from Watts. Unexpected to go for goal from that range. But in fairness, he had no one around him for support. It's a clean, crisp strike. And to add a time now, Adolo's ball in. Known for ports between January. He's looking like a really good signing. The goalkeeper. No messing from Swindon. Here's Reed. Pass comes out. He's clattered his man. He's a penalty goalkeeper who's played so well. But he came out. Clattered, Yandolo. Now a huge opportunity for Jack Payne. And Swindon of Shawley. But it's not if you're a Swindon town far. Payne steps up and showed great composure. It will go on for Mark Hughes to get his first point in charge of Bradford. It all started so well, taking the lead through Garret Edmonds. But Harry McGurdy equalised a couple of minutes later on a deep into injury time. It was Jack Payne's penalty to make the score line. Bradford won. Swindon too.


Hello Earth citizens. In this video I will show you a 10 minute routine to do when you have a lot of anger. So during those moments when you have a rush of anger and you don't know what to do and you don't know how to calm it down, take tips from this exercise and this routine to help calm that wave of anger that comes through you. So when you have anger first and foremost you have to recognize that anger is a temporary state. Think of anger and any other emotion actually but for this video we're going to talk about anger. Think about anger as a passing guest inside of your house. So like any guests they come and they will go.  See the emotion as a passing guest first and foremost. Secondly when you are angry, do not, do not, not, not, not, not, act. Don't say anything, don't do anything. Don't react in this angry emotional state because whatever you say, whatever you do when you're clouded by this anger, you're going to 1,000% regret later on.  Okay so first keep your feet shoulder-width apart.  Like there's a cloud of fire surrounding you when you're angry, right? So let's shake off and break apart this cloud of anger that's around you first and foremost to clear your energy.  Through your movement, through your breathing, we're going to shake off, break up this cloud of anger around you to start. So keep your feet shoulder-width apart and first shake from your knees. Shake from your knees and shake a little vigorously.  And especially if you're not... stay. Shake a little vigorously.  Relax every part of your body.  Shake, shake, shake.  When you're angry, every single person has a different part that has a lot of pain and heaviness. For me in particular when I'm angry, I feel it in my chest and I feel it in my head. So if that's the case, focus on whatever part hurts the most from your anger. Shake, shake, shake. Shake vigorously and shake with the intention of brushing this anger off. Get it out of your system. Let it out, let it out, let it pass. Like a passing wave, a passing guest, let it out of your body by shaking it off.  You don't need to worry about anything else. Don't think about the person, don't think about the situation. Just think about breaking up this cloud of anger. The more vigorous you shake, the more this energy will break up faster. So I recommend shaking very vigorously. Anything is okay. Shake it off. Relax every part of your body from your head all the way down to your toes. You can jump to anything is okay. Jump kick. Make your body free. Make your body free.  Let's shake more, shake more. Two more minutes, two more minutes, shake it off, shake it off. In two minutes, totally focused and change your energy. Change your energy. Shake, shake. Anything is okay. Shake, shake with the intention of breaking up this cloud of energy, cloud of anger. If you feel it in your chest, let out a gentle, slow it down. Keep moving, keep moving.  Slow it down. Slow it down. Focus on the energy inside of your body. Slow it down. Slow it down. Slow it down. Feel your joints.  Now feel your muscles. As you move, feel your muscles. Slow it down. Feel. Feel your muscles. Feel your muscles. Muscles in your shoulders, neck, head, arms, abdomen, hips, legs. Feel your muscles. Slow it down even more. Slow down your breath. Feel your muscles moving in every direction. Keep moving. Keep moving. Keep flowing. Keep flowing. Keep letting your body become a vessel of energy. A vessel of energy. Keep flowing. Slow down. Slow down. Slow down. Even more. Now make your body movement even more fluid, focusing on your muscles, your joints, from your head to your fingertips, to your hips, knees, all the way to your toes. Move every muscle, every joint. Keep moving. Keep moving. But slow it down.   You are channeling your angry energy into healing energy. By feeling your body moving fluidly, focusing on the energy sensation, you are transmuting negative energy into positive energy. Now move fluidly, freely. Anything is okay. There's no right or wrong answer. Just move feeling the energy in your body. Anything is okay. Anything is okay. Make sure every muscle, every bone, every part of your body is moving with energy. Keep moving. Keep moving. One more minute. Keep moving. Stay flowing with your body's energy. This is the most important part. Stay flowing with your body's energy. Flow. Flow. Feel your energy. Feel. Flow. Feel. Flow. And now slowly bring it even slower. Even slower. Slower. Slow down your movement even more. Slow down your breathing even more. Now very quietly feel your hands, arms, legs. If you're sensitive to energy, you will feel tingling in your body now. Focus on the tingling sensation or you might feel some warmth, heat, magnetic feeling, pushing and pulling. A cloud, fluffy like sensation surrounding your body. Anything is okay. Just feel that energy sensation. And now feel it in between your palms. Palms. Feel the tingling sensation, warmth, magnetism in between your palms. Focus on your palms. And now slowly bring your legs together. Hands by your side, palms facing forward. Stay connected with the energy sensation.  Exhale out through your mouth, palm down, push down.  Again, inhale, palm up. Embrace pure energy from the universe. Calm down, push down, heavy energy to your feet. Inhale, palm up. Exhale, palm down. Inhale, palm up. Exhale, palm down. Inhale, palm up. Exhale, palm down. Inhale through your nose. Exhale through your mouth. Feel your body's energy. Stay connected to your body's energy. Inhale. Exhale through your mouth. Inhale. Exhale. Inhale and through your nose.  Exhale through your mouth. Now push down your hot, angry energy down to the floor. Arms by your side. Slowly open your eyes and feel your body right now. How do you feel?  Does your thinking, your mind feel a lot more clearer than before? You did a great job. When you're angry, do not act, do not speak, do not react to the situation. Whenever you react in this cloud of anger, you will 1,000% regret what you just said or what you did. You will make a mistake. When you make mistakes between relationships, that's how people grow more apart. So resist the urge to react, shake off your energy, purify your energy like we just did through breathing, through movement, through focused intention of pushing energy out of your body, like this, before you speak, before you act and you will not make a mistake. To experience a full one-hour brain education-based class, please visit a local body and brain yoga studio near you.


