So we're uh, like I said, I'm David Maynard and this is John Cash We're going to be talking about device driver security You may or may not have heard something about our presentation at Black Hat But we're basically we're basically doing the same presentation in the end We're going to have some specific questions We've gotten from the Mac community that we're going to be answering about the stuff we did So we're going to start off with Nifty, I'd like to point out this presentation is being done on a Mac Wireless is off So we're gonna be talking we're gonna be talking a little bit like I said about device driver security It's a it's a very great topic now So as I've told other people this week the way we feel about this is operating system vendors like Microsoft like Apple Link distributions free BSD OpenSD these operating system vendors are getting much better at actually Hardening their operating system and you're not seeing as many to fall the tax I mean, for instance the Zotab attack you saw last year wasn't nearly as bad as like my Or any of the other ones before it. They're actually getting better at hardening the operating system So as an attacker and I'm assuming there's no attackers in this room because no that'd be bad But as an attacker You have two choices. You can either go up to the application layer Which you know would be like sequel injection attacks PHP file include the tax or you just send somebody a file That's like this is a virus. Please open it You know that that's that would that would be going up now going down is something that We've been talking about for a little while But now it's only becoming more applicable You device drivers actually under the notes to a lot of people handle a lot of a lot of unchecked Remote data actually So if you actually go and look at the device drivers on your systems So you had device drivers for you know USB and fire wire you had device drivers for your networking stack You had device drivers for your networking cards and stuff You had device drivers for your wireless cars you had device drivers all over the place that will allow people to take Basically untrusted input So what are problems with some of this device drivers stuff speed to market is so important Has anybody does anybody in here have an 802 11n card yet? One guy. Oh, I have one too, but it's for a whole different reason. So, you know say in No, all right, never mind One of the things about 802 11 and you'll notice now you can buy things like 802 11 and draft cards So basically what that means is the specs not quite finalized So you're able now to buy something that you know Conforming to what the spec currently is and if they change the spec later You'll have to you know flash the firmware in your car to get you know new stuff And people are doing stuff like this because there's a there's a long-held belief in the computer industry First to market wins. So speed to market is very important So in your rush to get things out the door and be the market winner some things Some things just don't get tested properly and that's that's where we come in we were you know Most of the testing and what most of the stuff we found has been tested using fuzzing techniques and things like that and There's a lot of already good tools available for that for instance. Scapi is a great packet creation library It's got a fuzzer built in you can actually write a Scapi scripts will automatically fuzz stuff and you can do what a raw wireless pack injection with this. It's pretty cool And a new hardware and committee design protocols are especially susceptible. We're not big fans of things that are done by committee I mean could you imagine having to go to the bathroom and it'd be approved by a committee Do you really have to go are you sure you have to go? How are you gonna go? Please hold your hand, you know like this while you're going so you know the problem is that you know The community design stuff a lot of stuff gets left out like securities not very not a large part of most most committee stuff So although what we're talking about, you know primarily to me like 802 11 a b and g stuff The thought process and that's one of the most important things that kind of got drowned out and a lot of stuff We were doing this week the thought process and how you find these problems how you fix them Can be applied to a lot of different things like Bluetooth new 802 11 specs like a 2 11 in and new wireless data stuff Like a gvdo and hsdpa. I myself am a hsdpa user So have device drivers had problems in the past. Why yes they have There's a here's three good examples I used to be with a company called the internet security systems and a gentleman their name Neil Mada actually found a Off by one in TCP IP sys. That's that's a pretty heavily used Device driver. I don't know how anyone else feels about it But you know, I feel it's pretty heavily used and it's actually but also pretty heavily audited, you know, last 10 years So, you know for somebody, you know last year to find, you know new off by one in IP options That's just showing that the ground is pretty fertile You know just earlier in the over in a month of the Microsoft super Tuesday There was a server dot sys vulnerability that was a super Tuesday that came out And this was actually also in the vice driver and strange enough There's also the free VST Wi-Fi integer overflow. It's it's actually in Wi-Fi What's kind of makes it relevant to this talk, but you know that there have been Yay Awesome, can I shake your hand later that that's pretty cool Have you tested that on any other systems? Have you tested that on any other systems besides free VST, right? All right, so I Have Has the free VST Wi-Fi integer overflow been tested on any other systems was kind of a joke, but Apparently I was the only one