Welcome to Sheboygan County Government, working for you. My name is Adam Payne, Sheboygan County Administrative Coordinator and co-host of this program with Chairman Bill Gehring. And today we're very pleased to have our Deputy Finance Director, Mary Wegman, with us as our guest. And Mary's going to be talking about the roles and responsibilities of the Finance Department as well as the very important process of our budget development. So Mary, good to have you with us. Thank you. Mary, why don't you just start by sharing a little bit about your background and how long you've been working in the Finance Department. Sure. I began with Sheboygan County in June of 1993. I was the very first staff accountant and I was promoted to my present position in August of 97 and I've been there ever since. So you were the very first staff accountant in the Finance Department. Yes, absolutely. And since then you've seen some changes in that office. How many staff do you have now? We have nine. We have nine and we've expanded. We actually have on our TO-3 staff accountants now. At this point we only have one position filled and we're looking for another one. Very good. So staff accountant since 1993 and Deputy Finance Director since 1997. Correct. And has the time flown or not so? No, it really has and it seems like every year it goes faster and faster. Well, obviously you've been in the department for a number of years and as quickly as it's gone clearly you have a lot of important roles and responsibilities. Could you please give our viewers a flavor for what the responsibilities are of the Finance Department? Sure. The Finance Department is responsible for all the financial operations of the county and that includes paying our vendors or accounts payable, monitoring receivables, internal auditing, internal controls, coordinating external auditing, debt management, budgeting of course, setting financial policies and procedures, and doing financial forecasting for the county board. And not just doing this for a department of nine or ten individuals but for 1,300 employees and 22 other departments? That's correct. We have, well, a lot of interaction with other departments. Our staff accountants are actually split up the various departments and so each of us is responsible to work more intimately, more one-on-one with each of our departments and that helps to facilitate the budgeting and you're in process auditing everything really. And that's a great transition. We talked about, you know, the difficulty or the process of putting together a budget every year and of course you're right in the middle of that and you and the Finance Director Tim Finch really help lead and coordinate that process. Could you share with our viewers a little bit about what is it that happens each year with this budget process? It's the most important policy document the county board develops. What are some of the first steps in getting that process rolling? Sure. It seems like we started earlier and earlier every year. Actually Tim Finch, the Finance Director, begins working with the Finance Committee and the Executive Committee coming up with targets for our next budget year. In June we finally have the budget kickoff meeting with all of the department heads and their support personnel where we lay out our goals and objectives for the next budget year. In July department heads go through and develop their budget. By the month of August they're presenting it to their liaison committees and late August September is when the Finance Committee reviews each and every departmental budget for the county. Finally at the October County Board meeting we'll be introducing the preliminary budget document so it's a long process. Sure is. We'll finish that in November when the county board ultimately adopts the budget and then as you said February and March of 06 we'll already begin discussions for the 07 budget. You did a nice job going through the process very succinctly there and obviously a key part of that process is the involvement of the liaison committees. There's 34 county board supervisors as you know, Mary, 10 standing committees. They all oversee one or more of the 23 departments and from your perspective and experience please share with our viewers what is the role of the liaison committee? What are they charged with doing? Sure once the department has developed their budget and we at the budget kickoff meeting as I said they're given the goals and our objectives for the 2006 then they go back with some information that we provide for them such as payroll projections, health insurance projections and looking at past financial history trends they know are coming. They develop a budget. Once they've done that they take it to their liaison committee and the liaison committee has to buy into their budget, has to approve what they're doing before it ever comes to finance. So the liaison committee as you said they need to approve that document, take ownership for it. They might challenge their department head to make an adjustment here or there and then ultimately when they adopt it it goes on to the finance committee and then from there to the full county board. That is correct. Yes. Very good. Thank you, Mary. As you know you worked for the county for some time. I've been on the county board since 1988. The whole budget process changed over the years. Way back when I first got on the county board it seemed like it would be each department or committee would try to think well what can I get by the finance committee. But when Adam came on board as the administrative coordinator he worked with the finance committee to develop a whole new budget process to attempt to kind of level out the tax rate so it wouldn't jump up and down. Currently do we have any limit on the amount that we can tax? We do. This year we have two limits that we must adhere to with the state. The newest limit is based on the net new construction. And for Sheboygan County that was 3.288 percent this year which gave us a levy increase of 1.4 million. Prior to that well and still in place I should say since 1993 is a rate limit. And that is only on taxes that are over the entire county so that drops off our special purpose taxes like bridge aid or library aid. Now this year since we have two limits municipalities are required to enact the one that is most restrictive and in our case that will be the levy limit for the net new construction. And really that new rate limit is something totally new to us this year. It's something we're dealing with for the first time and has put a fair amount of restriction on what we can tax. How have we done over the past couple of years comparison wise on our tax rate? Well since I can show you on this chart since we started a more formalized budget process with probably the 1999-2000 budget one of our goals was to even out the levy rate so there are no high or low really low increases and we've been very successful in doing that. Prior to that you can see we had some high years when we really dropped the levy rate and then we turn around the next year and increase it by an equal amount. So our goal has been to keep things very level and I think we've been fairly successful in doing that. You've been working on the preliminary budget now for a couple of months. How does it look for this next budget or current budget year? Where do you think we might come in? Right now our levy rate is at $5.95 and that represents a decrease of 33 cents. We still are reviewing budgets but I don't anticipate that there'll be much change in that. I would think we would stay very close to that rate. And it's really taken a lot of hard work by department heads, the committee finance department and county board supervisors to come in at that rate or to limit the request for dollars. Can you give our viewers some ideas about where the revenues for the county actually come from? Does it all come from the tax or where does the money come from? Sure. Actually our biggest source of revenue is the county tax levy and that accounts for 30% of all our revenues. Next are intergovernmental revenues and that makes up another 27%. And that includes all federal and state aid we receive could be state shared revenues, state transportation aids, IGT for the healthcare centers and support we receive for the clerk of courts, child support and any kind of governmental revenue. Next is the public charges for services and actually most of those are generated by our healthcare services. Those are for patient charges for staying at the centers. What about expenditures? Where does the money that we collect for the most part go? Sure. Our biggest draw on the levy if you want to call it that is our public health and human services and that accounts for 28% of all of our budget. The next closest is the general government departments and there are several departments making that up such as the treasurer, the register of deeds, finance, clerk of courts. So it's a whole grouping of departments. After that would be public safety and they make up 10% of our budget. Public works is very close behind and that's our highway department and our airport department and they also make up another 10%. The remaining 11% are all of the other departments and that's planning and land and water, the UW extension and the support we give to the UW Sheboygan campus. Okay. Really, some things just continue to go up and up and up but what have been some of the biggest challenges over the most recent years in beating the budget and putting the budget together? Well, again, we're estimating that we're going to have a double digit increase in our health insurance. We're projecting that to increase 13%. All of our employee contracts are settled and there will be an increase of 2.5% there but if you take those two together, of course, that's an increase of 15.5% to our budget. Additionally, we're projecting IGT will decrease. We're estimating a decrease of 24% from that alone and then as always, we have state mandates that are non-funded or underfunded so those are probably the things that make us pull our hair out the most. I wanted to jump in here real quickly because this is the key challenge that's really driving our budget process right now as Mary just alluded to. When you look at our wage and benefits alone, there's no fault of our employees. We have outstanding employees but a 2.5% increase in wages and health insurance going up 12-13% and we saw 20-22-26% increases even prior to that. It's starting to actually come down a little bit and it's still 13%. But those two areas alone account for about 2.5, $3 million in increase and as Chairman Gehring alluded to earlier with the budget gap that's with the state cap that's now in place, the levy constraint, really we can only bring in about one, one-and-a-half million dollars more of revenue through the tax levy. So if you take a wage and benefit increase of 2.5-3 million and new revenue of no more than a million and a half, well you can see immediately the type of challenge that the county board has and the challenge you have as a deputy finance director and all of our department heads have to continue operations in the same level of service. We're in a situation right now where organizationally with the state caps that are being imposed, the mandates that are being imposed, we don't have enough new revenue coming in to cover our wage and benefits alone and that obviously is a real challenge. Yes, it is and that's why we realize so much on our departments. They're the ones who know their area is the best and can we, is there anything we can do to run more efficiently, to bring in new revenues, anything of that nature? I think you've alluded to it already. While our costs continue to go up, we rely upon the state for many dollar items to come in but those dollar items are going down so we're really being squeezed in the middle and fortunately we did have a bit of a surplus that we've been applying to the budget each year but we can't continue to do that. Pretty soon we'll have no surplus and we'll be in the shape of some other counties. We just got back from a county's conference and heard from many counties that are at their taxing level limit. They're laying off employees, they just don't know where