Oops. Slap it. Oh, flip it over. I do. I feel really cool. This is, hi. Oh, hey. Hey. Hi. My name is Eric from the Spruce Eats. And my one thing is to have Tom from the Clover Club show us how to make a cocktail so you can look cool at your New Year's Eve party. I have no idea why you shake a cocktail, how you shake a cocktail, how to look cool while shaking a cocktail. And I want to learn that. OK, so we can back way up. There's a lot to talk about. The main reason that you shake a cocktail, well, obviously, it's to mix all the ingredients. Also, shaking is the best way to get something really, really cold. Any cocktail that has citrus juice in it or any fresh non-alcoholic ingredients should be shaken. And then concurrently, anything that has all alcohol-based ingredients, like something like a martini or a Manhattan, should be stirred. Today we're going to do a play on a margarita, sort of with some holiday theme in there. Did they tell you that tequila is my favorite? Is that why you brought this drink? You did mention that, although I didn't know that. Oh, actually, you know what? Yes, yes, I was told. Half an ounce of orange liqueur. There are lots of different kinds of cocktail shakers. We're going to use what's called a two-piece shaker, which is when you have two pieces that just wedge together. That's my favorite kind of shaker. But often, people have what's called a three-piece shaker or a cobbler shaker, which has the little piece for straining out of the top. I want to learn how to use this one, because that's the one that makes you look cool. That is one main reason why I think that people should use it, half an ounce of lime juice. A cinnamon syrup with cranberry juice. Add all your ingredients into the shaker first before adding your ice. I often like to say ice is to cocktails what heat is to food. It's the thing that transforms this mixture of ingredients into a finished cocktail. So I put all my ingredients in. I filled it with ice. You put the top piece on at an angle so that one side is totally flush. There's no gap. Then you give it a pop with the heel of your hand, and it will form a seal. Then you flip it around. I like to shake with the mouth of the larger tin or vessel facing me, because God forbid, if it does come undone, it ends up all over you and not whoever you might be shaking for. You want to hold it horizontally. The whole point is get the ice moving back and forth. So if you shake like this, that's not really going to happen. I think it's a good idea to have at least a finger on either end. I like to hold it up by my ear. So do one of these.  So yeah, as you go for it, shake as hard as you can. It doesn't matter how you shake, just that you shake hard for about eight to 10 seconds. Now we're going to separate these two. And so you hold it from the bottom, up in the air, and you just sort of hit it, and it comes undone. Serve it on the rocks. It looks very festive. Yeah. And there you go. Awesome. I'm going to give it a shot. Yeah. We don't have enough ice maybe. Oh wait, not ice first. I remembered. All right. Big one of tequila. Orange liqueur. Like little tip. Not the thing you're doing wrong, but just like it's a helpful tip when you're, it's called jiggering, little side fact that the name jiggers is just because in the 19th century, when this thing was invented, no one could think of a better name for it, and they just called it a thing in the jig. And jiggers are short for that. Anyway, holding it right next to the vessel, the shaker is good as opposed to on top, because then you have to move it to pour it. Cranberry juice. Little guy. Oops. All right, now the ice. It's time for the ice. Now it's time to light the fuse. This ice is hard to get out. This I'm going to remember. This goes in here. Slap it. Do it, maybe test it first. Oh yeah. And then I'm going to do this. Right, and ideally maybe, it looks great, but I would say flip it around. I do, I feel really cool. So then I have to karate chop in the right spot. Just hold it up, not on a table and around the seam, because that'll absorb the shock.  Yeah, exactly. No. No, you got it, you got it. Oh, I did good. You did. That like crack, that's the air escaping. Let's do this. Okay, you did a great job. Congratulations. I feel good. You looked good, you looked cool. We're just going to throw a garnish on these, just for some color contrast. We'll throw in some orange slices, and because there's the cinnamon in there, cinnamon stick, this is a totally professional looking, delicious tasting cocktail for your holiday party. It looks amazing. To our accomplishments, to your accomplishments, cheers. Thank you so much. Oh, so good. So good. Nice work. Thanks, man. Tom, thank you so much for coming in. And if you want to check out, Tom, go to the Clover Club, and you don't have to.  If you enjoyed learning how to make this cocktail, please check out more One Thing videos on thespruceeats.com.