As all the world knows, on last November 7th, the stars and stripes were raised over the port cities of North Africa. But it was not the first time that land had seen that flag at the head of an army. Tonight on the Cavalcade of America, we're going to tell a story 138 years old. The story of our first military exploits on those shores. The almost incredible tale of Bill Eaton, a swashbuckling Connecticut Yankee, who in 1805 sliced off and conquered Africa's richest province with only eight United States Marines and a handful of Arab mercenaries to help him. Carl Karmann suggested this astonishing and little-known story for Cavalcade, and Peter Lyon wrote the original radio play. Starring Joseph Cotton as Captain William Eaton, the hero of this African overture, the DuPont Company presents to the shores of Tripoli on the Cavalcade of America. I'll play it again with a prologue. It is a bright sunny morning in the year 1802. In the Norwich Courtyard of the Piratical Ruler of Tripoli, and under the personal supervision of the Bashar himself, a delicate diplomatic ceremony is in progress. Where is the Yankee prisoner I had ordered to watch, this little spectacle of wisdom? He is here, your magnificence. Bring him forth. I prefer not to turn my head. I see the Yankee is in chains. Good. Note carefully this little ceremony, Yankee. What's it all about? It's my work when you chop that Yankee flagpole, and when it falls, we are at war with your America. The flagpole nearly comes through. Freedom has a peculiar purpose, Bashar. It lends the state a great strength. Ah, the flagpole is chopped down. The Yankee flag is in the dirt. Look well at it, Americans. Now Tripoli is at war with the United States of America. That started it. Our play begins in the first years of the 19th century. Of the four fierce barbaric states, one is at war with the young United States of America. In one of the others, Tunis, William Eaton, played by Joseph Cotton, is American console. And every week, to William Eaton's office, come American merchant captains to tell an old and bitter story of tribute levied on American shipping. You thoroughly demanded $180 tribute from your captain. $180, Mr. Eaton. Only don't call it tribute. It's downright piracy. They're going up in their, uh, request. Oh, I'll say they're going up. Last time I put in at the Port of Tunis, I paid out 75 gold American dollars, never 75 too many. But 180. It must be something you can do, sir.  We're on the high seas. I want all the information you have, captain. Let's see. Cargo of nails and rum bound for Cairo and Athens. Right. Out to Boston. Mr. Farrer has held me up four days over my limit already. Can you do something? I'll do something, all right. I'll go over to the Bay's Palace right now. It's high time this piracy has stopped once and for all. Mr. Eaton, I assume business brings you to the Palace of the Day. That's right, Carmen. You are in too much of a hurry perhaps to stop in the courtyard and speak to the new Minister of Finance, Mr. Eaton. You? That's right, isn't it? Congratulations, ma'am. Many happy returns of the day. Hope I'll get along better with you. And I did with your predecessor. The first way, Mr. Eaton, and the only way to get along with Mr. Eaton, is to be prompt in your payment of debts to the state of June. Uh-huh. The old question of tribute money, is it? Carmen, I pay when I choose. Sometimes I pay if I choose. America must be a remarkable country, Mr. Eaton. It is such a young country and still so weak. Yet her counsel speaks with such a loud voice. You will kindly make the payment of tribute money for the year 1803 by Sunday. Will I?  He will be armed. And he will come straight back to your offices, Caraman Horsquip, with a very whip. He so much as dare set foot in my office's arms. As my mother used to teach me, one good threat deserves another. Maybe I shall call at your office myself, Mr. Eaton.  I rather think she would have advised me. Not to keep my treatment waiting, Caraman. I rather think she would have said, use your horse whip, Bill. The gentleman's waiting for it. Like that. Not like that. Like that. Like that. Like that. Like that. That's why it's been taken to the bay at once. He shall be made to answer this incest to the bay in Boston. He shall be made to answer this incest to the bay in Boston. He shall be made to answer this incest to the bay in Boston. The way of Tunis, defender of Mohammed, prince of princes, protector of Alhubau for Rites next to Mecca. So Mr. Eaton, you're in hot water. You disappoint me. You insist so strenuously on the role of headstrong young man. Magistat, your minister's seemed anxious for instruction on an American custom. Now I undertake to oblige him. This time you've gone too far Americans. But I'm a generous ruler, so I award you two coffers.  Well, I leave your imagination. I think you forget there is another alternative, Your Majesty. I'm going to allow you to sit and guess what it is until I return. You dare not return. We'll see about that after I've talked to the Secretary of State. I must say this is a surprise. It brings you all the way from Tunis without being recalled. In fact, sir, I left the country rather hurriedly at the urgent personal request of the day himself. The devil, you say? He hasn't declared war on us like the Bastion of Tripoli, has he? When I left there, but he may have done by now. That's why I'm in a hurry. To do what? Get back to North Africa, sir. Tripoli first, Tunis later. Tripoli? No, sir. We've been a war with Tripoli for two years. I know about that. I was in Africa when the Bastion cut our flag down. You're self-cuttermanly. He's the man I'm out to get. What are you talking about, sir? Will you have the time to make some sense? Mr. Madison, the point about you self-cuttermanly is that he's not the true Bastion of Tripoli. His brother Ahmed is the rightful Bastion. Yes, that's through him out of the country. Yes, and no one will...  I'll be brief. My idea is that Ahmed would go along with us and give us the support if we offered to get him his throne back. This part of the deal would be to stop old Parisi against our shipping and put an end to the man's for tribute money. This is a fantastic idea. First, do that to find his army. I know where he is. He's in Alexandria. From Alexandria, we strike at Durna. That's the richest of the Tripolitan province. No, no, no, no, no, no, no, no, no, just a minute. Are you seriously proposing to advance from Alexandria and Egypt all the way across that stretch of desert to Durna? Must be 500 miles. As a matter of fact, sir, it's 600. But it can be done, Mr. Madison, and I can do it. Eaton, you must be crazy. If you realize how big an army and navy we'd need for a march like that. Half a dozen Marines and two officers. Eight men in all. Mr. Eaton, I must admit at least that you're entertaining. I'm dead serious, sir. What do you want me to do? Sign your name to an order, appointing the American Naval Agent of the Mediterranean. Give the cooperation of our frigates now in those waters and leave the rest to me. Well, Mr. Eaton, if you're willing to take the consequences, I'll get you your order. Well, Mr. Eaton, you'll forgive me, but I think this is a reckless, unfortunate, and hopeless venture. Who's that to me? Here's a copy, sir.  You're not dead yet. Who are you? What do you want? Come to see me. I'm at Pasha. I wrote a letter. I'm Eaton. Will you meet him? The American? I'll try. This is Lieutenant O'Baron of the United States Marines. You follow me. Alone. Lead on. Now, wait a minute. I'm going to stick right with you. Alone. You come along. You, you stay here. I do nothing to the shots. I've got, hey, hey! That's what he means, business, sir. Tell him to get that scimitar away from here.  Take it easy. Take it easy.   Where's Armit? Which of you is Armit? I am Armit, gentlemen. You? Armit, good. Can I talk in front of these people here? Talk. They are friends, they are well. And listen, I'm in a hurry.  You'll be able to do what you like to your brother. You make me bash our game. I might. This won't cost you a penny. Just your word, but no tribute, will be levied by triple-A on American commerce. Just my word. And there'll be some of our people around to make sure you don't forget you gave your word. Yes, of course. But how do you propose an army march on German thesis? Dick take time from there. Go on, take triple-A itself if necessary. An army to German. Six hundred miles, gentlemen. Where would I get the money? No, no, no. That's my job. How many followers have you here in Alexandria? Oh, not a hundred men. Ninety. Good. I'll waste the rest. You'll take care of getting camels and camel drivers. We'll need about seventy-five, I figure. But since your march has never been done before, then you worry about that. You just get the camels and drivers. Can you do it? For the price, if it's possible. Then have them at the Arab's Tower. You know the place? The desert to the west, yes. Have them there on Wednesday night. Ready to start. That a collection of camels are much got together, a baron. Oh, believe me, Captain Aitken, we should call the whole business office right here now. Ah, what's the matter, Lieutenant? I'd say we were all ready. There's you, Sergeant Peck.  And we have six of our own Marines. And that's all. And that's really all. Oh, I don't know. Ahmed and his crew don't add up too much, but he did deliver the camel drivers. And there's my Greeks. I'm really proud of them. Any more of them. Listen, no value. Don't worry so much. And just what should we do when we get out in the desert? I know supplies have run out. I don't forget. We're meeting Captain Hell's ship at Bombard, a halfway point. He'll have fresh supplies.  