to turn. We are very fortunate in that we do have a healthy, undesignated fund balance and that has been another source of revenue for us in meeting our budget but as you said we can't rely on that forever. We still need to be, I don't want to say ruthless but almost to that point where we're really really delving into how we can streamline, be more efficient and still provide the same service. Additionally, we need the state to provide support still. For instance, this year our state shared revenue has remained constant so that was a great help to us. But then on the other side, the IGT going down the 28% is a real hardship to the health care centers. They're now asking for a levy increase of 1.1 million and that is a real challenge for us to meet their needs and then continue to support everyone else. Adam? Well Mary, I think you laid that out real well from a standpoint of our budget process and some of the challenges we have and as you ended on and as the county board is now grappling with our health care centers, 1.1 million more in tax levy to support that one department and again when the state puts a cap in place that you can't raise revenue any more than a million and a half and you've got wage and benefit increases of close to 2.5-3 million, a $1 million increase for one department, again it puts tremendous pressure on the county board and people such as yourself who are working so diligently to put that budget together and position the community as a whole for success. With that said, a lot of good things continue to happen here and one of the areas that you work on and help organize is our capital improvements and monitoring that budget and could you give our viewers a few examples of some of the real impressive capital improvements that are going to be occurring in the future? Sure, for the 2006 budgeting year we have, we are continuing with the Information Technology Center at UW-Sheboygan, we're doing some hanger expansion work and runway expansion at the airport, a new project but one that's really needed is our law enforcement dispatch center is going to be upgraded in order to receive 911 calls from cell phones and we're also updating our health and human services software to provide better case management and financial information. So people listening to this might be hearing, well how can that be? How can the county be in such a financial, financial bind from a standpoint of state imposed levy constraints and losing state and federal dollars and some of the things we've talked about. How is it then that we are able to continue to make these types of capital improvements? How do we fund that? Could you touch on that? Sure, as you're aware we have a resolution in place that limits our bonding each year to four million dollars. So what we do is in May we go to departments and we say now what are big ticket items that you expect funding for, for not only the 2006 but the following four years. After we receive that information we manipulate it, prepare a schedule and then look at each of those years and see where are we over the four million, where do we have to make cuts and then with finance committee they help to manipulate that so your project might be postponed a year or maybe you only get half of the dollars you ask for this year and another half the next year. So with a big picture in place we can see where we're going to need our dollars to be. And the dollars that we bond or borrow that is not under the state imposed tax levy constraint. Is that correct? Well for the levy limit it is. The levy limit is on everything that's in our budget for the rate limit from 1993. There it is exempt. Very good. And as you said we have a five year plan in place, the finance committee goes through and determines what we can't afford to do within that four million dollar cap that the county board has put on themselves. Prior to the county taking that action how much would the county borrow from year to year? Oh well it could be anywhere from like typically five million dollars to nine point nine. The reason we wouldn't go over ten is because then our bonds lose the tax exempt status and that cuts out some of our investors so it was important for us to try and always keep that bonding below the ten million. And really that self-imposed goal if you will that the board adopted has helped our bottom line from a financial perspective. We're not borrowing as much as we did in the past yet we still have a plan in place and we're still getting improvements done.  This year we've had a very slight decline I mean it's less than one percent but it is a step in the right direction for us to be moving and now that we have that four million in place we're going to continue to see that go down not in any big chunk but it will keep inching down. The other thing that I've observed from county board supervisors and you've been here longer than I so I'd be interested to hear your point of view. It seems as though the board is challenging the community is a whole little bit more from a standpoint of leveraging resources for example UW-Shabuigan we put on this beautiful science edition in the future we're looking to put on a technology center and at least what I've seen of late is that when the county board is going to bond dollars to put in these capital projects they're saying hey if we can get private investors or someone to make a donation to help contribute toward that obviously the taxpayers better off. Have you seen more of that or what's your perspective? I do think we have seen more of that and I think that's a great opportunity for us to partner with the outside and that way our citizens are first of all more aware of what we're doing and secondly can provide support to us to accomplish those and it makes us aware too of what they consider important. Very good. When the county board goes through the process of looking at all the capital improvement requests that department heads make or that the liaison committees to be more specific make of the finance committee how do they go about establishing priorities what's their what's their decision making process? Well I think first of all they look at obviously if a project is in process we're not going to cut off the funding so we look first to finish up items we have started. Secondly like with the airport they typically have a six-year plan in place and a lot of that is based on dollars we receive back from the federal government and 80-20% split so obviously we take that into effect and I think it's what our committees decide are the most important for us for instance the health and human services software is a large ticket item but it is so hard for them to manage their caseload and to manage financial reimbursement with you know manually because we don't have a system in place at this point so obviously that became a high priority for us to put that into place and then other things we have are for instance information systems we have a marvelous financial package people sought and it really had can do a lot for us it saved us a lot of time less and duplication of efforts and things like that but to continue with that we have to keep the hardware in place and so it's kind of you know we look at what we have now and what do we have to do to support that and then go on to other essential items. Well you've covered a lot of ground for us and hopefully have given our viewers a little better feel for the budget process and the roles and responsibilities of the finance department and one of the things you touched on just a moment ago is how important that the public is aware of what the county board is considering what the organization as a whole is doing and with the budget process really our kickoff in June and being approved the budget ultimately being approved in November the question is how how do people get more involved how can people get more information or how can they express their point of view if they're interested in doing so. Well our public hearing will be on October 25th at the county board chambers on the fifth floor of the courthouse so that's the the most important place for them to make their voice heard. We will have preliminary budgets available for them to view beginning October the 10th so they're welcome to come stop by the administration building room 208 and look at the materials and then even prior to that if it's a specific concern with the health and human services department or if they're interested in sitting in on a finance committee discussion of a particular budget they're certainly able to do so are they not? Oh certainly all of those meetings are open meetings and the agendas are posted in the lobby of the administration building so at any time they're welcome to sit in and listen. Well in the few minutes that we have remaining is there anything else that you wanted to touch on or that we wanted to share before we conclude? I don't really think so I just you know I hope viewers are aware that they are a very important part of this process and make their their views known if they feel they can't do it at the public hearing they're always welcome to stop by our office or give us a call and we'll be happy to answer their questions. Oh wonderful Mary we certainly appreciate your time today and Mary Wegman again has been with the finance department since 1993 very knowledgeable has tremendous insight on how the county operates and if you have questions of her or suggestions of her or her staff certainly don't hesitate to contact Mary and probably the best way to get a hold of a resource in the county is to contact our county clerk's office Julie Glancy is the county clerk she does an excellent job her staff are very friendly and if you contact that office depending on the area that you're interested in or want to weigh in or provide some input or get more information she can refer you to the correct person. So in summary a hundred and forty five million dollar budget about forty three forty four million dollars of tax levy resources coming in from the federal and state government a private pay or reimbursement for medical care such as our nursing home or something along those lines and when you talk about a hundred and forty five million budget twenty three departments two hundred and seven programs and nearly thirteen hundred employees a tremendous amount of responsibility and importance that the finance department provides so I can't tell you how pleased I am that deputy finance director Mary Wegman could be here today and I really appreciate her work and the work of her staff next month we'll be talking to Carl busy our corporation council we have a rather unique relationship in Sheboygan county where we contract with our corporation council and Carl busy will be here to talk a little bit about corporation council's roles and responsibilities why that's been a good fit for Sheboygan county and some of the important work that he does so until next month thank you for joining us


Our new Secretary of the Navy, Carlos Del Toro, put out his introductory message to the fleet last week. Culture comes down to one goal. Every sailor and marine, of all races, genders, religions, and ethnicities, must treat one another with dignity and respect. This is not just about doing the right thing. It is about ensuring our Navy and Marine Corps will be the most talented, most combat-ready, most committed force possible. In this introductory message to the fleet, SecNAP Del Toro focuses directly on the value and importance of fostering an inclusive organizational culture. As leaders, develop an inclusive culture where all individuals are valued for the unique ability to contribute to the mission while flourishing in their work is a worthy goal. The conduit or path to achieving meaningful and long-lasting inclusion comes down to trust. A leader must trust her people. A leader must trust the organization. A leader must trust herself. Through this trust will then flow back trust from those around the leader where all individuals feel empowered and, yes, included in the success of the organization. More to the point, people will then feel a true sense of connection and belonging to an organization and toward a leader who shows humility, empathy, and patience. Lead well this week.