that got it so Say again. Oh net VST was also vulnerable So if there's any free VST die-hards, don't don't feel like I'm exclusively point out a free VST problem It was it was a you know, it was a more widespread problem So yeah, okay, there have been device driver problems in the past If you if you think they haven't been you know do some research Google is your friend don't don't ever believe anything I say for you know go Google stuff so strangely enough Intel on you know this past weekend released a lot of a lot of Driver patches for just Work, okay 130 megs worth of patches. Is that a patch? I mean how big is a compiled Linux kernel? I remember when I download the Slackware for the first time it was smaller than that but You know that they fixed a lot of problems in Remote code execution it says it right there So, you know these kind of problems and wireless drivers, you know, they are real they happen So now this is where John starts talking. I'm gonna go back to text messaging people Okay, so So Dave here is the really brilliant kernel level ring zero payload ninja exploit guy And I'm the 802 11 guy. I if I hadn't met Dave the demo would have been Here's a Windows box.  I no idea. So I'm gonna talk about Yeah, somebody call us a fantastically hacking duo in a blog that was great Anyway, so I'm gonna talk about 802 11 and why 802 11 in particular is susceptible to these things lately The biggest reason it's so susceptible is it's just so complicated so I'm gonna talk about why it's so complicated and maybe what we could do to fix it and The direct consequences of it being so complex is that a you can fingerprint it and then be you can exploit it So so why is it so complicated? My friend warlord? I think said this though Somebody else might correct me says fear leads to anger anger leads to hate and hate leads to particles designed by committee Maybe it's particles designed by committee lead to hate So It's just it's too complicated to get a bunch of guys in the room and have them do it right Maybe the guys could get together and elect the smartest guy, but you don't want more than like two people doing this I think so So why is 802 11 so complicated? Well, partly it's too ambitious partly It's attempting to deal with the generate problems things that wireless networks have to deal with that wired ones Don't are obviously hidden nodes unreliable links and other networks on the same channel. I mean those happen all the time It's just the nature of Wireless and so so that adds legitimate complexity of the problem They're trying to solve and so so that's you know, they have to put stuff in there for that, but uh There's a lot of extra fluff. So can we fix it?  When when is that a feature that it does do it?  So I think the number of management frames used to like break things versus actually accomplish stuff is it's not worth it You should be able to ignore them There's some control frames that can cause problems these are harder to ignore their more low level and they're related to keeping networks on the same channel from interfering with each other and Remove the extras and here comes the extras later So so why is all that interesting because complexity is a hacker's best friend If there's if it's not complex and somebody didn't mess up and if somebody didn't mess up We've got no bugs to exploit and 802 11 is not lacking in complexity So just for a quick comparison, I'm gonna compare 802 11 to ethernet ethernet has three fields source destination and type I'm willing to bet if I put 14 bytes up there and said it's an ethernet header. A lot of people in the room could parse it 802 11 has a version a type a subtype eight flags one two three or four addresses in different spots Fragment number a sequence number and that's in the header After that, we've got Stuff that's not in the header, but just as important you've got positive acknowledgement and 11 management frames six control frames lots of sub types for Each of them and then as soon as you turn on an encryption it adds more fields initialization vectors and mix etc and So there's still more stuff thrown into the standard. There's ad hoc How many people here have used an ad hoc network to do something useful raise your hand okay, so like That's more than black cat black cat. It was like, I don't know three people So this is like, I don't know five percent less than five percent Okay power savings is a as a feature in there that I actually feel is probably worth having it It lets cards essentially turn themselves off and say I'm gonna turn my card back on and you know ten seconds Well smaller time frame than that, but you got the idea so the card can tell access point I want to sleep. I'll be back in ten seconds store any packets for me and I'll pick them up later So that adds some some complexity, but it's at least accomplishing something useful saves your battery Two types of media access control PCF versus DCF PCF stands for point coordination function DCF is distributed Basically DCF is Ethernet and over wireless is the easiest way to think about it And if DCF is other than PCF is token ring You can bet people are really rushing out the door to push token ring over wireless, right? I Mean I mean this isn't part you don't have to actually implement that to get certified But it's still in the standard taking up a ton of pages and it actually takes up some management frames as to so those bits Are we forever used or something that I don't think anybody implemented ever? 11 e quality of service that's so you can do video conferencing over your access point now I got to ask you up so you've got quality of service on your access point so your your teleconference gets ahead of your FTP session or whatever but What happens when it hits the back end wired connection it goes out your Ethernet