Look at this arm at close, Captain. You can't trust him. He's right behind you. Ah, gentlemen, we leave right away, gentlemen. Listen, stop calling me that. Call me Captain Aitken. Yes, we're ready. The camel drivers are. Yes. They want to say, gentlemen, as Captain. Tell them they'll be paid at their first stop. That's Captain Bain. See, they're at their first stop. Let's go. Listen, three weeks in there. Two hundred miles along. How do I wish I could share your cheer for this? Why not? Another hundred miles and we've reached Bombard. August needs to sell the fresh supplies. Why not be sure? What is it, Sergeant? The camel drivers. They're talking up to go back. They say they're going as far as they're going to go. I might have known that, Armit. Where's the lead of the camel drivers? I'm here. What's all this about? Armored partial payers to go this far, no problem. You've got time back now. We're only a third of the way to Jonah. Armored partial payers to go this far, no problem. Got to stay with us just a few more days. Armored partial payers to go this far, no problem. I'm beginning to believe you. How much money can we raise? We have a little over six hundred dollars with a scooter. Armored partial payers. All right, all right, all right. I'll pay you more. Four hundred and fifty dollars to take us to the next added and capped. So we can hire new drivers. Armored partial payers to go this far. That's the only English you know. Five hundred dollars. Six hundred dollars. Six hundred and fifty. That's all we've got. Six hundred and fifty dollars for four more days. To the next races. Captain Eason. That means exactly six dollars and fifty-four cents in the treasury. How about it? Armored partial payers. Oh, oh, here's a bargain. Thank heaven he knew that word. We're listening to the Cavalcade of America sponsored by the DuPont company, starring Joseph Cotton into the Shores of Ciprile, a fantastic story of the Marines of Africa one hundred and thirty-eight years ago. As our play continues, Captain William Eason, played by Joseph Cotton, has led a little army of eight Marines and a few score Arabs three hundred miles across the desert from Bomba, halfway forth to their march to Dana. Here at Bomba, they are to meet the American frigate August with fresh supplies, but no ship rides without her in the harbor.  Two days. We're two days behind schedule. Why didn't her wait for us? Couldn't he wait two days? Captain Eason, gentlemen, the ship, the American ship that brings supplies to us on me, where we see. Oh, probably around the clove to the left on a Tegadier. Captain Eason, my men, they are stars. They are not eating in three days. Not good eating in three weeks. I haven't been exact with stuffing myself with food. My men, Captain Eason, I cannot take responsible for them. Look at them. They're coming for them. This is Captain Eason. I go to my men, Captain Eason, but I give them no orders. We will see who is in command, Captain Eason. First, my men want their events on you. You will excuse me, Captain Eason. Now let's find it. Let's go. They are not eating. Come ten yards closer and pull that arm up. I'll choke you barehanded. You'll give me out of the fire suit. I'll give you order. One, two, three, four, five... Three. Hey, that's a lot of stuff. I don't have it, that's a lot of work. He's an awful... He's calling some men off. Whoa, watch somebody with him. Only a car. The chop's getting to that. What do you mean? What do you mean, what's wrong? It's a show, it's a show, I tell you, sir. I'll get round you the point. Thanks, Kevin. And not a minute too soon. That evening? Captain Howell, I'm certainly glad to see you, sir. Is he, uh, second trip to Bombayton? Most of you are up for a while. I hope you hadn't come when you did, so we would have been. Well, how many ships have we within fighting distance? We have this across. And the harness? Nautilus, a three-day sailor will. I say it'll take us three weeks more marching to reach Denner. That would be the, uh, 25th April. Can you get the harness and the Nautilus to join you in sailing to Denner Harbor on the 27th? You come in from the sea and we'll storm them from the land. You seem maybe sure you can bring us out, Ethan. Now, uh, I know about your Marines, but how'd the rest you soldiers? Not very good, Captain Howellman. I haven't given up hoping yet. Well, Lieutenant Brown, are we all here?  We could fight not more than six, then. I'm sure of that. Well, then all of you listen to me. You're not in very good shape, any of us. Nine or ten weeks on the desert, there is nothing to boast about. I called you together because I wanted to impress on you how... Well, what a tough job we've got ahead of us. There's Denner. You just see those walls. This is the evening of the 26th. Tomorrow our frigates will sail into that harbor to bombard the town. We'll attack by land. You six are Baron Peck and I. The Greeks will fight with us, I'm pretty sure. For the rest of us. Any questions? Yes, sir. Captain Ethan, sir. How many men inside the city? Have we anywhere known? Maybe 6,000 in fighting trim. Why? Just one, sir. But 300 apiece for us in the Greeks. That's right. Where? Over five knots. I have a ton of balance. Yes, sir. I'm for Armit. Holding the Council of War. Fine. Well, then at least he's prompt. Here he comes now. Come in, Armit. And then I'll set for the scrap tomorrow morning. No, no, no, no, no, no. We will not fight this war in the city of my men and I. What's the trouble, Armit Pasha?  Inside the wars, there are many much bullets, not good. We are too few. What do you think, Lieutenant Baron? Armit Pasha, why did you and your men come all the way to Gunner if you don't want to fight now that we're here? There are too many in the wars of the city. 20, 25 to 1. They are more than we. Tomorrow we're going to fight if the governor inside insists on it. And you'll fight too, Armit Pasha, and your men will fight with you. My men do as I said in the captain. I say we won't fight.   Well, good mind I have you shot as an example to your men. Is that me? Yes, Sergeant. What is it? Governor's answer to our offer is that, Armit, I told the governor you would grant him full pardon if he surrendered.  Here's his answer. It's addressed to you. Read it. It is to me that says, my head is yours. Looks like you've got a tough chance to make fun. If you don't fight, I shoot you. If you do fight and lose, the governor takes your head to send to your brother as a souvenir. Maybe they'll use your skull for an inkwell. The sort of thing your brother'd like to do. The flight says only one thing for you to do, Armit. Well, it looks like you'll fight come to bar the morning and all your men with you. And it looks like you'd better get them to fight well enough to win. Excuse me, please. I'm really sick. I go to my man. Nice work. But it's lucky that governor wrote that note back. That note? Yes. The governor? Yes. I wrote that note myself. Maybe it should be coming in now. Have a look through your glasses, sir. Yes. Now it's happening. They have to come all three of them. The artist? Don't lose heart. Good for catching hold. Roger. They've opened fire. Have the Egyptians bring a few things up to bear as close as they can. Tell them to try and reach the world somewhere. Keep them in one spot. Right, sir? Where are my Marines? Right up on. Let's go. Right, sir? Everybody! To the attack! You take your shots to the coast of the world! Come on! There's a double! Come on! Come on up on. Is it causing, sir? Four dead, then counting yourselves to ten wounded. The city is ours. They're guys and fed to the west for an hour.  How's your arms, sir? All right. Only a flesh wound. Hey. What's this? It's Captain Mercy! Disarm it! Quiet! Quiet! Hold on. Who's this? The governor of Gernet, Captain. Armett seems to think that... Yes, yes. Captain Eaton, you remember our little bargain, the governor and I. The little matter of head. But, Captain, I know nothing of this mess. Oh, yes. Look, Armett. Now that you have the rule of this country again, you should remember that your majesty's greatest gift is mercy. Oh, but Captain Gentleman's a bargain. He's a bargain. He's a... No, no, no, no, Armett. I have a message I want this governor to take to your brother, Yosef. Governor, I want you to go to Tripoli. Tell Yosef that the stars and stripes wave above your palace here in Gernet. And tell him that I am coming to Tripoli personally to raise the American flag that he cut down. Tell him it's going to wave over his very capital. Thank you, Joseph Cotton. Ladies and gentlemen, later in the broadcast, Mr. Cotton will appear again. Before he does, we have a story to tell of the part chemistry is playing in the drive for salvage. This year, the 82 plants of the DuPont Company will salvage more than 60,000 tons of scrap metal. Salvage is nothing new to the chemical industry, for salvage is merely another word for conservation. An industrial chemistry is built around the idea of conservation, finding more economical ways to produce and use materials. Coal tar was once thrown away, for instance, because we did not realize its usefulness. Today, thanks to chemical science, drugs, dyes, disinfectants, hundreds of things are made from coal tar. DuPont set up a salvage and reclamation division 35 years ago, a central control for handling waste materials. In 1907, its first year, the division salvaged, among other things, some acid drums, an old ladder, and $3 worth of wood ashes. This year, the salvage of scrap