Hi, how's everybody doing today? This is rich here. We have a rich TV live with a very special guest It is Dave was Lynn the CEO of Hedge trade. How you doing today Dave doing great rich? Thanks for having me Thank you for being here now. Why don't you tell us a little bit about Hedge trade first before we talk a little bit more about Bitcoin? Yeah, sure so our company Hedge trade has built a platform for trading predictions and The platform is a tool for experts or solid traders to post their trading predictions And then when they post this prediction, they need to make a stake so they can stake our Hedge token or they can stake Bitcoin and That shows to the audience that they have skin in the game And then when the users on the other side to see the prediction They don't know the exact underlying entry price or exit price of the prediction Until they unlock it and they have to pay a fee they have to pay a portion of the stake to unlock it and Then if the trader is correct, then he receives his stake back and Receives the proceeds from all the purchasers that unlocked it and if he's incorrect Then the trader loses his stake and all the purchasers get their money back So it's an interesting model because if you're someone that unlocks this prediction You're only paying for it if the prediction became true And if the prediction became true, then you can make the same trade as the trader and earn profits and earn money on Executing the same trade as him bike by copying him So it's this interesting model that aligns the interests between the traders and the purchasers seeking the information and Yeah, it's just a different way of Sharing trading ideas because there's there's chat groups and there's Twitter and YouTube and all that But it's easy to delete your tweets or delete a message in a chat group But on our platform we post all these predictions on the blockchain and give the traders a track record and performance and You can check out their their performance history before you unlock when their predictions so So we're in beta right now and we're building a lot of features, but it is totally functioning and Anyone can sign up right now Very good. Now right now. There is a very big catalyst that is going to be Happening for Bitcoin. Bitcoin is going to be having Can you explain a little bit about what that means for you when you hear the term Bitcoin is having? What that means because there's a lot of people that don't really understand what Bitcoin having is Yeah, sure. So Bitcoin having means that the mining rewards are being cut in half and so then when people understand that It signals scarcity and it signals the fact that there's a limited limited supply of Bitcoin It's it's predetermined when all these block rewards are going to happen based on all this mining And so when the minor rewards are shrunk it Illustrates to the market that oh boy, you know, like it's it's a scarce resource. It's finite and In the past we've seen the the price increase around this concept so You know, some people think it might be the price might be baked in and it's already worked into the price of Bitcoin Some people think it's still to come But it definitely creates a lot of stir in the industry and it's a hot topic for sure Now if the miners are only going to receive 50% of the rewards Would it not make sense that the price of Bitcoin would double so that those miners can at least be making what they were making before so that it's not going to be Too expensive as far as electricity and in order for it to be viable for those miners the price is essentially going to have to double Is there any validity to that thought process? Well, it's it's not necessarily a if then Situation it doesn't it doesn't mean it's going to double by definition But it does mean that the rewards are going to half by definition And so that a lot of miners could be underwater and might not be making money They might not be profitable based on the cost of the electricity and the cost of their mining equipment So some miners might have to go offline And then the hash rate will increase and so there there are some some interesting supply and demand effects on Bitcoin so But yeah in effect for any miner to make the same amount of money After the having the price has to double in order to make the same amount, but it you know We'll see if that happens or not, but Yeah, it's it's definitely a big impact to the industry coming up Now the cryptocurrency space is a very interesting one because right now there's a Coronavirus that is now starting to be talked about all over the world, right? Now in a world where money Potentially people are saying well, what happens if someone has coronavirus and they're passing it through money Does that make Bitcoin even more interesting now because now we can literally send money to people through our phones Without actually having to put our hands on money, which could potentially be spreading a virus. You think there's any validity to that Was that crazy I don't know people have been talking about it. So it's actually not it's actually not that crazy You know, I live in Singapore and so I'm I'm you know It's it's not ground zero of the virus, but it's we're close to China and Singapore is affected quite a lot here There's travel restrictions and there's even temperature checks or any time you enter an office building So that so the city is feeling the effects and and I heard a funny thing that Normally when you hear about some big washing their money, you know, it sounds like something criminal or it sounds like they're You know trying to do things outside of the government But it was actually people physically washing their money with soap so that you don't yes, bring me germs or viruses so that's that's that's kind of funny, but yeah, I mean it's it's possible, you know, like The virus is spread through touch and and and and yeah, if there's less handled money and less people, you know touching each other's throat, you know with with these products and Objects then yeah, sure. Maybe that is good thing for digital currencies because I can do it electronically through the phones and I have to handle hard money Now for anyone that's watching all over the world that's interested in what you're doing What would you tell them that makes your business a game changer? What separates you from everybody else? Well We're about educating people and helping them helping them trade and helping them get into cryptocurrency helping them become a good trader helping them learn about tech and what sets us apart is the fact that we are all about transparency and Accountability so we built our platform so that all these trading predictions are posted on the blockchain They're transparent you can see someone's track record and know that it's blockchain verified and then the accountability is there because They have to stake money on their predictions They can't just post you know some trading idea and not care if it's right or wrong if it's wrong They lose their money and they put some skin in the game So if you want to unlock that prediction, you know that they they have an incentive to be correct with their prediction Otherwise, they lose money So we're all about transparency and accountability and just want to help people get educated about trading and crypto space and For anyone that's watching that wants to get in contact with you or learn more about your platform. How would they do that? Yeah, I would just go to our website hedge trade comm and Right on the homepage It'll show you links about how to sign up for for the platform And then we have a blog that has hundreds or hundreds of really well-written articles by our internal team That teach people about trading and crypto and blockchain and so those are some really good resources and tools But yeah, I would just go to our website and start surfing around and and we're here to help So even even reach out to us as a chat box or you can send us an email at info at Hedge trade comm that's great. Well, you know what? I've already signed up guys I'm going to be learning more about this platform as well. Thank you so much for your time today Dave I wish you all the best of luck with your new business hedge trade Which looks very very interesting and appealing and I'm sure there's going to be a lot of Members all over the world that are going to be very interested in it So let's definitely stay in touch and hopefully we can have you again on the show soon Thanks, Rich. Yeah, I really appreciate this and love to have you on the platform and keep in touch It's gonna be fun. Absolutely. Thank you so much. We'll talk to you soon. Thanks


We'll go to the income by customer summary. Let's open that one up and check it out. I'm gonna change the range up top from 010122, tap 123122 and run it to refresh it. And there we have it. We've got our customers on the left hand side. We've got the income by customer. So if we scroll on down, that comes out to the 10, 280, 05. If I go back to my income statement and look at the income side, that's not the income statement. The income statements over here and the income 10, 200. So it's pretty close, not exact on it.  So for example, if I go back to the first tab and I look at this balance sheet account of accounts receivable, you'll recall we found a accounts receivable aging report which tied out exactly to this number. That will typically be the case because QuickBooks will not allow you typically record something to an accounts receivable account without assigning a customer in such a way that QuickBooks can then make the sub ledger tie out to it. And that's quite nice because with this particular account, that's very important. Although it does cause problems as we'll see when we're doing adjusting entries, when we don't really want that to be the case. The same is not the true, not the same or it's not the same if you go over to the income line items. Meaning if you were to record something to income with it, with a journal entry or with a deposit form as you might do if you were recording with the bank feeds, then you might not assign a customer in the same fashion that QuickBooks can then add it to the sub ledger. So that's why it's more likely that your income account will be off than your sub ledger. But if you're recording all of your income with the sales forms, invoices and sales receipts and assigning a customer to it, it should be tied out. It should be correct. Also note, if there is a problem with this one, it's not as big an issue as it is if there's an issue on the balance sheet side of things with accounts receivable or accounts payable because these are temporary accounts. So at the end of the year, they're gonna close out and you'll start over again with a zero at the beginning. So if you got out of whack somewhere, it'll reset itself at least on a yearly basis so you can get back in alignment and move forward from that point in time. Okay, so if I go back on over, then it gives us our expenses which are typically gonna be the cost of goods sold here. Now, sometimes you might have a more complex kind of job cost system where it might be something different than that but now it's got the expenses and then you've got the net income which is a little deceptive of a term because it doesn't tie out to the bottom line of net income but this is the impact on net income of these transactions or gross profit in essence. So that 968341, you would think would tie out to basically gross profit in this case. I went to the wrong report again which would be income minus the cost of goods sold or in other words that 405, you would think would tie out to this number. It's a little off, it's a little different because of some of the issues we just talked about. So that's one of the two kind of sub ledger reports. Notice how nicely you can create bar charts you can imagine and we will do in future presentations to use this data to create like a pie chart of who your best customers are, who you sold to the most to and that kind of stuff to kind of spikes up your, the visuals on your reporting possibly for month in, reporting and quarter in and year in.