Gold and silver and actually also WTI and print had a nice run on Friday after the NFP Labor market a job start out of the US was not as strong as expected markets were not asking themselves Or didn't try to value those data points those NFP numbers just by themselves but they asked what the Federal Reserve might think about them and They asked about Did those over those numbers strong enough to a warrant a rate hike in September? And actually the answer the markets have on Friday is that they don't and so this is positive for silver This is positive for gold. This is also positive for the time being for the stock markets for equities Which went up. We also have Asia this morning. They hung saying going up on a new year yearly high Hang saying has built or has formed an inverted head and shoulders pattern There's still seven percent to go to the target of that bottom information. So, yeah Asia is very strong this morning So is the Taxations of the DAX this morning the European stock should profit from those Yeah, hopes that rates in the United States will be lower for longer Very positive is that gold is rising vis-a-vis with equities It's going up at the same time as equities are going up And this is a very positive sign because it's a signal that the bear marketing gold in the precious metal sector has ended Yeah, if you look at the United States, there's another Development of note in my opinion auto data. They have statistics for the sales numbers of automobiles in the United States. They had 17.9 million cars sold on an annualized basis just some months ago So you can take the monthly data and just Calculate them to the whole year just annualized them and Just some months ago. There was a peak of seventeen point nine million now We are at sixteen point nine eight million sold cars on an annualized basis in the United States So actually sales are going down economic growth isn't as strong as expected and The bumper is that Ford the car maker thinks that the peak of Sales has been reached and they are not speaking about the peak in the summertime, but they speak about the peak from 2009 until Now sales have been going up and up and up When it comes to old automobiles, but now the peak has been reached and Ford expects That sales will go down from now very interesting in my opinion So there's still a lack of growth globally so G20 the G20 States and politicians and officials a meeting in China pledged to boost growth again I don't know what they want to do. They didn't give any details, but they All together stand for more growth on a global basis So it's interesting to see what they want to do because actually the dead load of virtually every Government worldwide is just so high that it's not possible to get even more debt to finance any Fiscal stimuli. So let's see what is really going to happen this week Or with a high probability is that the ECB a European Central Bank is going to Talk about their QE program, which is actually Stabilizing growth in the eurozone, but not as much as the ECB wants it to be So actually they or markets expect at least that Mario Trager, which hasn't been Which he didn't Publicly speak for for many many weeks now. He will be on Thursday early afternoon He will be holding a press conference after the ECB published their Yeah, communicate and Actually markets expect that Mario Trager will Lengthen the QE program of the ECB Because everybody expects that by mid-March where this program will actually end that by mid-March 2017 Conditions for inflation and growth will not be met yet actually. So Everybody expects that he does say something about the QE program on Thursday. If not Then he will do so on October or at the latest in December to prepare the markets that there will be more Cheap money and more liquidity coming from the ECB


It's a time to get to see people you haven't seen. I just saw some friends of mine who grew up in Chatteroy and it's like a reunion weekend. There are families that have their family reunions this weekend, so there will be something for people to do and a place to go. And people just love it. They enjoy it. It's just so much to do and that's why people love it. They don't have to go anywhere else to even get food, so it's great. In many ways the contributions that Cole has made to our community, our area and our country and also allows people to raise money for their organizations with their vending booths and those types of things and it's a traditional Williamson event. It's one of those that's sort of circled on the calendar every year.


Jog circuits are useful when you may need to momentarily bump, inch, or move a motor as opposed to having the motor run continually when you hit the start button. In this video, we're going to look at how you would wire up a circuit for jog with a control relay. So here we have the schematic. We have your typical stop normally closed push button, a start normally open push button, a jog normally open push button. Then we have a control relay coil, which has the associated contacts with them and the motor contactor with the associated contacts with it as well as the overloads, the three overloads denoting a three-phase motor. What's going to happen now is if we hit the start button, we're going to run through the sequence of events that occur. The moment I push down this normally open start contact, what will happen is current can flow all the way through and the CR coil or the control relay coil can energize. Any contact that is associated with the coil will end up doing what it's supposed to do. The normally opens will close. So this normally open CR contact closes and this normally open CR contact closes. But that's not all that happens because what will happen now is not only can current flow through here and energize CR, but current can now flow through and energize the M or the motor starter contact. So we see here that M now is energized. This starter coil is energized, which means that the contacts themselves will close as well. So what'll happen now is starts goes through CR is energized, which closes CR contacts which energizes M, which closes these contacts were closed when that closed, the M contacts were closed when M energized, and now my hold-in contacts will keep the circuit running, even if I let go of this start switch. Even with the start switch unengaged, I still have a path for my current to go down through over here and keep M energized. So the motor will continually run. So in order for my motor to run, I have to have both the CR coil and the M coil energized. When I push the stop button that interrupts the current through the whole circuit and basically everything drops out. Now we're going to look at what happens when we hit the jog button. When we hit jog, the CR is not energized because it is being held out through this normally open push button. So it will run through and I will energize M, which will in turn close the M contacts. But because CR is not energized, the CR or normally open contacts are de-energized and the CR normally open contacts here de-energized. Current does not have a path that will not cross over this open part of the circuit and M will stay running as long as the jog button is pushed. The moment I let go of that jog button, you'll see that M will drop out. And with the jog button back to its normally open position, there's no longer a path for M coil to energize. CR is open as it always was and then M opens as well and you're back to a complete de-energized state. And that is how you can have a jog circuit utilizing a control relay.


Hello everybody! Today I want to share with you something amazing that my partner and I discovered in the last month when we've been in one of the biggest tech conferences in the United States. So in the previous month we've been in an AWS conference, actually it's a server company, it's the biggest server company in the world and they are making some conferences in different countries. So we've been in the conference in the United States and we saw something very amazing. The first thing is that we saw that all of the new technologies that Amazon talked about, AWS has talked about, we already implemented in our company to help our customers and to improve our services. But this is not the important thing. What we saw is that our servers and our uptime is over 99.98% up. It means that our services almost always up our auto-ordering, our site and our monitoring platform. So what we discovered to do is to make it very transparent for our users and to give you the opportunity to see when the site is up, when the monitoring is up and when the auto orders are up is up. So what you can do, you can go to status.autods.com and there you can see in any moment actually this system updates automatically without any action from our site. You can see if the site is up or not. You can always know if everything works as you want, as you need actually or you need to be worried because something is not working properly. So we are really sure that it will help you and it will save you time instead of contacting the support and ask if there is any general problem. You can just go and check it by yourself on the status page. Also you have it on our Intercom chat here in the bottom. You can see here the status all system operational and if there will be any problem anytime it will be updated there automatically from our system. So you can just go there and check the statuses of anything in Autodesk, the Autodesk app, find the suppliers and auto ordering. I really hope that this feature will help you and it will make it everything much more transparent for you. So you can enjoy your work with Autodesk. See you in the next videos for any question. Just ask here under this video in the comment section and I promise you that I personally go every day over the questions and I will answer your question.