metal alone by this division will amount to 60,000 tons. Hundreds of men in DuPont plants will devote all of their time to salvaging materials ranging from conduit and valves to boilers and electric motors representing thousands of units of vital power. This type of salvage finds its way back to the steel mills, even the sand banks into which test shelves are fired as screens to recover lead and copper. Cleaning rags, waste paper, broken glass, burlap bags, cotton fuzz, cloths, containers, and whistles are reclaimed. Rolled steel drums are salvaged by the fountains. The dents ironed out and the holes welded. Even typewriter schools are returned to the manufacturer by the thousands. Every DuPont plant organization makes a continuous survey of buildings and equipment. Lists of any machines that become idle are circulated to all departments. Valuable machines and materials idle in one location are sent where they're needed. Equipment listed and not called for is sold to other companies for use in war work. But the ordinary kind of salvage in plants everywhere, important as it is, is small besides the hundreds and thousands of tons of material that industry is able to conserve in other ways with the help of chemistry. For instance, for many industries, chemical science saves metallic leftovers and puts them back to work. Leftovers like iron sludge, which helps to feed the blast furnaces producing America's steel. Another example of industrial salvage is the use of a DuPont solvent in removing oil from worn cloths. One manufacturer alone reports that 250 drums of this solvent salvaged 650 drums of spinning oil and in addition made it unnecessary for them to use 20,000 gallons of natural, 250 drums of ammonia, 56,000 pounds of sulfonated castor oil, 150,000 pounds of soda ash, and 75,000 pounds of soaps. Literally tons of materials were released to other manufacturers who needed them for other kinds of war work. This is salvage. Salvage and conservation are one and the same thing. One more activity touched by the helping hand of the chemist who brings you better things for better living through chemistry. And now, ladies and gentlemen, the star of tonight's Cavalcade of America, Joseph Cotton. Thank you, ladies and gentlemen. It's been a pleasure reenacting on Cavalcade tonight this almost forgotten incident in our history. For by such adventurous exploits we are reminded especially in the coincidence of this story of the power of the past in shaping the forces of the present. Thank you. Next week, ladies and gentlemen, the Cavalcade of America sponsored by the DuPont Company will present a new radio play based on a favorite American classic, The Perfect Tribute. This celebrated and touching story is about the great emancipator in a moment of mingled triumph and despair. And our star will be Edwin Jerome. For this next week, when Cavalcade presents Edwin Jerome as Abraham Lincoln in a new radio play based on a famous short story, The Perfect Tribute. Joseph Cotton, who's latest motion picture shadow of a doubt is being shown throughout the country, appeared on tonight's program through the courtesy of David O. Selznick. The orchestra and musical score tonight were under the direction of Don Vorey. This is Clayton Collier sending best wishes from Cavalcade sponsor, the DuPont Company of Wilmington, Delaware.  This is the national DuPont Company.


entity 666 aka the Happy Files Virus. The entity itself is like a computer virus that's been causing chaos across the internet inside of the back rooms. It's been described as a tall all black humanoid measuring around 2.1 meters in height.  Now its facial expression does not change through its manifestation at all. After this entity has had its fun as a virus on your computer it will then morph into a real life flesh and blood creature and will try to jump scare you until you have a heart attack in real life. If that doesn't work then it'll chase you like in the video game. Slowly at first but then extremely fast to the point where it's running around you in circles and then it'll attack you in a gory way.


Alright everyone, we have some data in for the PlayStation 5 launch month of November. Now this isn't the US NPD, this isn't Japan or anything else like that. This is our first full month of data, or at least our first launch month I guess is better to say of data. This comes from the UK. And normally the UK actually had quite a bit of console sales for the month of November. Usually the UK sales, I'm not going to say they're inconsequential, but they're just a small part of the pie, and it still is true it's a small part of the pie. But I mean, almost a million consoles sold in November. So crazy. This comes from gameindustry.biz as you're seeing on screen, it says almost 900,000 game consoles were sold in the UK during November according to the latest GFK market data. The hardware data is for the 4 weeks and the November 28th, so technically missing a couple days, but this is how they gather data in the UK all the time. In terms of home consoles, not including handhelds, it is the 8th biggest month for console sales and the 2nd biggest month for console revenue behind December 2013, which was when the PlayStation 4 and Xbox One received big new shipments. The most successful machine of the last month was the newly released PlayStation 5, which means the Nintendo Switch had to settle for 2nd place. Of course, they could have said the Xbox, but nope, the Switch actually outsold the Xbox. So there's that. For only the 3rd time in 2 years, even so, it was a big month for Switch, with hardware sales up 96% over the previous 4 weeks. The console had a very successful Black Friday, and so far this year Switch hardware sales are up 63.1% year on year. In terms of boxed software, 2.38 million games were sold in the UK last month, which is October 25th through November 21st. Switch games were the most popular of the month, accounting for nearly 35% of all games sold, followed by the PlayStation 4. Nintendo was the top publisher of the month, thanks to continued strong sales of Animal Crossing New Horizons, Mario Kart 8 Deluxe, Minecraft, and Super Mario 3D All-Stars. The company held off strong competition from Ubisoft, which saw big sales of Assassin's Creed Valhalla and Watch Dogs Legion. The biggest selling new game of the month was Call of Duty Black Ops Cold War. The Activision shooter sold significantly fewer boxed units than previous games in the franchise, with the vast majority of sales coming through digital download. The other big new games in the charts is PlayStation 4 and PlayStation 5 game Spider-Man Miles Morales. The title reached number 4 and primarily sold on PlayStation 5. In fact, it was comfortably the biggest PlayStation 5 launch game ahead of Call of Duty. The launch of new consoles unsurprisingly caused a spike in the accessories market. Nearly 1.25 million accessories were sold in November from October 25th to November 21st, which is up 61.4% month-on-month and 48.3% compared with last November. The best selling accessories of the month were the PlayStation 5 DualSense controller, which was number 1, and the Pulse 3D headset for PlayStation 4 and PlayStation 5 at number 2. Number 4 DualShock drops from the top spot to number 3. Meanwhile, the new Xbox controllers debuted at number 4, the Shock Blue, and number 5, the Carbon Black, and number 9, Robot White. Other new accessories in the charts include the Media remote for PlayStation 5 at number 7, the DualSense charging station at number 8, and the PlayStation 5 HD camera at number 11. Here's the UK top 20 selling boxed games for November. CC Cold War at top, Assassin's Creed at number 2, FIFA at 3, Marvel's Spider-Man and Miles Morales at 4, Watch Dogs Legion at 5, Animal Crossing at 6, Mario Kart 8 at 7, the Switch version of Minecraft at 8, Super Mario 3D All-Stars at 9, Fortnite the Last Laugh Bundle at 10, Ring Fit Adventures at 11, Marvel's Avengers at 12, Minecraft Dungeons at 13, Grand Theft Auto V just keeps charting at number 14, Hyrule Warriors Age of Calamity at number 15, Demon's Souls at 16, Star Wars Squadrons at 17, 51, Worldwide Games at 18, Just Dance 21 at 19, and Crash Bandicoot 4 at about time at number 20. So obviously the big thing to take away from this is yes, the Switch performed really well. If you care about Switch sales, it did well in the UK. It was a really good November. But a few things. Where's Xbox? I mean, the Xbox Series X clearly sold because the Xbox Series X slash S controllers are in the top of the accessories thing. So like three different controller variations are in the accessory sales. So people did buy Xbox, but there's no notes about Xbox sales. And I think that's one thing I sometimes hate about these little sales data breakdowns because we don't really get raw access to this data. We don't get raw access to the data like Game Industry Debate does. So when they have access to this data, what we want to hear is we want to hear a comparison of everything. And what we heard is that PlayStation 5 is dominating in the UK. Although is that surprising? PlayStation 4 was massive in the UK. So PlayStation 5 having a massive debut there as well, that's not shocking. And that's good. Good for Sony. I know people act like, you know, all I ever do is talk negatively about the PlayStation 5. I actually legitimately am excited about the PlayStation 5 and can't wait to get one on hand myself whenever they're actually in stock and I have the money. I can't ever seem to get me having the money for one and it being in stock to line up. It will someday when it's not so hard to get, it