Welcome to The Anxious Morning. Every weekday morning will take a few minutes to go over important lessons that you can use in your anxiety recovery journey. The Anxious Morning brings you support, education, inspiration, encouragement, and empowerment. Read or listen quietly on your own time, free of the endless noisy scroll of social media. Use the information to help you along the path to recovery from panic disorder, agoraphobia, and other anxiety problems. For more, visit us at theanxiousmorning.com What is the morning effect? How mornings can move your recovery forward? U.S. Navy Admiral William McRaven said, If you want to change the world, start off by making your bed. He was right. We're not Navy SEALs. This is not the military. We are addressing the topic of anxiety, not warfare. But what Admiral McRaven said can help us make better choices. When you start your day with a challenge, no matter how small it may be, you will often find yourself in a noticeably better place come afternoon and evening. One small action first thing in the morning can help bring about bigger and more consistent changes later. Why? Starting your day by meeting even a small challenge sets the tone for the rest of the day. Laying in bed thinking about how you feel is not helping you. Get up, put your feet on the floor, and go brush your teeth no matter how you feel. Do not start your day just thinking about how you can't possibly handle anything. Start your day by actually handling something, even if that something is just basic dental hygiene or making your bed.  Dread and anticipation are often the main things of an anxious morning. Dread and anticipation light the anxiety fire. Starting the day by meeting a challenge takes the heat out of that fire. Taking some positive action first thing in the morning helps to break the anticipation and dread cycle.  This is far better than waiting, thinking, and despairing over what lies ahead. Having a purpose when you open your eyes matters. Having a predefined plan to execute matters even more. A person in the grips of anxiety and panic is often confused, unsure of themselves, and has difficulty making decisions and choices. An unstructured day that starts with a totally blank slate often adds to anxiety and fear, when the anxious person can't think of what they should do next to feel better. Building structure into your day starting with a pre-planned morning action means you don't have to decide what to do when you wake up and you're feeling afraid and unsure. Meet a challenge to start your day, even though that is hard to do. It often makes for a better day where you feel more confident and in control. It can lead to being more satisfied at the end of that day. You will likely find yourself a bit more motivated and less susceptible to negative judgment about your progress. Even if you have a less than desirable afternoon or evening, you will be able to counter that with the knowledge that you are moving forward for at least part of the day, rather than passively wishing and hoping another full day away. If things get bumpy, and they will often, starting the morning off right helps you to look forward with hope and some sense of power and influence, rather than with despair. The morning matters. Use it to your advantage the best that you can. Tomorrow, we'll look at the power you can find in a very small space. I wrote about the morning effect in chapter 5 of the Anxious Truth, a step-by-step guide to understanding and overcoming anxiety, panic, and agoraphobia. You can find that book on my website at theanxiustruth.com. And if you like the podcast and you'd like to have the podcast and full text delivered into your email every morning, visit us at theanxiustmorning.email.


Hey everybody, welcome to The Waldoch Way. My name is Jessica. Today's video is going to be a look inside three different summer workbooks. Now you guys heard me talk about the summer brain quest and the summer bridge activities book in our summer plans, because I'd picked both of them up and I wasn't sure what you were gonna be using. And then a lot of you also commented that you had picked up the daily summer activities from Evan Moore. So we have the summer brain quest, the summer bridge activities, which is by Carson DeLosa, and the daily summer activities, which is by Evan Moore. So I'm just gonna briefly show you inside all of them, tell you which one Emily gravitated towards by first impressions, and then tell you my first impressions of the three as well. Hopefully this will help you pick the one that's right for your kiddo. Okay, we are gonna start with the summer brain quest because it's sitting right here. Every one of the ones we are looking at today is going to be for between third and fourth grade. So if your third grader is done and then moving into fourth, this is the specific workbook we're looking at. The summer brain quest includes science, social studies, English, language arts, and math. There is a fold out summer progress map, over 150 stickers, and 158 pages of learning fun. The pages are pre-rated, if for whatever reason you wanted to take them out. There are eight outside quest stickers for each of those, and then an award that they can get at the end. And then there's just pages. There's no like do 15 minutes a day or do this specific one on this specific day. It just has its directions, what you should do, the page for it, what skill it's covering, and then upon completion you add a sticker here, and then there's a brain box on each of them that kind of tells you a definition. So this one has like what a run on sentences, what the word economy and trade means. So we have things like prefixes and suffixes, primary and secondary sources, diverse life cycles, and then there's more stickers that you place on the map when you have completed a certain level. Here's just a look at that map. It's fold out in the back of the book. Now I'm going to show you guys the last few pages in the summer brain quest so you can see how high it goes. Advancement wise, let's see. We'll go with, this is 116. We have magical multiplication, which is like seven times two, four times blank. These are all of word problems of multiplication, and then we're doing some multiplication and division solving for in over here. Pottery patterns, here we have some cause and effect, narration, and then each one of these is like a little paragraph about a world hero, and you're going to write the similarity and difference for comparing them. So that is about how advanced it gets, and then there is an answer key. So if you need that answer key, it is in there. And if you're familiar with brain quest at all, one of the things that they are very popular for is their trivia.  So it has questions on one side and answers on the other. There are about 12 little question decks back here, and each of them have four questions. One for math, one for English, one for science, and one for social studies. There is also a little section for book reading. It suggests a few fiction books, and then you can write a review for each of those, and it does the same for nonfiction. Okay, so that is the summer brain quest. Next, let's look at the summer bridge activities. This one is the one that I said was back here from Delosa. So it is 15 minutes a day. It includes reading, writing, math, science, social studies, and fitness, and there are bonus flashcards and stickers. All right, this one has a table of content, so I am going to sit here for just a second. Actually, let me even zoom in for you guys. Okay, so there's the table of contents in case you wanted to see it. Has all of the skills matrix. Their summer reading list is right here in the front. There is fiction, and then on the backside, there is more fiction, and then a list of nonfiction. So there's two pages of summer reading. And then it gets straight into, there is a monthly goals and a monthly word list for each of the months, like when you start for section one, and it talks about the different physical and flexibility things. That's what you're gonna be doing is an introduction of flexibility in section one. And then it gets straight into this is day one. Day one is front and back. So each day is basically one piece of paper front and back. These, again, just like the other one, are perforated, so you could pull them out if you wanted to. So here we are solving word problems. Here we are reading a group of related words and writing two more words for that group. We are reading the passage and answering the questions, and then there's a little factoid down here. There are stickers, and this one as well, you place a sticker at the bottom of the page when you're done. And so it just goes on like that. Every day, you're doing the front and the back of one until you get to the end of the section. At the end of the section, there is some bonuses. This is a science experiment. There is a social studies activity as a bonus as well. And then you get into section two, which would be a new month. So you have monthly goals and word lists again. And then section two is again, 20 days, front and back. Here you are doing multiplication and division and matching them to each other. Writing a book report of your favorite book, using quotation marks on a separate sheet of paper, write a story about one of these. Here's like props for you to pick from. Do you think that a student should have to wear school uniforms? Why or why not? State your opinion and provide reasons to support it. And then this is sorting between common and proper nouns. So there are three sections. I believe there's three sections. Yes, there's three sections to this book. Each section is set up the same way. There's bonuses at the end. There's 20 days within it. Each day is front and back. There's stickers and factoids. I'm gonna show you the last few lessons so you can get an idea. Okay, here we are rewriting the fractions as decimals, reading each group of words and writing an S if it's its sentence, F if it's fragment, R if it's run on. Where would you best find these answers on a globe in a dictionary or in a cyclopedia? So it asks questions. Proof reading. So you're gonna use different proof reading marks and proof read these sentences. And then you're reading passages and answering the questions. Here is subtraction, parallel and perpendicular lines, rounding each number to the nearest place shown in the parentheses. So 10,000, 1,000, 100,000. And then again, there's some bonus pages for science and social studies. There is an answer key in case you need it. And then here are those flashcards. It looks like these flashcards are probably, these look like sight words. These look like vocabulary words. And then you have some angles, place value, factors, fractions. So it's a little bit of everything and then a certificate of completion. There's your little star stickers that you use when you complete it. So that is the Carsten DeLosa Summer Bridge activities. The last one we have to look through is daily summer activities and this is the one that's by Evan Moore. It includes reading, math, spelling, critical thinking and geography. And it too has stickers included. It is set up in 10 weeks. There is a skills matrix in the front. And then it tells you what's in this book and how to use it. There is a spelling list that contains the weekly spelling words that are gonna be practiced in the book. And then the way this one works is when you finish for each day, you color in the stars. And then it tells you your spelling words on the front of week one. Write about one thing you did each day. Color a book for each 20 minutes you read. My favorite book was and I liked it because. So this is a weekly kind of dashboard. Here you are going to be reading and answering the questions. This is Monday and this is Monday as well. So it looks like each day is gonna be front and back of one piece of paper. So here we are rewriting the sentence correctly. We are doing multiplication, single digit multiplication. We are spelling these words. We're gonna read them in circle, different