It's the mat work. So almost going back to what I was asking last time because I was trying to draw a connection between what I'm going to do visually and the brand and the music and everything. So how do I know where to start in my story and when to start the story in my songs as like fans kind of like funnel in so they understand what I'm talking about. If like some of the songs are situational, do I just kind of just start with like the overall story like from the get go? So what's the particular story again? Because I remember you are already talking about, you know, it should be past tense or present tense and how does that go? Is there a very specific story that you're trying to relate right now? Yeah, yeah. So it's more of like, I don't know if you know, like, well, easiest way to describe it is like, I don't know if you know Hassan Minaj.  So I just wanted to give like my take on this and also like kind of show people that like, all right, it's I may be talking about stuff that Oh, you might think like on surface level, it's more meant for like an Indian crowd or whatever, but I kind of route it back to an emotion that and we're like kind of like humans in the end. So like it all relate to an emotion. So I try to digest, like, like kind of frame it in that perspective, which is also why the name kind of goes into like, we good, like no matter what happens, either the highs or lows in life, we good, right? I, so I guess like going off of this is more of like, so I want to, so like for fans to understand what, what my like thought process is now and like what I'm doing, I kind of want them to like go from like square one, which is when I was like in like a dark, like a bad place type of thing, not like really like confident in myself and all that stuff. So my, my question is, do I, so I want to release first. It was like, okay. So based on like what you were saying last time, it's all the media and like the pictures and the content around like the songs I will be releasing will be related to that, just to keep like the story, like kind of consistent. But the thing is, how do I like, it's like more of like figuring out how to narrate it properly, if that makes sense. Like, do I start like from the very beginning of the story from like singles, or do I save this story for like, maybe like an EP or like an album and just like do specific like instances of like situations or whatnot, just as singles and hope that like the audience understands that these are like instances in an overarching story. Like, I don't want this to seem like random stories that kind of just come seem disconnected. Like how do I make sure they understand like the overall like story that I am coming from like basically the brand in a sense. The we good part or the Indian American part. I would say like the first since I'm coming from the beginning, it would be the Indian part, because the we good part is kind of like what it goes into. Got you. So one, you have to utilize things outside of your music, right? Whether that's an interview or whether that's a visual or some kind of small series or piece of content in relation to it, something that you do and launch around it. So you can have maybe a like five part podcast series, right? That's open and honest and discussing, discussing what that experience is like from an emotional standpoint, from a happy, from a comedic standpoint, whatever makes sense for your brain. And you can touch all of those in all of those emotions from your point of view, whatever that unique point of view is as an artist. So that's a place to start from your songs. You don't want to tell too much of the story for the sake of the story. You want to make sure that it's still going to be a good song. So you write about certain instances. And then the people who understand your brand from the rest of the packaging, they'll be able to relate back to it. But then if someone experienced a song first, because everybody's not going to experience you from the very beginning, right? And from that in a specific order, then they'll just like the song for the song. And then they get taken into the world, right? And hopefully some of them might just stay surface level, but the ones who get taken into the world would then be able to realize there's a greater story and then even be able to see there's a chronology to it to follow. OK, so if I were to like talk about all this on like a podcast or whatever, is it there's not really OK, so there's no such thing as like kind of being too open, too early? Or is that just me kind of being weird? And that's something that just kind of comes up where you just because if I just have like eight hundred followers, but I'm like spilling my like feelings out, that's kind of I feel that's kind of weird unless it's like what comes with the job. Part of it comes with a job, but another part of it is. Well, there is a sense of being too open. I wouldn't use the words to open is just being tactful on what you share and when you share it because you want to understand what the brand that comes with that will be.  What is it?  I just feel like some of those details are necessary, especially because some of the people who follow me were part of it. So it's there is that connection point, which they can like relate to. It's just that I feel like being a little since I'm not like very active or anything as of right now. I just like I've been doing like the what the dollar dollar 80 method or whatever that Gary V does on Instagram. And I've been doing that, but other than that, I haven't like posting content because I've been trying to figure out like maybe like, OK, I set like 10 different kinds of posts that I could do that. I can just kind of like rotate between. But I've been I wanted to get like the brand all like structured or like unified to get a concrete idea of what it was so I can like go down from there and figure out the 10 that I was going to do. Um, but what I am talking about is I would say is, yeah, in a sense, being like open, talking about like the more like sadder part, which. Yeah, yeah, it's more about like the sadder part, not really like the specifics.  Can you hear me now? Yeah. Yeah, I just got you. So from that perspective, one, I say right out the story. Like make it clear so even I can understand, maybe share it. And then we can piecemeal what should be received, where and what type of content can relate to it.