will someday. But honestly, I think that this is great, good, great for Sony, great for gaming. I just find it weird that we're hearing about PlayStation 5, we're hearing about Switch, but not hearing anything about Xbox. After the Xbox launched in the UK, so why are we hearing nothing? Did the launch just like bottom out? Was it a flop? Even if it was, I want to hear about it. So kind of interesting that they really only compared two of the three major systems out there instead of looking at all three. Again, not an issue that's going to happen with the NPD report. We'll get a look at all, we'll get a look across the whole spectrum. Obviously in Japan, we always get a look at the whole spectrum every single week. So for some reason in the UK, though, it's like, eh, we're just not going to really talk about it for some reason at this outlet. I checked a few other outlets that reported this as well, none of them are really talking to an Xbox beyond the accessories market where they had three in the top. And I figure if people are buying extra Xbox Series X slash S controllers, then they must have systems, but whatever. Honestly, this is nothing but good news for Sony. If you're a Nintendo fan, I wouldn't really worry about it. I mean, what do they say? This is only the third time in two years that the Switch was not the number one selling hardware for the month. Is it really that big of a deal? Well, we'll see what happens in December. December will be a big, big calling card to a PlayStation five top switch in December. I don't know. It is the new hot thing. So I'm not surprised. The UK is very heavily skewed towards Sony. So it having massive sales is what I expected. And I'm glad it delivered. That would have been extremely disappointing if PlayStation five didn't have a massive debut. But it did. So kudos to them. Miles Morales obviously being the top selling software. I had a feeling that that's the top selling software across the board for all PlayStation five in every region. I'm guaranteeing that Miles Morales is probably at the top. I know Call of Duty is going to be up there as well because it's a really big game. That's going to be on all platforms that it's present on anyways. Can't say all platforms because they still don't support switch. Those bastards. Now they're really not going to support switch from next channel. So I just I'm just happy. You know, I think it's good to see everyone successful. I think Microsoft is actually pretty successful in the moment. I think they're seeing their game pass subscriptions going up and we'll hear about that soon. I obviously think they had a really great debut in the United States, which is their primary market might be their only real big market. But they seem to always perform well in the US. Even the Xbox one did extremely well in the US. These switches been killing it. Switch continues to kill it. I mean, even though Nintendo didn't have the top selling hardware spot, they were dominating in terms of unit sales for software.  We're actually at a point now where I feel like we're reaching an equilibrium this holiday. We're all three major players in the console market are performing well and and doing what they should be doing. Isn't that wonderful? I think that's wonderful. You know, for all the talk about how, oh, the PlayStation 5 has design flaws. Oh, you know, the Xbox doesn't have games. Oh, Nintendo didn't really deliver us much here in 2020. All three console manufacturers are selling oodles of consoles and selling out. All three of them are selling oodles of games and selling out. And all three of them are making money hand over fist. They are highly successful right now. So I think this is good. And the thing is, I'm finding that a majority of consumers that I talk to, regardless of which platform they perform, are happy. Like, there's all these people like attacking Xbox owners like, why would you buy an Xbox Series X or S? They have no games. Well, beyond the fact that S has now been proven to be an emulation beast. Holy crud is it a beast. It might be.  But for $300, the kind of things that you can emulate on a series S for $300, if you're into emulation, oh my God, it's like a must have for three hundo. You could not find a better deal on the market for emulation. But that's just emulation. A lot of people that own the S and X are berated online anyways. I don't think they're berated in person. I'm online. Like, I own a Nintendo Switch, a gaming PC, and well, it's an editing PC that can game, I guess I should say. And then, obviously, I have an Xbox Series X, and I get berated at times. Why do you own an X? It has no games. And I'm like, well, Game Pass. Game Pass isn't that great.  Who cares about old games? Well, a lot of people care about old games or even be bitching about the lack of virtual console on Switch. If people didn't care about old games, Sony wouldn't provide a streaming service specifically built around their old content. Like, clearly, we wouldn't care about Final Fantasy 7 remake if we didn't care about Final Fantasy 7, which is an old game. In fact, if we don't care about old games, why are we talking about Demon Souls? Oh my gosh, look at this Demon Souls remastered remake thing on PlayStation 5. Again, it's an old game from PlayStation 3. If we didn't care about old games, we wouldn't care about any of these games. But we do care about old games. We care about where gaming has come from. So it is something that matters. And Game Pass isn't just for old games. I know it feels that way for some, but I mean, there's plenty of 2019 and some 2020 games on Game Pass.  And now you can pre-install those games so you don't even have to wait to play them when Day 1 hits. You can already have them installed, all the updates ready to go. So again, I think Game Pass is fantastic. Now that's actually a better argument to get an Xbox One right now, you know, or something like that, an Xbox One S or something that's cheaper. But honestly, I think that everyone's winning. I am loving my time with my Xbox. I'm playing more games on it now than I think I've played on an Xbox in a long time. And when I get to PlayStation 5, despite my concerns over the design philosophy of the system and how a lot of people were praising the design without any actual evidence that they should be, and now the evidence is out there that the design is completely flawed, the air is completely choked off, there are parts of the system not even being cooled, and it's going to lead to long-term failure in addition to the fact that the SSD is soldered on the board. So good luck. You're going to get five to 10 years of life out of your system before it just doesn't work at all anymore. And it's the only system I can safely say a decade from now, you're going to hit that power button and it's not going to turn on. But that being said, that doesn't mean I'm not excited for PlayStation 5. I'm excited because of the games. I'm excited because of the UI. I think the UI of PlayStation 5 from everything I have seen looks amazing and should maybe even be the market standard for UI systems. Microsoft and Nintendo might need to take note. The hint system looks fantastic. Again, Microsoft and Nintendo take note. Nintendo in particular, you had a hint system on Wii U. This is like taking it to the times in it by a thousand. You guys should get on top of that since you like to provide help for people. Much to walk through manufacturers should grins. But yeah, I think that this is good. I think the PlayStation 5 is exciting. I think Miles Morales looks amazing to me. I can't wait to play it myself. Obviously Astro Boy and Astro Bot, whatever it's called, Sackboy. I think it's Astro Bot and Sackboy. I think both those games look amazing. I'm honestly excited even more for PlayStation 5, believe it or not, than I am any other platform. Because I did dabble a little bit in Xbox games, whether it was on PC or on my old Xbox One X. I did not dabble in PlayStation 4. So one thing that's exciting for me, believe it or not, about the PlayStation 5 is it's backwards compatible with all the old PlayStation 4 games.  I can go back and play the Horizon Zero Dawns before Forbidden West comes out. I can go ahead and play The Last of Us and Last of the Part 2, because I didn't even play the original Last of Us. I can go ahead and enjoy these experiences for the first time. And that's amazing to me. Granted, that's a great reason to just go buy a PlayStation 4 right now. They're cheap, right? But if I'm going to spend money on a system, why don't I just get the new one that gets the new games and the old games, right? Then you can argue, well, wait for a redesign. And I get that argument. You want to say, just buy a PlayStation 4 now, and just get the slim when it comes out or something that's better designed. I hear you on that, but I'm also kind of a tech junkie. So no amount of old tech is going to satisfy my tech junkie needs. And I'm also a YouTube content creator that talks about video games. And I would love to do more coverage of the PlayStation platform, which I can't do because I don't have the PlayStation 5 on hand. That's why you're seeing more coverage skew towards Nintendo, which will probably always happen on my channel. It's called Nintendo Prime. I have it admitted bias for Nintendo. And then obviously more coverage of Xbox because I have one. I have a Series X. Gotta get that PlayStation 5, man. Scalpers, do me a favor. Just send me one of the kindness of your heart, and I'll stop blasting you in every video. Okay, no, I won't.  All right, folks. I'll catch you guys in the next video.