ones. Here is handwriting practice in cursive. Language bytes, this is multiplication with missing factors. Reading about Florence Nightingale and answering the questions. There's language bytes, math time, writing a list, doing geography. So up to this point, this is Friday. So we have just finished and we're starting. This is the last of Friday. So now we're in a new week. So that was one week's worth of work. So I'll show you one more time what one week looks like. Here's your dashboard with your spelling words. Writing something you did each day. Coloring your book, your favorite book. Please make sense. Find the nonsense word in each pair of sentences. Correct these sentences. Here is math and you're gonna fill in the table blanks here using some spelling and writing. Language bytes, this is talking about plural nouns. Math time, single digit multiplication. Reading and answering the questions through a read and comprehension. Language bytes, we're writing the plural of each words. Math time, again, single digit multiplication. Geography, you're gonna use an atlas or a globe in the map of the United States to name the outlined bodies of water or the number of bodies of water. In my own words, you're gonna write a paragraph, complete these analogies for language. Here is single digit division. This is synonyms for the words underlined, word problem, and then guess who for critical thinking. So that, again, was a one week's worth. So it's front and back of one page. I am going to show you, I think maybe the last week, so you can have an idea of how advanced it gets. Here we go. These pages are perforated too, so all of them have perforated pages if you wanna pull them out. Here is the most advanced spelling list. We are doing three digit subtraction and addition, cursive handwriting, single digit multiplication, directions for baking a cake. And let's see, this looks like homonyms, adjective and adverbs, draw a map showing how to get from your home to a place you can walk. This might be a friend's house, a park, or a store labeled the street. Make a list of five words that could be used in place of the word said. Pick three and write sentences using them. Single digit division. Here we are going to be using a dictionary for these words. And then that is your critical thinking puzzle. There is an answer key in this one as well. And then in the back, there is a blank multiplication table, a cursive letter formation chart, and some stickers. Okay, first impressions. I let Emily look through all three of these. She is eight years old, almost nine. She's in third, going into fourth. Just in case you're curious. After she looked through them, the one that she picked that she thought looked like the most fun was the summer brain quest. I think that's because they do a really good job of making it appeal to the kids. They make it interesting for them. They make it fun. They make it look appealing. So this is the one that if she was to just look through them and pick one that she would pick as the kid. Now I have rearranged these in my opinion of how they go from, I guess, easier to more difficult. Of the three of these, I feel like the summer brain quest is the easiest of them. I'm not saying that it's below or above or on average as far as grade level goes, but of these three, this is the easier one. I feel like the Evan Moore Daily Summer Activities is in the middle, and I feel like the Carson Delosa Summer Bridge Activities is the most advanced as far as what's in it. So depending on where your kiddo is at, maybe you want to get the brain quest because you just want them to have something fun to do. Maybe they're advanced, so you wanna get the summer bridge. Maybe they're gifted, maybe you wanna challenge them, or maybe you just want something in the middle. So that is my opinion as a homeschool mom. This is the easier, this is the more difficult, this is kind of in the middle, but again, Emily says that this one is her pick for the most fun. I hope it helped you to see inside these to kind of see which one Emily would like best, what my opinion is on their levels, and I hope that it helps you have a fantastic, fun yet educational summer and prevent that summer slide with whichever one is right for your kids and in your homeschool.


Fy enw'n cyfnod, ysgol, gyda ni'n gwybod i Tref Sheldraith yn gweithio'r cyrtytau cyrtyf. Hwyl. Felly mae'n gweithio'n ei ddechrau. Nid oedd yn cyd- i'r cyfnod o'r cyfnod, mae'n cyd- i'r cyfnod o'r cyfnod, nid oedd gallwn yn gweithio'n cyfnod i ddefnyddio'r cyfnod. Mae'r cyfrigeid yn y set, mae'r cyfrigeid yn gweithio'n cyfrigeid. I'm only going to be able to talk about some of the content that's normally in this talk because of the limited opportunities to the limited lengths that we have to speak at. But if you do have any interest or you want to ask questions or you want to just like come and hang out, I will be outside the bar, buy me a beer, you can ask anything you like and I will demonstrate every crack that I don't happen to have in this talk then. But you have to buy me a beer to get to that point. I'm going to talk about high-tag 2 crypto, this is me, I work in cyber. I do interesting things with crypto and RFID. So the first question is why do we copy RFID tags at 125 kHz? So for those that don't know RFID exists in low frequencies like 125 kHz, high frequency is 13.56 MHz and very high frequency is 866 MHz or 433 MHz depending on where you live. So why do we care about 125 kHz RFID which are basically quite old as a technology and they're going out of fashion, they're disappearing. It's because they're used to protect things that are far more valuable than the amount of money it costs to break it.  They're also used to implement the car immobiliser in most cars. I've since been contacted from giving these talks by Audi and Nissan because apparently they're using that technology, who knows. So normal RFID at 125 kHz looks like this. It transmits a single page of data over and over and over again whenever it's powered up. And at the start of that single page of data is a synchronisation pattern which the reader and the tag both know. And when the reader detects that synchronisation pattern it reads whatever bits come afterwards and turns that into a number. And that is the number they then use to make access control decisions. Clearly you can copy these easily by just emulating a field at 125 kHz and seeing what number comes out, write it down and then program that to another tag. So they're trivial to break. In an electromagnetic sort of spectrum basis this is kind of how it looks. The reader emulates the field, the tag has no battery, it absorbs its power from the field and then it damps that field on and off in a pattern to signal information to the reader. And if the reader wants to transmit information to the tag such as I want you to write this page with a particular value then it damps the field in a particular way as well. The way that they damp the field is one of these types of keying modulations and possibly encoded with Manchester biphase or not as the case may be. I'm not going to talk about this any more. The many, many months that I spent looking at this technology I had to learn a lot of this stuff and none of this is interesting to the crypto world. Yes it's very interesting if you care about radio and I did start this project. So I'll quite happily talk about it but honestly the crypto is much more interesting so we're going to skip this bit. So if we wanted to secure 125 kHz RFID what we'd want is two way comms and we'd want some sort of authentication and some sort of encryption such that you couldn't replay the comms and you couldn't copy the tags easily. That's kind of the goal. So I'm going to talk about HiTag2 which is one of these not that it makes any difference because that's the standard ISO card but it's HiTag2 which is the technology I say probably in your car immobiliser and possibly in the tags that let you into the building that you work in. In password mode and in crypto mode and you might note from the contents I'll talk about password mode very, very, very small amount of time and I'll talk about crypto mode a large amount of time. That's because password mode is rubbish as we're about to see. So what I won't be talking about is everything else and specifically cars but come and talk to me later if you want to know more. So it all started with an academic paper. Basically we had a job which we involved breaking into buildings by copying RFID tags and one of my colleagues said I think this academic paper says a lot about the sort of system that we're looking at breaking. Would you like to have a look at it and could you implement the stuff that they're talking about? This is the academic paper. It's called Gone In 360 Seconds, hijacked with HiTag2 by Fadalt Garcia and Balash. I've met Flavio Garcia. He's a lovely man, very Italian and the stuff they did is awesome. It's very, very clever mathematics. It's very hard to understand. They wrote code to implement three attacks in this paper when they produced the paper in 2012 and then never released their code. For five years no one had written that code and people were asking for it on the RFID forums. That's why we decided that we should write that code and release it, which is what we've done. So what does the HiTag2 tag look like? It looks like this if you drop it into acetone and then magnify it with a child's microscope. For the sake of a pound for the acetone perhaps and 30 pounds for the microscope and 700 pounds for a decent SLR, you can get photos like this as well. In the bottom right one it does actually say HT2, which means HiTag2. If you looked closer it would say Micron, which the people who originally made it and stamped the silicone that Philips then bought, that XP was rebranded to. But this is largely pointless.  What a HiTag2 really looks like is this. This is logically what it looks like. There's eight pages of 32 bits of data. So the first page is the UID. That is stamped into it in the factory and is not changeable. You can buy Chinese HiTag2 tags where you can change the page zero data, but typically the vast majority in the world that you will see you can't. It doesn't matter because it's not important to the crypto. Pages one, two and three contain secrets, which is why they're red. Pages four to seven contain user data, such as this user's ID within the system, which the system then makes access control decisions over. So whether you're in password or crypto mode, the whole system resides on shared secrets. Now it would be lovely if there was enough process in power to do asymmetric crypto in these kind of things, but there's not because at 125 kHz it just isn't the power to do these kind of things. So therefore you have to do symmetric encryption and if you do symmetric encryption then you basically have to share the secrets. What that really means in practice is that if you have a system with a thousand doors and 10,000 users with tags that can open those doors or a subset of those doors, then every door reader and every tag has the same secret within it and you only have to compromise one bit of that system to access the secret and then you can compromise the rest of the system really, really quickly. So this is kind of fundamentally bad as security goes in terms of access control. When you move into the world of 13.56 megs and you look at sort of Desphire, EV2s and things like that, these problems don't really exist in this kind of form and things are much, much better, but if you were to look at another crypto system, whatever it happens to be, and you found that kind of signature, then you at Lambell should ring, you should start to think, well I could probably just compromise a tiny bit of this and then I could own the whole thing and to compromise a tiny bit of it really means I just need to steal something and take it apart, which is kind of what I did. So password mode, I'll talk about password mode really quickly. So the reader in password mode constantly emanates the binary pattern 