I'm running. There you go. Oh, I've got to share YouTube for you guys out there in YouTube There we go. All right, perfect. All right guys, so welcome back Looks like we're gonna have another exciting morning. We're about 150 points. Got a couple of nice interesting stocks I'm making a nice little move. We're doing really really well with the stock MR. I and I mean, I had a really nice pop on the second What was that time we actually there was two of them actually but and there was one nasty one at 8 a.m But program trading is what makes stocks make their biggest moves and I just want to blow this up really quick So, you know, some of us get in early, you know, we usually start opening up the room around 745 The stock obviously came up to on our watch list and then all of a sudden boom The thing just ran up to about 290.  It's that nice. I saw cheap little stock right there and then all of a sudden the stock literally ran and took a really nice run from You're 270 and then second product of the second program trading time zone at 830 Boom where from 270 all the way up to 315, you know, you could have trade several thousand shares of that You could have trade one share of that stock. The goal is is having the fun of making money And you know in a stock that's going the trend and also doing it in pre-market I want to point out something over here. There was a couple of orders. I didn't see that That much excitement on level four I'll bring over here so you guys can see it So I did see a big order right here. It got filled when the stock came back down There was literally about I don't know or not really that much about only about a hundred twenty seven thousand shares but Which is a lot which is a lot and sure enough That's what we focus on follow the big money and then boom the thing obviously popped only to about 319 But here when I didn't see any orders out there, and I saw this all the order right around that 830 get filled That's where you had that really nice pop. So I mean that really pretty much Did it for this morning? There were a couple of the stocks out there that made some nice moves Laser loose is called laser that that made a nice little pop right there. We're gonna check out that one also But but as always, you know how I give you a nice watch list I'm gonna do something a little different again like I did yesterday I'm gonna go through the watch list show you how we how we bang it out You know also being a little bit more of an educated type of class and then obviously that kind of give you an idea of How we find these big movers now obviously you could see the biggest percentage gainer in today's market on The Nasdaq and on the most volume list right there on the left hand side is Now does it mean that this is over it's done I mean stocks of 75% no listen There are a lot of the stocks out there, you know, they're gonna move so this might be done for all we know but Being a good trader, you know, you have to remember it's not about hitting home runs It's about base hits, you know what every time you try to hit on her home run You're gonna strike out more than others. So that's basically what that comes about now before I do that I just want to kind of touch about some stocks that we did trade yesterday that some of you missed I want to start off with the E and TX trade and Let me just fix that chart right there and blow that up so you guys could see it So anyway, that stock had a really nice big early mover right out of the gate ran from force Seven I mean 640 right up to about 840 really nice to doll move but it got there so fast that I always tell you and You know, we teach you this in class things that go up really fast You got to be very careful because they come down twice as fast.  Can I still trade? Yes, because the markets trading from 9 30 Eastern to 4 o'clock And you know, we always trading pre-market. So that was also pretty good tiger was also another one That had a really nice early move.  Nice stock were from 24 all the way about 26 It wasn't like the other some of the other stocks that we traded the other day where they were up a hundred hundred and fifty percent But there was definitely nice movement there to make a nice decent Days pay and then the ORPH I want to just bring that one that one was Phenomenal that one that was probably one of the best ones and you know, it's funny We always talk about the 10 30 move. That's another time the program trading that thing just literally ran Once it broke that 660 price range when they hit that resistance level right the open Don't listen. This thing was off to races. This thing ran all the way up to night 20 so and everybody should know the stock right here because This is the stock that we traded just about, you know, not too long ago ran from five dollars all the way To seventy five dollars. Yeah, that candlestick right there.  So let's go through um, but that's the past Let's not worry about that. Let's flip the page and now let's focus on what's going on to the future and the future is Follow the big orders cyber traders and my fellow traders on YouTube and Facebook. You got to follow the orders So we have our our level four. Where is she? Put her she's right here somewhere There we go It's hiding behind the other window. There's a problem.  So here's another stock that's moving this morning Charles actually called the CLO V. I forgot about that one too. CLO V. Hold on Has been treating us really really nicely and I've been a big fan of that one. Yes, great coal right there Charles Look at that gorgeous pop right there 1425 if you know what it just came up. It's right now the fifth biggest percentage gainer on the Nasdaq I love the Nasdaq. I'll listen I'm not biased, but it's just a NASDAQ. There's just so much more action will volatility, you know But always important what we always train you you don't jump into a stock without knowing Where the orders are now this stock we did really well with it The stock had that big rather from ten dollars of twenty seven came crashing down But she's been doing really nicely lately. She's just a little little volatile, but a great call right there. We're gonna come back to it. Oh Okay, let me just bring this up to you and share what's going on.  They're not worth it. So this is garbage. This is garbage This is the warrant for CLOV, you know, very difficult spreads are pretty big when it comes to that This is not a good, you know stock decent volume up a little bit spreads too big You know, remember they got to be very tradable. You got to make sure you have a very very good level on it Now what else as I'm working way down the list you can see like now we're getting down to the 5% time zones When you get to 5% that's where I call it quits. I'm not a big fan of it But this one I am thrown on here the VX RT. Wow, this one just made a nice little move to another 9 o'clock Program trading the stock we traded it back in February some of you remember this thing ran from $7 up to 25 Yeah, that could happen that could happen You're like, wow, and everyone keeps talking about AMC and GameStop guys Professional traders like us we see these things all the time. By the way, this is why you don't hold positions overnight PRTG People think like well, I don't trade $3 or $5 stocks. I don't know what you guys are prejudiced about Why if you can make a dollar on a $5 stock doesn't matter if you trade a well, it's you know, it's too cheap They're not penny stocks because you want trade expensive stock Yeah, wake up one morning and be in a stock like PRTG and every day you think like oh, you know We're doing great $30 $40.  We traded this one to back in June or from a dollar fifty to four fifty on She's not looking Too pretty and pre-market, you know, you could see she's like hovering right around these Resistance levels back in the beginning of June. She's holding here pretty strong I'll pop over there and check on level four and see what I think but as you're looking at some of these stocks They're not as Pretty as some of the NASDAQ stocks.  