Oh, yeah, that's the kind of subdued, no-sleep, kind of hungover response I was looking for. So it is DefCon Sunday. Everything's a little bit slower. Everything's a little bit more chill. How many people have to go home today? Oh, that's too bad. How many people have to go to work tomorrow? You've made a huge mistake. I made that mistake once. I will never do it again. You might make alternate plans. Well, either way, thank you guys for coming out. A few years ago at a couple of different conferences, actually I got stuck with the Sunday morning hangover crowd and it was no fun.  So let's give Stephen and Siegfried a big round of applause. Yeah, good morning. Thank you. I'm Siegfried and this is my colleague, Stefan. And today we'll talk about antivirus applications in the mobile world. And this was joint work together with our team members, Stephen, Michael, Andreas, Philip, and Daniel. Well, so let's get started. Before we get started with the talk, a short announcement. Since this is our first DEF CON talk, and since we were both from Germany, we thought it was a cool idea to bring some local beer to DEF CON. So this is what we did. So we checked in this box of beer at the airport and the lady at the check-in counter was like, what the heck are you doing? And she said, I think it won't arrive in the US because you're not allowed to do this. And we said, well, let's give it a try. And long story short, so the box arrived and it's over there. Only one bottle didn't make it, but there are 19s left. So after the talk, please feel free to come and have a beer. OK, so let's get started with the real talk. A few words about ourselves. So Stefan, would you like to say a few words? Yeah, hello. Good morning. I'm Stefan. And I'm a member of the mobile test lab at the Fraunhofer Institute. And I'm working on mobile security, especially on Android and Android application security. Yeah, thank you. I'm Siegfried. I'm a fourth year PhD student at the German University at Kalti U Darmstadt in Fraunhofer SIT. I'm about to graduate by the end of this year. My main research focus is on static and dynamic code analysis in the context of detecting vulnerabilities or detecting malicious behavior. But this work was not only us. It is basically our team. We established a hacking group called Team Sieg half a year ago. And it's basically located at the university. And we look into different interesting security topics. And the antivirus application was one of our first projects. And we will show you now the results of our findings. OK, so let's start with a little bit about motivation.  But this one is an interesting one. So a lot of banking vendors, they have some FHQ in their FHQ. They're saying you should install your mobile antivirus application in order to be secure and to securely use our whatever mobile transaction banking application. So they really rely on antivirus applications. And this is somehow interesting. So do they really protect us, these antivirus applications? Or if not, then all this reliability of this banking application, for instance, is somehow broken. So let's start a little bit about some background information. As we all know, antivirus applications try to protect us. And their core is the malware detection engine or the virus detection engine. Well, it's based on signatures or behavior. But in the mobile world, apart from that, these vendors have a lot of different other features. And these features are interesting for the rest of the talk. We show four of them now. My favorite one is the loss and theft protection. So this means when you lose your device, there is a feature that you can remotely wipe or remotely block your smartphone, which some other stole from you. There is a feature called device configuration advisor, which in Android, you have a lot of security settings. And it might be the case that you did not set it in a secure way. So this application warns you and say, well, you probably should enable this or that feature. You shouldn't do this and that. There is secure browsing. Well, this is well known, I guess, from a PC world. If you would like to browse a website or if you would like to open a website, which is malicious, then they block it for you. And spam protection is in the mobile area more on SMS spam or phone spam. And depending on the vendor, some of them offer these features for free. Or some, you have to pay an amount. So it's like a pro version. So you have to pay a certain amount of money. And then you get these nice features. So let's dig a little bit deeper into these applications. I show you one application. I guess it's the Kaspersky application. And this is the manifest. So all the permission it requires. But this is not only Kaspersky. All of them require so many permission. As you can see, there is like SMS, contact, all these sensitive permission. Why? Well, it's obvious. Because from a previous slide, we've learned that they have a couple of features. And the developer, if they implement these features, they have to access certain security secure API calls. So they need all these APIs or these sensitive APIs. So well, this is somehow interesting, right? Because if you're able to do some remote code execution or something like this, you don't need actually root. So it might be enough if you only have this antivirus application installed. Because then you have access to a lot of sensitive data and you can easily send it back. So this was something where we started and it was very interesting to see. And then as a next step, what we did, we looked on the Google Play Store and we checked out a couple of applications. So we picked only those Android application which had at least 1 million downloads because they are the most interesting ones. They were Android, Helm, Manbubites, Asset, Avera, Kaspersky, MacFV, and Cheetah Mobile security. I know that there are more well-known AV vendors. The reason why we picked only these seven were we were our group had seven subgroups and each of the group looked into one application. Therefore, we had seven. But we did not look into any other vendors. So let's get started with the real talk. For this talk, we focused on four different challenges. And there were a lot more challenges. In the end of the talk, you see our white paper and a link to the white paper so you can read all the details. But for this talk, we will focus on four challenges. First, is it possible to do this premium upgrade for free? Second, my favorite one, misuse loss device feature. So is it actually possible if you have an antivirus application installed to turn it into ransomware? So actually, to turn it into malware. Third one, remotely influence the scan behavior. So targeting the heart of these AV applications. And the fourth one, is it possible to do remote code execution? In the following, we will show now a couple of examples and concrete examples. And we'll give you an overview of what we found. So let's start with the first one, premium upgrade for free. And for this example, we have two examples. The first one is on Android Helm. It's a very easy example. And the second one is a little bit more sophisticated. OK, when you look at the Play Store for this antivirus application, this Android Helm, you see that it has different versions of it. When you look very closely, it differs from the price. So it starts from euro 99, which is almost now $9, up to $129 or euros. So the reason is they offer different models. So for instance, I guess the $129 one was an unlimited usage of all the pro features. The $9.99, I guess, you can use it only for one month or something like this. It really varies. And the free version, which is a very left one, it's for free, but it doesn't have the pro features.  Depending on monthly or yearly basis. So as a first step, what we did, we would like to know how did they check if it paid or not. And then we looked into the code. And we found an interesting code snippet saying, thank you for upgrading to pro. And put boolean is pro and true. So for those of you who are not familiar with Android, in Android you have a so-called shared preferences file. This is an XML file which stores key value pairs. And it's only accessible within the application if you implement it in a secure way. In this case, it stores as a key is pro and as a value true. So when we looked at the shared preferences file at the installation time, so without any pro feature enabled or paying stuff, you see that there are already a couple of key value pairs stored. But there was no is pro false or something. So what would you do, right? So as a first step, of course, you add something like boolean is pro and true and see what happens. And this is what we did. We added this and then we started it. And yeah, here we go. So this was actually it. So this was enough for this application to upgrade it to pro. Just for completeness, for the first attack what I have shown, it's mandatory to have a rooted device. Now I will show you a very quick overview how you do this without root. And this is all well-known, but just for completeness. You have your mobile device on the left, and then you have the PC. And you can communicate with the PC via the ADB debug bridge. So what you do, you basically backup this application. And since the application allows the backup, it is possible to backup the application. And this backup also includes the shared preferences file.  