11000 using Porthwyrth modulation of the field and when a tag enters the field and powers up, it sees that and it responds with its UID value on page 0. The reader then sends page 1 in clear, which is the system password, and the tag responds with the tag password page 3 in clear and then the reader talks to it in clear and the tag responds in clear. So if you can eavesdrop on that, you can get all the passwords. So password mode is awful, we're not going to talk about that anymore in this talk. Crypto mode, however, starts with the same thing. So basically your system can be either in password mode or crypto mode, it can't be a hybrid. So in crypto mode, it's emanating 11000, the same pattern in Porthwyrth modulation and the tag responds with its UID in clear because there's no established creds at that point but at that point things are seedier, the encryption system exists and the reader sends the encrypted nonce and the encrypted challenge response value to the tag, the tag responds with an encrypted page 3, the reader can then send encrypted commands and then respond with encrypted responses. So the whole thing is much more encrypted. This is kind of how it looks in terms of what data is needed where. The reader has the key and the nonce and receives the UID from the tag and from that it seeds it and randomises its PRNG. Equally, the tag has the same data, it uses that to seed and randomise its PRNG and then both PRNGs end up in the exactly the same position, the exactly the same state. This is a key thing that I keep forgetting to say when I give this talk but if the PRNGs are at exactly the same position seeded and randomised with the same data they will then check out the same randomised binary stream. That's important because that's how you use them in a stream cypher. For example, if the reader wanted to encrypt some data to send to the tag it would say I want to encrypt 32 bits of data I'll get 32 bits of randomness from my PRNG and XOR that with my data and send it to the tag and the tag could go to its PRNG and go I want 32 bits of data and it would get the same 32 bits that the reader got because they're in the same state. It can then XOR that with the data it's received and that will give it back the plain text. This is a key thing to how this attack or the first attack that I'm going to talk about works. So stream cyphers, if you aren't aware, are basically XORing with a pad. Stream cyphers are rubbish, they're awful, please don't use them, don't take any of this as examples of fit ways you should build systems but the amateur cryptographer sat next to you will tell you that the only secure cypher in the world is a one-time pad and it's not because it has no integrity protection so I can own the one-time pad with certain caveats. Anyway, let's talk about the high-tag 2 PRNG and encryption. So the high-tag 2 PRNG is based on a linear feedback shift register that is 48 bits wide and it is initially seeded with the 32 bit UID which is from page 0 of the tag and the first 16 bits of the key which obviously the tag and the reader both know. Next up, the reader invents a nonce, a 32 bit value which could be properly random, it should be properly random and it XORs that with the upper 32 bits of the key and then it pushes that in one bit at a time into the LFSR as it extracts bits of output from the LFSR. Those bits it extracts from the LFSR it uses to encrypt the nonce by XORing each bit of the nonce with the next bit of the output from the LFSR which creates an encrypted nonce which it then sends to the tag. The tag can then do the same thing. So it gets the output from its PRNG, XORs that with the upper 32 bits of the key and XORs that with the 32 bits of the encrypted nonce. Of course you can't do that from the outset because you don't have 32 bits of output from the PRNG so you only have one bit of output at this particular moment in time because you only have one state that you know. So you take the first bit of output from your LFSR PRNG XOR that with the 16th bit of the key the first bit of the upper half of the key and XOR that with the first bit of the encrypted nonce which will decrypt that bit of the nonce XORed with the key which is the next value that you need to push into the LFSR. So it then pushes that value in which shifts the whole LFSR by one bit at which point you can then generate the next bit of output XOR that with the next bit of the key XOR that with the next bit of the encrypted nonce to decrypt it XORed with the key which happens to be the value that you then push in. It's a really neat scheme and when you've done it all both the reader and the tag end up in exactly the same state. It's not secure but I really like it it's kind of cool. It's like how to decrypt and seed your LFSR at the same time it's a neat thing it's just not secure. For really complicated mathematical reasons that I can't even go into in this talk but it's not secure. I will say if you're interested by the time I get to the end of this I'll be putting you at a github where you can find all the other code. Other attacks that I've implemented from the academic papers none of this is my invention I've literally just coded up what they've said in maths and turned it into C. But other attacks use that fact to completely break the crypto really really quickly so it is worth bearing in mind. After the tag and the reader we've got to that state they have no more randomisation or seeding information they need to continually be able to shift through the LFSR and invent new bits that get pushed in as the thing shifts. They use the feedback function L to generate the new bit. So it takes the LFSR state and generates one bit. So when you encrypt it kind of looks like this literally you get output from the PRNG XOR that with your data and that produces encrypted data it's a stream cipher and the receiver can do exactly the same thing. The function L will produce exactly the same stream of bits based on the state that you started with so it gets the same PRNG output it can XOR that with the encrypted data that you've just received back to the plain text and then you have the plain text data. The feedback function if you care looks like this is literally the XOR of 16 bits of the LFSR so the LFSR is 48 bits wide it takes 16 of those XORs and all together and that produces one bit of output that is the new bit that gets shifted in. So if you don't know the entire LFSR state there's a good chance you don't know the new bit that's getting pushed in. And the output of the LFSR the PRNG is not just the bit that falls off the right-hand side when you push it through it's actually generated with a filter function and that filter function is based on functions A, B and C in this kind of arrangement so functions A and B take four bits each from the LFSR and produce one bit of output and those five single bits of output get pushed into function C and that produces one bit of output and that is your output. Each of functions A, B and C are biased 50-50 which means if you don't know the input you can't predict the output with any confidence either way there's a 50% chance of getting a 1 a 50% chance of getting a 0 so looking at that that seems pretty cool pretty secure right? because how could you guess this sort of stuff? Well you look at some of the other attacks those academics are quite clever there's ways of breaking these things that I've implemented you can read the C to understand how it works so if we go back to my slide about how crypto mode worked it sends the start off the tag responds with its UID the reader sends the encrypted notes the reader sends the encrypted the tag responds with its encrypted password and then the reader sends encrypted commands and the tag responds with the encrypted responses so let's look at high tag two commands high tag two command is only five bits long the first two bits determine which commander is from read, read page, right page or halt and the following three bits determine which page of data we care about so if we're trying to read a page or write a page those three bits will tell you which page we care about read page inverted is essentially read page but every bit that comes back is inverted fair enough and halt turns the tag off until it leaves the RF field and comes back into it again and the reason that's there or a use case of where that's used I should say is in Las Vegas casinos where every chip has one of these tags inside it and the entire table is circulated by an RFID field and therefore they can track every tag being on the table or not on the table so when you set your field up and you kind of go start off the first or fastest or loudest tag will respond and that'll be the one that the field is and then the field will then communicate with that one all the other tags will ignore the communications because they don't meet the integrity checks that I'll come to in a minute and when it's finished talking to that tag it then sends the halt command which shuts that tag down while it's still in the field and then it does a start off and the next loudest or closest or noisiest tag will respond and it will talk to that one so you can talk to multiple tags within a single field using this because you can halt the loudest ones first if you see what I mean so if you want to use this in a really hostile environment take it to Las Vegas apparently they use this stuff now so high tag 2 commands are 5 bits long but in actual fact in a practical level when you send them they're actually 10 bits long so it's the first 5 bits followed by that 5 bits inverted so 0 goes to a 1 1 goes to a 0 so 1 0 1 1 1 inverted becomes 0 1 0 0 0 and so an actual command the minimum size it can really be is 10 bits this provides integrity checking now if you're trying to read a tag or maybe you're trying to write a page and the write page command gets corrupted and you accidentally write to the wrong page that could be quite devastating in some kind of industrial situation so with this the same bit would have to be corrupted in the first 5 bits and the second 5 bits for it to pass the integrity check it basically checks that each block needs to be the inverse of the proceeding block right but extended wise you can have as many of these blocks as you like as long as every block is the inverse of the proceeding block so you can have 20 blocks normal inverse, normal inverse normal inverse, normal inverse which apparently adds to the integrity what it actually does is creates a hole through which we can attack the system so let's talk about attacks and we're going to talk only about the first attack but the academic paper from 2012 has 3 attacks in it I've implemented all 3 I'm going to talk about the first one the Flavio Garcia then went on and wrote another paper in 2016 which has a new attack which is much faster Vincent Imler produced a GPU based attack that took 11 hours brute force in 2012 and last year Talas and the French government produced an optimised version that would work on Amazon using multiple GPUs and multiple hosts and then I just got word only last week that one of the other authors of the first paper produced a new paper last year that can attack the whole thing in like 30 seconds or something some incredible another attack that I now need to go and read about just for completeness to satisfy my OCD but basically there's lots of ways of attacking these things I'm going to talk about one the one I'm going to talk about is the nonce replay and length extension for key stream recovery attack which is a long sentence but it's really straightforward honestly we're going to replay a nonce several times and using that we're going to extend the amount of key stream that we can recover until we get enough key stream that we can then break the crypto so what you might have noticed when we were looking at how these things work was that all the entropy comes from the reader in the form of the nonce so if you have one tag it has a single UID on it and every time you present that to a field you'll get the same UID so if you stick with