So I'm not seeing anything pretty that I like on the on the New York stock exchange There's really nothing there that really stands out losers righty Ever liked that store, I don't know what it is They put one in my town and they got bought out by Walgreens. Thank God, but I don't know never really was a fan But it is at support levels not gonna hold it against it. All right, not gonna hold it against it Was that the DQ? This one's taken a really big hit, too Lot of these stocks are really coming down a little hard. So that pretty much does it I mean we got we got one two three four five six stocks. That's not bad That's not bad for the for this morning What else that we got going on who's looking at something else or pH? Norman's bringing that one up there You know like I told you I'm not super sold on it. It was a great It was great. It did a nice move. I'll put it back on the watch list again You know, maybe maybe we'll come back at that big rally But listen, don't let what happened, you know when it went from that eight dollars to eighty dollars but I will we if you did your homework and you learn what we taught you here at Cybertree University and You look at your journals and look and say, how did I trade that stock? How did it work for me? Make sure you look into it, but we'll put it on the watch list. We'll see how it goes. All right Anything else that I'm missing I did not call out anything else out there Gomez sacks bull five percent shares of what oh and ORPH Was that the news what happened Tina before? I Mean, I'm really over here Gomez sacks buying, you know a stake in a company, which is very very rare That's that's pretty funny But we'll keep an eye on that that that sound that's very interesting And by the way for some of you don't know this okay yesterday did oh, that's why it ran If some people you don't know this Goldman Sachs is the godfather of Wall Street Okay, I think 70% of their their their business model is all trading so if you know You might hate them you might not like them you think they're sleazy, you know you think they're cocky But at the end of the day When they when they talk you better listen because they're not stupid They got the smartest people in the world that work there and there's some of the best traders in the world And I know that because some of them in my neighborhood. All right guys. Good luck today. Happy trading. We'll be back At 2 30 for the afternoon meeting cyber traders, you know commentary will start at to that just when the market opens up and if you see something say something if you're watching this video just friend us like us and Like I said, if you feel free to come join us and find these stocks that moving today's markets All right, because that's what it's all about make your money. Enjoy it take the day off and come back tomorrow Good luck everyone. Happy trading. Be safe


My name is Toby. This is Mickey. We're glad you could make it this morning. We're going to talk to you about Windows Gadgets. First, our standard disclaimer. None of this has anything to do with anyone that we've ever worked for, or do work for, or might ever work for in the future. We have our own opinions. They have no opinions about anything and the two connections aren't connected in absolutely no way. Shape or form, they have no knowledge of anything we do ever and they're not even sure we exist. Well, aside from not being sure that I exist, my name is Toby. I'm a senior InfoSec geek for a Fortune 50 company. I do all sorts of things that mostly involve telling people their ideas or bad and then trying to keep their ideas from being compromised once they insist on doing them anyways. And an opinionated loudmouth. That too, you forgot to say that. My name is Mickey. I used to work for a Fortune 50 company. I used to break software firmware and hardware in my spare time. And well, that's it basically. We're going to keep docy-dowing because we don't have wireless mics. Excuse us for being a bit rough this morning. Today we're going to go through a bunch of different things. First, we're going to spend a little time. We've already talked about who we are. We're going to talk about what gadgets are. By the way, you all know we're talking about Windows Gadgets, right? Yeah, we're good? Okay. We're going to tell you a little bit about what Windows Gadgets are. History, little details about them. Then we're going to go into what's wrong with them. We're going to talk about first attacking with gadgets and then we're going to talk about how you can attack gadgets. Then we'll spend a little bit of time talking about, once it's all done, what you can do about it and what the solutions are. Long-term, short-term solutions that Microsoft chose and otherwise. I understand. A couple of thank yous because this talk is based on several things made by other people and the support of other people. So I'd like to thank Itzy, Gaffix, Ian, Jason Street, SoftSec folks, Wim, Aviv, Raph, Galdi Skin, and Suzuki Sao and Mitsuki. Mitku, I don't think I pronounced that, but they helped us a lot with their work. Try this one. Also, CG, I guess we'll use that. We apologize, clearly technology is complex and we're not very good at it. Also, CG from a Carnal Onage blog for his work on PowerShell Bypass, PowerShell Metasploit, and just being a lot of fun to read. So for those of you who don't own Windows systems, what are gadgets?  You can use gadgets that range from a simple clock up to GPU performance handlers. They're very simple to use. A couple of examples on screen. Those are the default Microsoft gadgets, the CPU clock, the RSS feed and the weather. A little history about gadgets. The first references we've actually seen documented were to show the active desktop in Windows XP. Over the course of the last week or so, we've had a couple people mention that they remember seeing similar things that there was actually an active desktop in 98 as well, but we weren't able to find any traces of it or any documentation on it. So the first thing that we've seen is from Windows XP is the concept of the active desktop.  It was fairly simple. In Vista, they started moving around, moving to the concept of actually having something called a gadget. They had the sidebar. It was fairly simple. We'll show you in half a second. It looked like this. Literally, it was just a sidebar. All of the things ran along it and were very tightly tied to it, but they were referred to as gadgets. In Windows 7, they actually did a significant number of improvements to the capabilities. First, they combined it to a single process. They made it much easier to manage them. They could be placed all over the desktop. They also added a number of new capabilities to make it easier to develop, and they added a bunch of enterprise security features. The development points are obviously irrelevant at this point. Windows Vista, this is what it looked in Windows 7. We're actually both quite fond of the Pandora gadget. It's a fairly handy thing to have, and it's literally just a way to listen to Pandora on the system. I think I was listening to Ween at that time. These are some other examples besides the ones that you saw previously. The question is, why does this matter? To be quite honest, Mickey came to me and said, we should do this, and I said, why would anyone care? It took him about three weeks to convince me. It felt like an eternity. Yeah, you're telling me. About three weeks to convince me to do the research, and frankly, it's not news. If you write bad code, you're going to get compromised, right?  