And there are already a couple of scripts out there, which do this everything for you. And then you add this new line. This is pro true. And then you do a restore back into the application. And here we go. That's it. And you can do it without root. Good. So this was the warm-up. And as a next step, I would like to talk about how Asset did this. Good. In Asset, it was a little bit different, the situation. What they had, they did not check this on the client side. They checked the verification if it is a pro feature on the server side. So you have your application on the left-hand side and the back-end in the right-hand side. And what you do, you have an authentication with your username and password. And if the username and password is sent to the back-end, it is checked if this is the pro feature, if you paid for the pro feature. And if yes, it sends you back, yes, you paid. And then you can enable this. So how could an attack work? What we only what we need is the username and the password. Because if you have the username and the password, we can whatever, get our own application and set the username as a username and a password as a password. And we can basically, we have the same features as the features from the victim. So how can we do this? Because what they did, they did a good job. They did a TLS protection, at least. It was not sent by a plain text. Yeah. So what can we do? Well, there are well-known vulnerabilities to SSL, TLS. Well, we didn't like to whatever do crypto-breaking stuff or something like this. We thought, isn't there an easier way to do this? And yeah. So the problem in Android, at least, with TLS and SSL implementation is, it's not that the protocol is the problem. It's the problem that the developers implement this in an insecure way. They do some mistakes and that stuff. And a very common mistake is that they do not check the SSL certificate, for instance. More concrete, in Android, if you, for instance, as a developer, created SSL communication by HTTPS, the operating system itself checks if the certificate is really the server certificate. It does some chaining stuff. But you, as a developer, you can do this by yourself. So you can check these by yourself. And as an example, what you have to do, if you would like, whatever, do not trust Android or Google or if you say, I have my own checks, you can do this by yourself. The only thing what you have to do, you have to implement this X5 or 9 trust manager, for instance. And then you have to implement a couple of methods which do the checking. And one method is the check server trusted method. And within the body, you have to implement, for instance, SSL pinning and all that stuff, what you have to do. And, well, so this is so-did asset, for whatever reason. They implemented their own X5 or 9 trust manager. And then we also saw the check server trusted method. And, but when we looked into the body, we saw it was empty. So what does this mean? This mean they do not check if there is, if I do a man in the middle attack and I have my own certificate, this method gets called and it does nothing. So, well, SSL is basically broken, so we can do a man in the middle here. So as a first, so now we are at the situation that we can do a man in the middle. So we are sitting in the middle of asset in the backend and then we basically sniffed what's going over the wire. And as I mentioned, what we did as a test, we set up our password, our username is tester and the password was test. And then we looked at the wire. And what we found was something interesting. So the user, the license username is probably username and the value was not tester. So they somehow encrypted it additionally. So this means they did not rely on the TLS protection, so they put an additional encryption layer on the credentials which were sendable. Some are interesting. Then we were interesting, well, how do they do this? And well, when you look at the password thing, you see some interesting things. When you look at the base 64 decoded value for tester, it is one, five, D6, B1 and so on. And for test is one, five, D6 and so on. So this is somehow interesting, right? So it looks similar. So let's look a little bit deeper in this. So what we did, as next, we did a so-called chosen plain text attack. So we used as a username, for instance, a, a, a, a, a and so on. And we looked at the cipher, how the cipher looked like. When you look at this table, you see that every second byte is redundant. It's useless, so we can easily remove it. And then when you look at the positions of the plain text, the characters, so the first character, if the first character is an a, for instance, the cipher is always zero. If the first character is a b, the cipher is always b6 and so on and so forth. So this showed us that, first of all, a second byte is not required. Second, there is somehow no chaining involved in this encryption scheme. And it looks like a simple substitution. So maybe some of you have already seen how the substitution works, but I will show it to you now in more detail. So let's come to this point here. So first, we used as a letter a, and you have the cipher zero. So how can you come from an a to a zero? Obvious, right? So you use xor with a as a first position. Let's verify if this is correct. We use b the first letter, xor with a is three, right? So we do the same c, xor with a is two, which is correct here. So this showed us it is somehow just a simple xor with a key. So what do you do as a next step? Of course, you create a very long plain text. You create, when you look at the cipher, you do an xor and then you have the key. That's it. Just for verification. So first, we broke the SSLTLS communication because it was implemented in an unsecure way. Second, we figured out their encryption scheme. We have the key here. And then, for instance, for the user tester, this is the encrypted one, and then we xorred it with the key, and we got tester. So here we go. This was it, and here we go. Good. Yeah, thank you. Next challenges, so I will hand over to Stefan, and he will talk about the next three challenges. Okay, hi. I will now present the rest of our challenges, and the next will be Sigrid's favorite, misuse loss device feature. Here we have, again, our old friend, the Android Helm app. If you remember, this was the one with the sophisticated license verification. And so we thought, okay, let's look also, look into the loss device features. Shorter summary, what do we understand on the loss device features? Sigrid also explained it's a very easy function, so if you have installed this antivirus application, you can activate this feature, and if you get lost your smartphone, or it gets stolen, you can use another smartphone, or a desktop PC, and remotely activate some features like device location, remote wiping, or also remote locking. And the question is now, can we, for instance, abuse this remote wiping or this remote locking without any authentication, and so transform the antivirus application into a malware, and, for instance, lock it remotely and blackmail the user. How is remote communication in this service is implemented in common? At first, there's the Google Cloud Messaging. This is a service by Google which you can implement and use for communicating with the smartphone. There are also some other push service provider, and you also can use the SMS messaging system. This means if you want to trigger something on the device remotely, you just send an SMS message, and the application will get the message, and, for instance, execute some comment. In our case, this application uses SMS message communication. So here you see an excerpt from the application, and here it explains how the anti-staffed feature or the remote protocol for SMS is working. So by default, this feature is not activated. This is an important fact, and we will explain later why this is a problem here. And if you activate the feature, the user has to define two phone numbers from a friend. So if this device gets lost, you can go to his friend and say, hey, sorry, I want to track my device. Can you borrow me your handy? And then he can send the comment SMS. The comment SMS you see also listed here. As a prefix, you have a password. So it looks okay. You have to authenticate, and then you have a space, and then the comment. For instance, if you want to trigger the location, you send from your friend's handy an SMS with your password, a space, and the comment locate. Let's take a look more detail on the process. So on the left side, you see the user. He's sending an SMS. And the application itself is in some kind of wait state waiting for the SMS. For all Android-Aware people, it's just a simple broadcast receiver which receives the SMS message and executes some reaction. So here you see our SMS message. At the beginning, you have the password here. MyPass, separate by a space, and the comment here as an example, wipe. Internally, the application now splits the text into two parts on the space side. So we have the internal variable. Let's call it SMS password. In this case, it's our password, MyPass, and the second variable is the comment. Here it's wipe. Then there's a password check. It checks if the transferred password in the SMS is matching to the stored password in the application. If this fails, the comment will not be executed, and it's getting back to the wait state. If the password is equal, it will execute the comment. Okay, now where's the implementation flaw in this process? As I already mentioned, by default, this feature is not activated. So it means it's deactivated, and an attacker can abuse this deactivated feature. So on the left side, you again see our attacker. He will send an hour malicious SMS. For this case, he has to know the number of the victim, and he sends a simple crafted SMS. It looks like the following. At the beginning, we have an empty string. Then we have a space, then our comment, an additional space, and some irrelevant string. The application now will split at the wipe. The first variable, our SMS password, is empty. The comment you see is our wipe. And now, if you have the password check process, and the default, the password is an empty string. Now when we compare our empty string with our transferred, password, the empty string, this is matching, and the comment is executed. Now you're asking, okay. Now you're asking, but what about the friend's telephone number? Is it also checked? Yes, but it's the same process. If there's no number, it's an empty string. And also an SMS, you can spoof the number. I think this is nothing