one tag that UID is not going to change the key on it equally is not going to change because it's the same key on the entire system and that is again fixed so nothing on the tag is generating any entropy when you put it in the field of the reader the reader takes that and seeds it and it generates a nonce and then it encrypts that nonce and sends it to the tag and the nonce together with the key in the UID is what sees the PRNG right so the only entropy is that nonce so if we have a device such as one of these perhaps and our fiddler and we eavesdrop on the communications between a tag and the reader we could steal an encrypted nonce and an encrypted channel's response value from that one handshake and then in our little back smoky room somewhere else we could then replay that nonce and challenge response value over and over and over again to the tag and every time we replay it the tag would reset to the exact same position each time the same PRNG position because all the entropy comes from that nonce and the challenge response value just proves that the nonce is a valid nonce essentially properly encrypted so if you remember that this is the position that the reader and the tag got into after they were seeded and randomised then we could create this in emulated reader and pretend to be a real reader because all the reader has to provide is the start auth command which we know from this spec the encrypted nonce we captured the encrypted challenge response value we captured and then it will get back the encrypted page tree from the tag at which point the tag will be in a particular state and if we do it again it will be in exactly the same state however many thousand times we do this it will be in the same state each time so for example if we gave it the encrypted nonce of 4A85B2DF we might expect that PRNG output of O1O O1100 O1100 for example and each time we initialise the tag with that same nonce we would get that same PRNG output which is what is being used to encrypt the stream of data it is really important to understand how the nonce replay works which is why I labour that point so strongly so the way we are going to attack this is we are going to try and find the read page 0 command because we know the answer to page 0 page 0 is the UID so we already know what answer we should get even though it will be encrypted but if you are working from the position of something you already know attacking it is a lot easier now if an encrypted command is 10 bits long because a basic command has to be at least 10 bits long and then it gets encrypted to random noise essentially then there is 1024 possibilities and out of that there are 16 correct answers of which one will be the read page 0 command so we could search and search and search when you send an invalid command you get this unencrypted error response of F402889C and it has to be unencrypted because the idea is that the reason it has gone wrong in the normal use case is because something has gone wrong with the encryption if someone has gone wrong with the encryption you can't expect the tag to be able to decrypt your encrypted error response therefore it has to send an unencrypted error response value and it is always the same number so we can use that as a canary in order to work out or an oracle in order to work out whether we are sending the right commands or not so one way of attacking this we are actually going to bit flip but one way of attacking this would be to send 1024 or up to 1024 encrypted commands one after another, cycle through them until we get something that isn't the error response which would be the dumb brute force approach to doing this so I am going to have a drink because it has been at least half an hour I should do me until the demo but this would be dumb you can obviously see why this would be pointless but the reason it is pointless is because if we imagine what an encrypted command would look like we know that F if the encrypted command is F E F G H I J K L M N as individual bits we know that F decryps to 1 and K decryps to 0 because C M 0 has to be a 1 for a read page command and K has to be the inverse of that the decryption of K has to be the inverse of the decryption of F so we know those sort of parameters we know what they must decrypt to but equally we know that the decryption of E G H and I must be the inverse of the decryption of J L M and N and we don't know what the pad is that we are dealing with but we are using the same pad each time so what we do know is that we don't have to care what J L M and N actually decrypt to they could decrypt to a random like bit pan we can search E G H and I to find something that decrypts to the same as that and that takes 4 whole bits out of our search space which reduces our space to 2 to the 6 rather than 2 to the 10 which means our chances of finding something will be we'll probably need to send 32 actual requests before we hit an actual success as opposed to 64 so we've halved the amount of work we need to do honestly it's cool it's crypto cool so we find one valid re-command because basically we just do that until one of them comes back with a different response to the only decrypted error right now we have one valid re-command now what we're going to do rather than search for all the others we're going to bit flip that to find all the others because then we don't have to actually do any transmission over the RF much quicker so if the one we found is E F G H I J K L M then we could take that imagine that that decrypts to read page 4 inverted as the actual plain text well the first half and the second half when they're decrypted must be the inverse of each other because it's a stream cipher if you flip a bit in the encrypted version it flips the same bit in the plain text version which is where all the integrity and the insecurity of one pad of cipher is going to fall down right so we could flip the first bit E for example in this example and in this example it would flip it from a read inverted to a read command but if it was originally a read command it would flip it to a read inverted command okay so as long but in order to maintain the integrity we also have to flip the same bit in the inverted half so bit 6 also has to be flipped but because of the nature of stream ciphers if we flip the bit in the cipher text we flip the same bit in the plain text we can do the same thing on bit 6 as well so if we flip bit 0 we also have to flip bit sorry if we flip bit 1 we also have to flip bit 6 and it will flip it from a read to a read inverted or a read inverted to a read but either way what we end up with is a valid read command equally we could flip a bit in the page bits so if we had read inverted page 4 and we flipped bit 5 it would flip it to read inverted page 5 as long as we also flipped bit 10 to maintain the integrity by flipping the same bit in the second half of the command that's really neat so basically given one actual read command that works in the encrypted form we can flip it around until we get all 16 by basically just building a table it's really trivial and then what we can do is try every one of them out one of them must be read page 0 like not inverted and that's the one we're looking for so what we'll do is we'll go around a loop of trying each of the 16 possibilities every time we'll reset the tag back to the same position with the same nonce to the same point of the PRNG and we'll test our guess and if it's right we'll store the key stream and if it's wrong we'll just go around the loop and try another one and each time we'll reinitialise the tag because we're working from the same position of the PRNG because we're using an emulated reader that's replaying the same nonce that if you replay the same nonce you get the same key stream back I repeat this enough times to hope that it gets boring so you just understand what I'm saying at this point because I'm always fearful that I'm saying stuff and people are kind of going why, why does that work it's not actually that hard so if we try our guess we're going to assume that our guess is correct where we have a 10 bit encrypted command we don't know which read page or inverted page command we have but we're going to assume it's read page 0 and so we can XOR that with the plain text of the read page 0 command and that will retrieve the 10 bits of key stream that would be necessary if our guess was correct when we've sent in we get back our 32 bit response which won't be the error response because it will be a valid read page command of some description we can take that read page response and assume that's page 0 which we know because it gets given to us for free in clear at the beginning of the handshake it's the UID so we can XOR whatever we get back with the UID and that will give us the next 32 bits of key stream if our guess is correct and if our guess is incorrect we've got nonsense so somehow we need to check if our 42 bits of key stream is correct or not so what we do is we create a read page 0 command that is 40 bits long and we do that using that extended command definition that we had earlier the thing that we were going to attack so a read page 0 command will be 11000 111 at the very minimum followed by 11000 followed by 0011 et cetera over and over and over again up until the point where you stop sending these blocks so we can make a 40 bit version of this read page 0 command with extreme integrity and then all we do is XOR that with the first 40 bits of the key stream that we think we've generated is an encrypted version of that command and then we send it we reinitialise the tag with the nonce back to the same point again so it's using the same key stream and then we send that encrypted read page 0 command and we either get back the error response which means that when it decrypted the integrity failed which means that we weren't correct that wasn't the right command or we get back a 32 bit response which isn't the error response but the transcription of page 0 UID that means at that point that the first 40 bits of key stream must be correct and then we can take the response and XOR with the UID to get back the next 32 bits of key stream which basically gives us 72 bits of key stream that we know from the point that the PRNG was initialised from the nonce mean transmitted and it completed in the handshake which means that we can send that nonce and challenge response value encrypted and know the pad that the commands and the responses are being XORed with which means we can do things like this where we can basically read each page of the tag one by one by initialising the tag back to the same point and then doing a different read page command each time and the way we do the read page command is we correct the plain text version the first 10 bits of key stream send that to the tag and whatever comes back we XOR that with the next 32 bits of key stream to get back the actual answer which means that we can then recover all eight pages of the tag and three of those pages involve the secrets that we need to know in order to be able to talk to any other tag in the system so it's kind of a really I think it's a really cool attack so I implemented it and the way I implemented it was I took our Fiddler made by Aperture Labs which if you don't know is Major Marr Function and Zack Frankin and they've made a really nice bit of equipment so if you have a Proxmark which can do low frequency and high frequency what you'll find is that high frequency is really good like it actually works mainly because Major Marr Function wrote the code for that but when it comes to low frequency stuff it's not very good at all it keeps crashing especially on high tag too doesn't really work very well however they made the R Fiddler to kind of plug that gap and vote the code for it and it's really good so I went to the R Fiddler github page and they say you can download the IDE that you need in order to edit the firmware and you can download all of the firmware from the github and then you can start writing your own C which is just straight for C you can read through the