This isn't novel. Turns out, though, the same issues that made this an actual interesting target and a problem are being moved forward consistently as a clear and enthusiastic business model. We're seeing everything being done by vendors to try and make it easier and easier for people who have less and less experience and knowledge about development to actually do development. So the sorts of mistakes that we found and that we were able to exploit and take advantage of on these systems are going to continue being common as long as you can do something as silly as write an entire application in JavaScript and HTML. So a little bit of what is a gadget? A gadget is a zip file. Technically, it's a zip file renamed to be .gadget. If you didn't get that, that's cat.zip. A gadget has several screens on it. The main one, which you see when you use a gadget, there is an about, a fly out, and a setting screen. As you can see, they have correlating HTML files. This is, by the way, the simplest directory structure for a gadget. You've got a CSS folder, images folder, JavaScript folder. A couple of HTML files. Sorry. This is Neon Cat Gadget, which you'll see soon enough. The part that is not standard is the gadget.xml, which is the gadget manifest. It holds the information on a gadget, manufacturer, copyright, URLs, permission level, which is always set to full and is expected to be full by Microsoft for some reason. Forget anything? It can get simpler. Yeah. This is the template. Yes, this is the HTML template. But you can also develop gadgets with Silverlight. So it's even more simpler if you... It's simpler, sorry. English is not my first language, I apologize. WPF and Silverlight will make it easier to code malicious code into your gadget. So a little bit about the security model. Microsoft actually provides a very detailed explanation. We were surprised by how much effort Microsoft has put in to documenting the security model and to documenting good security practices for writing gadgets, especially considering the general lack of security quality we found in the development of gadgets. They didn't, for lack of trying, we didn't see quality for lack of Microsoft trying to do it right. What we're going to do though is we're going to call out some of the highlights of the security model and if you want to see more, you can still find the documentation for a modern Microsoft site. There's a URL in the background. First, code signing is actually possible. It's not standard. It's not common. It isn't required, but it is absolutely possible. We saw out of 60 or 70 gadgets that we were able to pull down one or two, maybe three. One vendor. One single vendor and not very many gadgets from any vendor that were actually signed. The prompt looks pretty similar to the actual installation for any standard application. The action behind it is much less complex in that it's just dropping everything into a directory but I'm making a couple configuration changes, very small stuff. But as you can see, it looks pretty standard. Show of hands, who's familiar with an HTML application? HTAs? Show of hands? Who can give me the square root of 1,563? Just checking that there was actually a difference in response. So, they're fairly similar to HTAs, HTML applications. There are some differences in that they still run in the local machine zone but they have some additional privileges that you wouldn't otherwise be able to take advantage of and they have some limitations that aren't always in place. First, one of the advantages and something we found tremendously useful is you can instantiate any active X object on the system. Doesn't matter what it's for. Doesn't matter whether it's a reasonable or sane thing to be able to do from an HTML function, you can do it from here. However, you can't actually kick off a USC prompt. Doesn't matter what privilege you're actually running as for the user, this is always going to run as a standard user even if you're in the admin group. On the other hand, any process that's been exact from the gadget can then itself raise a USC prompt and since you can use the active X shell.run function or shell.exec function you can still pretty much do what you want from here. Parental controls do apply as you would expect for any HTML based thing. It's a running in an IE container, it's just a modified set of permissions to do so. Anything? You want to add anything? Some of the enterprise features that were added in Windows 7, there are a couple basic things that you can use, you do via GPO, you can manage them in different ways. One, you can turn off the sidebar completely as a function. Two, you can set policies to control unpacking and installing of Windows gadgets that aren't signed. Unfortunately, this doesn't actually prevent somebody from installing them manually and it doesn't remove gadgets that have already been installed, it just prevents new ones from being automatically installed when they double click and want to run them. You can disable user installed gadgets which is basically just locking down the permissions for a specific directory and finally you can actually override the get more gadgets online link which is now dead anyways. At this point, normally I know the standard is to ask questions at the end. Feel free though, does anyone have any questions about anything we've covered on the development side of it that you want to ask now? The question was is there any concept of this moving to Windows 8? Do you mean is there anything being done in Windows 8 that has a similar sort of idea behind it? Okay. As far as I know I guess since neither of us work for Microsoft we can speculate wildly but as far as we know you've got the metro app store sort of thing that is similar but it's wrapped in the app container capability which locks it down much much more tightly and I haven't looked at the development for the metro app so I don't know anything about metro app. Any other questions? Yeah. I think the question was is Microsoft really going to remove gadgets from Windows 8 or are they going to make it optional? Our understanding is they removed the feature and other questions? Attack surface. We're going to now go into a little bit of the attacking actually through gadgets and with gadgets. We're going to start off with attacking with gadgets. One of the fundamental problems here is that it's just another piece of code somebody is running. We've all known for 20 years that if you download and run someone's code it's just this little tiny container thing. Unfortunately people don't actually think of gadgets for some reason as code. We weren't quite sure why.  Honestly they are just as dangerous as any other piece of software. So the question is what can you do with this? Well is it really just another piece of ability that you would expect? Here are some of the things that you're actually able to do from a gadget. I can't do everything I might want. Well OES, wait a minute, I can. I can exact code. Do I need to say anything? Well just in case anyone is curious you can also open URLs. So if you didn't want to carry something with you in the HTML that you're downloading with the gadget you can go get more. If you want to change what you downloaded you can do that too. You want to update, no problem. You want to create files with arbitrary content binary or otherwise on the system. We can do that. You want to be able to read files, anything that the user has permission to you're good for. And if you want to get past that permission obviously you can just spawn something and raise the UAC prompt and do so. Make your computer speak. Sure, you can do that too. All right. So let's just make sure this works. Proxy setup is going to be one. It's going to be another one. No, I think that was the never mind. Let's stop with the Gmail. We're going to show you a little demonstration of what you can do with a malicious gadget. I'm just going to make sure I'm connected. Okay, so this is a POC of a gadget that will self spread to all your contacts. It is not fully weaponized, it's just a POC and a little explanation. The gadget opens Gmail assuming well, quick question which how many of you use Gmail? Okay. How many of you make sure you log out after you and stop using Gmail? Every single time? Every single time. How many of you are lying? That's not good. What the? Okay. Can we get sound from okay. I apologize in advance. You should be so ashamed. Open your contacts. Select them all. Create a new email add a subject add a link and we'll send it. When it's done it will close the window. Now just to clarify how it is. First of all I would like to stress that there is no security vulnerability in Gmail. It's kind of work around for a setting. Gmail allows users to use keyboard shortcuts. And to enable that usually what you do is go into settings and select an option saying enable keyboard shortcuts. However, if you open a URL with KBD equals 1 in the query string you will get that feature enabled. And gadgets very easily send keystrokes to the screen. This is the code that sends the Gmail. 