new. Okay, so as you see, there failed something in the process. Okay, second challenge. Now the third challenge is, can we remotely influence the scan engine, or the behavior of the scan engine? Here we have a new example. Here we choose the malware bite antivirus application. And at the beginning, here you see a short scheme. As you know, the most, or every antivirus application does its own signature updates every hour, every day, and so on to keep the signature database up to date. In this case, the malware bite application is doing this by plain text, HTTP. So HTTP is not anyway protected. You have no authentication, no confidentiality, no integrity check. And smartphone are wireless devices, so you can imagine wireless communication and unprotected traffic is not such a good idea. So in our first step, we set up, again, a simple man in the middle listening on the HTTP traffic. And what we saw is that the signature requests to the backend responses with the signature update. In this case, this is a SIP archive, which is additionally encrypted. Re-encryption algorithm is RC4. I don't know, but RC4 is not the best algorithm for doing secure encryption. But yeah, we were too lazy to break it, and it's much easier because the symmetric key of the signature encryption is stored in plain text in the application. So if you look into the application or make some string, you will find the crypto key. The man in the middle attacker simply decrypts the archive, can remove, for instance, the signature repackage, re-encrypt, and forward it to the victim. And now the scan engine has, as you see, empty signatures. And in the next level attack, for instance, you can send a well-known malware or a red tool and hijack the smartphone. And the victim is not protected anymore. Yeah, as I already mentioned, it's a simple plain text attack, it's not so sophisticated. So we show you the last challenge. It's more complex. It's now remote code execution. Also, can we inject in antivirus applications some foreign code and remotely trigger this code execution? And as you think, yes, we can. And we here for this example, we choose Kaspersky, antivirus and internet security application. Here again, at first, as you see, we have our HTTP requests for the signature update, no encryption, no authentication. But in this case, Kaspersky has done better work. They have implemented some integrity protection. I think the update is not so that you need confidentiality, but integrity protection is very important. So if a man in the middle attacker tries to modify the updates or the signature files, the application will reject this. So at the beginning, we thought, OK, Kaspersky has done good work. Everything is OK. So despite of this, we set up our man in the middle attacker and looked at different HTTP requests. As you can see, the application is transferring some SIP archive, some XML files, and some JAR files. What you see here in this SIP archive, this is just some company internal advertisement containing some XML HTML files, some configuration XML files, and an interesting file is the root detector.jar file. This jar file contains some Android executable code. You can imagine it's more generic as a library containing executable code, which will be loaded from the application during runtime. And in our first step, we just injected some text file into the archives. And yeah, there's a signature protection, and we could not modify or inject some executable code in this root detector. But the SIP archive seems that the SIP archive is not protected. There was no rejection when we entered our evil TXT file. Now we take a look into the application folder. Here you see now the application folder and our SIP archive, which is extracted after the update from the application. Here you see, as I mentioned, this is just some simple advertisement banner with some JavaScript, CSS, HTML files. So it seems it's not so critical. And at the end, here you see our injected evil.txt file. So at the first, we thought, OK, we can do nothing just insert the text file or just insert here some file is a problem because the code will not be executed. So let's take a more detailed look in the rest of the files the application contains. And we have some additional files. Again, you see in the middle our root detector file, which will be loaded by the update. But we have also a pdm.jar file. As I already mentioned, it contains executable code like a library, which is loaded during the runtime. But this pdm.jar file is not loaded with the update. It's part of the application. So for the Android guys, it's in the APK files. So at the first installation, the pdm.jar file is already there. As I said, it's part of the APK, contains executable code. And our root detector is signed. So this is not really a tech vector. But let's take a look at our pdm.jar file. Now we injected, instead of the text file, we injected really a pdm.jar file with our own crafted executable code. But the problem is, as you see, the pdm.jar file is still in this zip folder, or in this folder which is created by extracting the advertisement library. So we have to find some way to break out of this archive and to override the pdm.jar file. And one technique for this could be path traversing or directory traversing. This means if the zip library, for instance, which is used by Kaspersky, does not evaluate the file names in the zip archive correctly, we can perhaps inject some malformed file names. And because of missing escaping, we can break out of this directory and override this pdm.jar file. So I will now show just the exploit and explain it in a few details. As I said, we have to override the pdm file with our manipulated file. So we crafted our own zip file. And if you look at the content of the zip file, as you can see, we have our CSS, HTML, advertisement stuff, and our own pdm.jar file. But this is no folder prefix. As you see, this relative path and the dots and slashes are part of the file name. This means the whole file is named dot dot slash dot dot and so on. And because of the erroneous implementation of the zip library in the application, it will be extracted. And the pathes will be interpreted. And our pdm.jar file will be overwritten and loaded by the application on the next startup.  And first, at the beginning, we found an unprotected communication because of the HTTP update requests. Then we augmented our zip file with this renamed directory or path traversing file. This was possible because the advertisement archive was not integrated integrity protected. And the zip library, which is used contain implementation flaw. We override existing executable code by our own code. And at the end, when the app restarts, this injected code will be executed. And this is working. We have no demo, but Reli, it was working. OK. So our challenges are solved here, or the examples we wanted to present to you. Here you see a summary of all our findings. On the top of the table, you see again the different apps we analyzed. On the left side, you saw the different type of vulnerabilities and possible attacks. And if you take a more detailed look in it, you see each application has at least two or more vulnerabilities. If you're interested on the advisories or more details of the vulnerabilities on the attacks, on the bottom, you see the link to the detailed advisories. These are also the advisories we sent to the different antivirus vendors. At the end, we want to give just some experiences which we made at the responsible disclosure process with the different companies. We informed all companies. But as you see, one did not fix the vulnerability. They did not react on our announcement. We tried several ways. We sent emails. We tried web forms. We tried also to contact them by the Google Play Store. But there was no reaction. So if someone is here from Android Helm, please come up later. Or at the end, you find our contact information. Other fails we had during the responsible disclosure was there are companies which provide websites where you can announce your found vulnerability. And they also provide a public key that you can transfer your email confidential. But on one, the public key was expired. So how to transfer it? I wrote an email. Can you send me a key? Comes the answer. The key is on the website. I wrote again. The key is expired. OK, thank you. We send you a new one. Another website contains a public key, PGP key. And it was valid. But the email was not matching. So again, send me a correct email. And some other also did not react. We phoned them by email and so on. But there we had luck because we met the research director of antivirus security of this company at some conference. I was telling him about my problem. Half an hour later, I had a PGP key and an email. What did we learn? Yeah, also big security companies fail in implementation. Its developer are just humans. Human makes mistakes. But on the other side, and these companies work a lot of people who are aware of these problems. And they sometimes should look into their own code or make some code audit internally or externally. There's the room for the improvement and the responsible disclosure process. And the last thing, it's a bit more funny. They also, it seems, they also reuse their code in different products. Because I think most of you know the name, Tavis Romandi. He was also hunting bugs in Windows antivirus applications. And we found also one bug, which he found in another application. But he was faster in announcing it, so I missed the bug bounty. This is our presentation. Here you can see our contact information, also our Twitter handle, and the website of our students group. They also find the advisories and more information about our project. And yeah, thank you for your attention. If you have questions, feel free. You're also a secret announced. You can meet us later or here now. We have some beer. We can drink a beer or discuss about this security or Android security. Just feel free. Yeah, thank you.