code and kind of go and it's understandable, it's just programming like you expect, normal kind of code and when you actually want to transmit or receive stuff over the R F you can hunt through the rest of the code base and find out where they've done the same thing that you need to do and copy and paste their function calls into your code and then the thing just works Honestly it's magic, it did not take me that long it took me longer to understand the maths in the paper than it did to write the C to actually implement this stuff I've added a whole load of commands to R Fiddler I've extended their stiffp.wm command so I can just literally pull out encrypted nonces and change the response values I'll create a crack command for doing the attack that I've just talked about a keystream command for the second attack a reader command so that once you've got the key you can read any high tag 2 card in that or tag in that system the clear store tags it's all about weaponising this kind of stuff so you can have it hidden away with a battery powered thing rather than having to carry a laptop around it's kind of neat and if you were to do the attack you'd do something along these lines but rather than talk about it let's do a demo this is the bit that will fail miserably I might add I've got a couple of terminal windows and a whole load of windows underneath you don't need to care about right so let's top tip if you're talking at AMF camp don't sit in the sun and drink beer all day it's not the answer right so this is an RFID R Fiddler and I'm already in high tag 2 mode so I'm going to put that into SNF PWM I'm going to clear it and then in store mode I can't type I'll worry about that in a second I just set up another one over here so I'm going to create one as a reader the one that I'm hoping to configure there is going to be the eavesdropper it's really funny trying to type one handed but it's okay honestly we have trust we have faith in the room this will all be super marvellous right so I've got a fake reader set up so if we come back to this one we're on a SNF PWM store okay so you can see the start-auth commands the reader is constantly emanating start-auth using pulse width modulation mode of modulation over the field that means that it's shouting out start-auth, start-auth, start-auth because it's looking for a tag many many many times a second so I'm going to introduce the tag and I'm hoping hoping we're going to manage to read it hang on there so that is kind of reading it most of the time and what we're capturing will be the encrypted nonce and encrypted challenge-response values assuming that that's working so let's stop that am I in the right yep so let's see let's see what we've managed to capture list list L ah there we go we've captured all of these encrypted nonces and challenge-response values now you see the ones that are ffff clear it's an error ignore that there's no guarantee that others will have been received clearly but we'll just trust that it's the case for the time being so if I now take hang on I take the one that's the fake reader out of the way and I just have I just have this ar fiddler here and the tag now what I'm going to do is place the tag on the antenna and I'm going to try and crack it using one of those values so where's my cursor I can take the last one if you like I can take the first one of this page if you like I can take any in between apart from the ffff does someone want to shout stop and I'll just pick one at random yeah that one there we shall have that pair okay now as a magician clearly I will have forced you to the only one that works in this list but honestly we'll come back and try it again in a minute with a different one just to prove that I'm not using magic and mind control to trick this right so what I'm doing is I'm going to run the crack command with this particular encrypted nonce and this particular encrypted challenge value that goes with that nonce it will get the uid of the tag itself it will hunt for a valid read page command it will then bit flip and try each of them out until it finds a read page zero command and then from there it will read tags banks of memory the reason I tell you this before I press enter is that when I tested this in my demo I pressed enter and it just happened immediately and people weren't convinced that this was actually doing magic so brilliant cannot get your eye oh okay I just need to move see this is the trouble with things that aren't soft with it it's very very sensitive right let's try that again it's such a big build up for such a big error hang on hang on where's infosec westward to like take the piss oh god you're for fuck's sake man don't keep that bit on the film will you because yeah I'm not surely no this should definitely be 1411 that should be 1421 down there that one's still reading in fairness honestly that one is still reading I know you're being helpful it's like it's like not having two hands it really is like like this is accessibility errors yes oh I can just hold it you can just hold it there I mean I don't even need like two that one is gone it is no longer right it will work now I guarantee I don't know how good electronics is so easy I don't know what you're worried about right so anyway we need to run this command up here and honestly we will come back if this completes super quick I'll do it again with another pair so that you can see oh look at that it's actually searching for a read command it's gone off the side of the page ah it found one and God jeez that's actually a really good demo but there you go and so you can see that that is definitely a tag that I've read because page four says dead beef and pages five and six on my office phone number feel free to ring me with all of your high tag two ways but now we know that we could do things like we could put it into high tag two reader mode and we could use the key that we can pull out of pages two and one so that is the key and we run that we could then take our other tags which are hidden away down here see we don't have to crack the other tags we can just read them so that one is a beef face that one is feed face and if we read the special tag four we notice that pages one and two are inaccessible because it's been configured to not give you the contents of pages one and two which I'm now going to flip back to my size and talk about very briefly so that was the demo tag cloning if you know the key and they are not protecting the tags you can just read the tags using that key that is provided and then once you've read the tag you can write that to another tag the UID will be different but it doesn't matter because the UID is not used for any access control decisions it's only used for the randomisation for the PRNG at the start of the crypto and you can potentially do that at a distance although anyone who wants to do it at a distance who knows analog electronics can touch we have money and we'd like to help build something at a distance that works so I'll quickly move on to my closing remarks this attack is amazing it's really cool not because it attacks high tag two or you could use it to steal cars but because it's a really neat way of abusing the protocol of the crypto and abusing something that people would generally think was secure to actually retrieve all of the secrets within the system so read the paper it's really clever it's hard to read but you might want to read the code instead but if they do protect the tag then you can't use that attack because you don't get pages one or two you don't get the key that stops you being able to clone tags so instead you need to use attacks two or three that come from the same paper or attack four that comes from the later paper that comes from the early GPU attack or six that comes from the later GPU attack so to put those into context attack two to recover the key takes two days to build a table a minute to get a key stream off the tag you need a valid tag and then two minutes to search the table to find a matching key right so if you've got a valid tag attack two is really awesome if you haven't got a valid tag you can use attack three which only attacks the reader there are five minutes collecting values but once you've got those values it takes 16 minutes on average to attack the tag on my Mac unoptimised they reckon they can do it in six minutes hence gone in 360 seconds six minutes, 16 minutes whatever I didn't really bother optimising that attack but basically if you can get the values from the reader you can attack that really quickly and get the key equally attack four takes the same values but you only need about 16 of them maybe 16 to 32 depending on how many on your random luck or unluckiness because it's a fast correlation attack which is based on probability and the actual attack only takes 45 seconds it's really awesome but you could just take two of those pairs of values and run them against attack five or six attack five would take two hours on average on EC2 using a P2X large but if you run it against a P2 8X large on Amazon which has got 8 GPUs you can get it down to 15 minutes the same code will work over multiple hosts with multiple GPUs so you could like half that if you had two hosts you could quarter if you had four hosts etc and it all cost the same amount of money which is $5 which is a very cheap way of attacking someone and stealing someone's BMW so the point that I'd like to make in my penultimate slide is that we can learn lots from academics in the world of crypto so in the world of academia they might not be the best hackers in the world we might think that we know more than them because we're down and dirty and we're messing with tools and attacking networks and they are theorising in their ivory towers but when it comes to crypto theorising in ivory towers seems to be the way to get the answers and I think that when they don't provide the tools we can take their maths and make our own tools and there must be a lot of stuff that we haven't even noticed yet because we are just simply not looking there so I think we should look more in the world of academia implement more of their stuff and scare everybody with that so my final slide is simply the github for aperture labs limited which is where you can find the RFID RFIDLIP source which has got all four it's got the first four attacks and all of the slides to explain it and you can find my contacts if you wish thank you very much oh we'll be drinking more 42 the mic's not on can you turn on the mic for the audience please try talking it might work do you want to shout and I'll repeat it oh oh actually stream cifers based on LFSRs are not exactly state of the art but could we salvage a system like this by taking a page out of the Blu-ray book and having each tag have multiple say 64 keys on it 64 different keys on it so when you actually steal one of the cards you can compromise those 64 keys but somehow by clever use of the other keys you are able to steal cable integrity of the entire system I think I've not looked at that attack I think adding more keys would just give me more things to attack and I'd end up with a bank of 64 keys in the dictionary and then for I could probably use that to attack the rest of the system and clone all the tags what you need is integrity protection not obfuscating of the keys so that's what this tag system doesn't provide and what one-time pads and stream cifers generally don't provide is integrity but nowadays we have GCM and various other authenticated encryption so go on Graeme you clearly you're going to okay you're probably going to be the last one you need to set up for the next week just quick question would all of that bit flipping have not worked if they'd put like a checksum instead or CRC, something like that no it doesn't help at all no it doesn't really solve the problem at all because at that point we have the pad that we're attacking so it might expand the space that we need to search within but it makes you solve the problem all right I think that's all we have time for thank you very much Kev thank you