16 lines. That's how simple this is. So simple example, you saw what can be done very standard malicious sort of gadget activity. The key is that it's got all of the access it needs to all of your cookies and all of the information in your browser. Which means it also has your proxy configurations. It can manipulate anything else it wants on the system. It's got all of that state that you're giving it at any point in time. Another condition. We discovered also that gadgets can also read map network drives delete map network drives handle map network drives. Everything that Windows supports it can do basically. We actually ran out of time to find out all the things we kept finding we try something and say oh that's possible. How about oh that's possible so you've been something we've talked about attacking with gadgets simple demo. Hopefully you understand it is just a POC. The question is now what can you do in terms of attacking gadgets. Well unfortunately they're just code. And in many cases they're written by people who don't have a lot of experience writing code. It was fairly interesting as we went through the collection of gadgets and we found about is that a question? No, it had all of them in an attack? Okay. We found about 65-70 gadgets that were floating around that people were actually using. And it was very easy to distinguish between the gadgets that were written by people who are used to doing development. And they'd break it down as you'd expect with any developer in terms of having separate files for different function families and all sorts of clean object oriented design and people who are used to doing web development in which case you'd see one big HTML file that contained everything in the JavaScript and you can do this. It's really just a web page to some extent that's running locally with a lot of extra pillages. So you'd see a lot of different styles and of course that leaves you with a lot of vulnerable systems so you end up with a fairly basic strategy which is just find some gadgets analyze them pause and profit. So what did we find? Well when you went around we found a lot of sites offering malware that were claiming to be gadgets we found a fair number of gadgets but we found more in terms of total number of sites that were offering it there was more malware out there than there were actual gadgets we found really limited use of SSL in fact the only consistent cases that we found SSL being used were in the cases where the websites that were being connected to required it otherwise they didn't use it and we actually found all interesting educations you want to give them the rundown? Yeah we saw one good use of SSL in a gadget but the funny thing was that the website hosting the file that was being accessed through SSL also hosted it at normal HTTP so all you got to do is SSL strip and you win and this is the sort of behavior that we saw that was actually some of the more well intentioned behavior we saw most of the time we didn't even see that used so a lot of connections to ad servers that seemed to have no purpose for the gadget they never notified the user that they were being connected to they never prompted the user for any permission or activity around it it was just generically run we also found that there were a small number of producers that produced all the gadgets which meant that there was a lot of share code at one point Mickey got this random text from me saying there's something really strange going on I've got gadgets that are coming from different sources that have the exact same update patterns in their fully qualified domains literally the pads are he said no I can't be right the pads are exactly the same we start looking into the domains a little bit and they have not listed that there's anything compared we find out they're owned by the same company and that the developers at the same minute all of a sudden make sense they're using the exact same code base there's just no reference the question is was there any warning for self-signed certs or anything like that and certainly you would hope to see that and we did not we also didn't see any prompting for cookies now that may have been the configuration but I don't think so because we tried it with about half a dozen configurations and it just didn't seem to prompt the way you would expect so the interesting thing is that if you find something in one gadget you're probably going to find it in other ones as well this comes up a lot in a framework and if you're building a framework and a lot of these are built from simple frameworks you're going to end up with shared flaws this is just another instance of shared code giving you underlying problems how many remember the ASN1 bug one two really? okay ASN1 is an underlying parsing protocol that the US government defined they offered a reference implementation of it that nobody bothered to use as a reference and just took and implemented directly into everything baseband for satellites ISDN SNMP everything uses ASN1 and so there was this really pernicious flaw that showed up everywhere because of the shared code problem it was a long lasting flaw so like we said we found a bunch of actual really poor practices which led us to plenty of options for how to inject code your default permissions were full we could easily sniff traffic I think he really likes this one yeah this is a funny one as we're looking through traffic seeing what the gadgets send through HTTP requests on 64 bit platforms we noticed that gadgets will send a request every request will be sent with an HTTP header UA-CPU does anyone know what that header is? show of hands that header is to indicate the kind of platform you're using as far as I know I can tell from the large scope searches I did online and Wikipedia which is not really accurate most of the times UA-CPU has been used in IE3 and 4 and has not been used since except here the only use that we've seen is in gadgets on 64 bit platforms 32 bits are unimportant more interesting thing is most of the systems that I have been in contact with through all my corporate life experience have been Windows 64 bit machines we have no official numbers but we assume that most of the Windows 7 machines are 64 bit based so I got to do a sniff to traffic and you'll see it easy to spot so SSL we all know it's really complex it's not like there's good references for it it's not like it's well documented there certainly aren't libraries that are available for everyone to use and it certainly hasn't been explained again and again and again and again how to do it right so why would you expect anyone to do it properly and since you can't expect someone to do it properly what you end up with is this strange habit where gadgets want to update themselves it's reasonable auto update is a reasonable thing but what we found was you have clear text downloads of updates and since gadgets are written in javascript and html what you've got is clear text download of javascript and html which is then fully updating the entire cache of the gadget itself which means you've just replaced all of the code for the gadget which unfortunately means that whatever you looked at at the beginning may have absolutely no reference or relevance to what is actually going on to what's actually executed this is sort of like what Charlie Millard demonstrated except nowhere near as complex or challenging and not quite as cool well nowhere near as cool frankly but the same sort of consequence you think you get one thing and you get something completely different as a result it makes it really simple to perform a man in the middle attack as Mickey pointed out there's a really simple html header that you can check for you can use something as simple as your phone to be clear the demos we're showing you and the demos that we've done were actually doing full man in the middle we configured a proxy this isn't because it's required it's because the demo gods are capricious and fickle and really really nasty and we just don't want to have any more variability in it than we absolutely have to there's no reason though you couldn't just do a race attack and do an injection without actually having to use a proxy for this okay yeah so what we have here is a proxy running in this window bottom right window a proxy said listen to gadget traffic and intercept it and replace the response with something interesting I'm going to display this using it yeah no that was just the port that we set up for the proxy the question was all gadget traffic hit 8181 no that was just the proxy port that we chose because it was a nice number no meaning no meaning otherwise um the question is is it typically using any gadget traffic is just running an IE process so it's going to use whatever ports IE is configured to use by default it'll use 44380 if you've got a proxy that's on an off numbered port it'll use whatever is on the off numbered port yeah so this is the normal screen in windows the default gadgets the only two different ones are the neon cat which you already seen and the piano the piano gadget is this one is exactly the one that was in the Microsoft gallery live gallery before they killed it no modifications have been done to it reminder this computer is running through a proxy right now hello this is your computer I'm tired of the way you have been treating me I am going to self destruct in five seconds goodbye the gadget isn't supposed to do that that's by the way three lines of code the hardest part of that was actually well no I wasn't really a hard part of that one that was an easy one to be fair your computer does complain at you a lot imagine hearing that when you least expect it so the simple example we gave you of running just injection making your computer say something this is kind of cute trite a little silly we've seen it before the question is of course can we get a shell that's always the real interesting question and the interesting thing is as we said since you've just got the ability to write anything you want to the system and you've got the updates in many cases or not even the updates you've got the request for html and javascript running in clear text and it's going to then go execute your javascript and parse your html you've got a tremendous amount of power in the process you can write any scripting language you want execute anything you want in our case we started playing with PowerShell so at this point ok so what you've got now is three windows top left is a simple html web server that we set up it's serving a shell it's serving a file in this case the file it's serving is a very simple metasploit meterpreter reverse tcp shell we didn't do any modifications by itself this shell would be detected by any decent antivirus that's purely for poc because we're lazy the fact is obviously that you could download any binary that you want and you could write anything you want in the upper right corner you've got metasploit waiting for a recurrent connection and as mickey already showed you you've got a proxy in this corner we're going to do one small change the payload that's delivered because it is a gadget just like because it runs in the IE process you've basically still got to clear the cache it'll store things there were a number of times where one of us or the other would forget and try to figure out why something suddenly stopped working it was more than a little frustrating but it's pretty straightforward so what you're going to see from this side is not particularly exciting fairly intentionally from this side all you get is that all you see is a file working to the desktop now this is for a poc we chose to write to the desktop you can write anywhere you want there's no reason you have to write to the desktop you can start, you can write to the startup folder you can write anywhere the user has permissions to but notice that there is no prompt that you're running an unsigned binary notice that there is no prompt that you were kicking off anything from a script or running a script all you saw and one last thing the gadgets functional still works in contrast what you see when you've got back here is that you see the request was detected and injected you see a request here for the URL and for the file that it downloaded and over here what do we have but actually a windows shell so you can in fact now the interesting thing about this is that if you run the exact function from javascript it will warn the user that you are trying to execute something that's not signed that was downloaded from an untrusted zone it tries to do the right thing however if you run a binary from power script power shell it doesn't warn you at all now of course the default policy for power shell is you can't run scripts on the system luckily CG and some of the other folks out there have been looking around and talking about power shell attacks and documented some really nice power shell policy bypasses so what we're actually doing in this attack is we are using javascript to write first to pull down to the system then it writes a power shell script which is meant to execute the binary and then it writes a batch file which is used to bypass the power shell policy so that you've got a batch script running power shell exacting the shell the result of which is the user sees nothing and it bypasses all of the basic controls on the system to do so it was actually mostly the pain in the neck of getting all of that escaping properly set up between multiple languages and getting it to write to the desktop so at this point you can see we feel pretty comfortable that you've got complete compromise of the system we've owned it you've got shell we can do this with anything that you're asking for javascript from anytime you ask for javascript with a gadget we can do this what do you do about this it's fun to find flaws but you've got to find something that you can do about this well at a basic level if you're going to write applications it's going to be vulnerable if you're going to download and execute stuff don't take handy from strangers think about what you're downloading think about what you're executing if you're someone involved writing application framework and this is an open request to anyone writing application frameworks if it matters that something be done properly don't leave it to chance the easier you make it for people to write code the less experience they're going to have writing code finally there's always microsoft solution which is they removed the feature completely and they moved over to the windows 8 model which has the app container instead which has much much tighter controls over it completely they're moving into the windows store they've updated all the documentation for developers and everything else this research could not have been done without the help of others interesting history the three CVEs you see are remote code execution in default when those gadgets in vista reported by Aviv Raff in 2007 that's five years ago it has been probably worked by Ian and Aviv on DEF CON 15 and it's Ike Yonatan for the Jinx malware for a lot of reference even though it's not listed under the references the fact is that all of the functions we found the PowerShell policy bypass all of those things we borrowed proudly and stole enthusiastically from people who did and published and were good enough to share the original research that they found we couldn't have done it without them so if you've got any interest there's additional references here if you've got questions we're happy to take them we got only a couple of minutes after that we're going to be in the Q&A room number four I guess maybe we'll move to the Q&A room and take questions there thank you