jack does IP or Ethernet care about those quality of service bits No, so if you're trying to video conference with somebody on the same access point You're probably doing well, but they're like a hundred feet from you so I And then I'm pretty sure that's going into the standard and that's that adds a lot of complexity right there And finally just to show you what these crazy standards guys are thinking of this isn't going to make it in I really hope and I'm not on the committee by the way. You could probably guess that But somebody told me they're at an 802 11 committee meeting. It's only proposed geo locating So this is the layer two of your network card Basically trying to tell the access point where you are or the access point have it figure out like your coordinates either GPS or some other coordinate system so you know where you are relative to other users in the network What does that have to do with getting packets from a to b absolutely nothing? But that's what these people are thinking So what do you get if you remove all the extras? I called this 802 11 minus minus Dave here came up with a much more marketing friendly term Wi-Fi light So let's call this Wi-Fi light If you remove all the extras you get an Nintendo DS It has no Wi-Fi certification It's nowhere near 802 11 compliant. It ignores the often disassociate frames and It looks like it ignores a lot of other control packets as well works great Yeah, and Nintendo doesn't pay me in fact my wife was annoyed that I had spent $120 on a DS for research. I Tried the same thing on an Xbox because they have wireless cards right and she was like no Anyway, so this works great, but it probably doesn't roam very well Who cares how many people roam on wireless networks? Let's have another hand-raising thing How many people have a network that they roam on? Okay Something like ten people in the room So a lot of the complexity in these protocols are there for the ten people in the room who want to roam and the five people in The room who have ad hoc networks, and I'm not saying that you shouldn't have the ability to do it But you should have the ability to turn it off Because that's where most of the bugs are and things that you don't do every day. I mean think about it Everybody here's on wireless networks and your boxes don't get crashed and owned right So your your boxes are capable of moving data packets and getting you online So if you could just take that bit of code that's doing that and strip out all the extra crap They threw in you wouldn't get you know your boxes would not get crashed or owned So if you could just turn those things off that'd be great. You can't do it though so anyway Onto finger printing 802 11 Why bother? Obviously if you've got a pocket full of wireless Ode you could target your exploits Wireless IDS's could use this to monitor Chipset and driver use so for example a good scenario is you refer a company to issue a laptop and they say Okay, you can only use our hardware not your home laptop because you've got all sorts of crap installed on it And then it's already owned. Okay I can't really enforce it at least most people can't so this will let you go Okay, fingerprint the box they give you keep track of it when you ever you associate and if it's changed Then they just don't let you on now. That's obviously not foolproof. Uh an attacker could just go Okay, they got an athero's car this driver. I'm gonna put it in my laptop and I'll get on the network But it's you know a start And finally you could use it to refine os fingerprints if you're having trouble So why is this cool? Well, uh, I think it's cool because I don't know of any other link layer protocol fingerprints uh Can't fingerprint ethernet, right? It's just three bytes or three fields. So So and why is this possible? Well, like I've been saying it's because of the complexity of the protocol So when I first started to trying to fingerprint these it was like well, how how far down could you go? Could you the easiest thing to do is get the chipset or the chipset family? You know this is a theros broadcom centrino and uh And then after that there's a different chipsets, you know There's an athero's 52 12 versus a theros 52 11 and then there's distinct drivers for the chipsets You know, uh, this has a broadcom card in it. So do windows boxes sometimes So they got different drivers obviously and then finally Can you tell different versions of the same driver? Now if you could tell different versions of the same driver That is really what you want if you're going to be targeting exploits because your return address might change Or you're going to overwrite something else and you really need to know that So that would be ideal if you want to own something and finally maybe could fingerprint firmware I didn't really look into it because people are just not putting much in firmware anymore so I came up with three specific types of fingerprints two work one doesn't I talked about them at black yet I don't have time to do it here. Unfortunately. I'll show you the one that is cool and works and uh I gave a live demo at black cat. You can ask people it did work I'm very proud of that The reason it worked is because I had an hour and a half of lunch before my talk to come set up everything And debug the hell out of it and I didn't have that today and for short on time So I can't do a live one, but I'll show you how it works And basically the duration stuff. I'm going to show you let's you get down to the device driver version in some cases That's really cool So duration analysis totally passive very accurate and easy to automate. In fact, it's already automated and works so To understand this basically I've got to tell you what a duration is It's a 16 bit field and every every 802 11 data packet and lots of other packets if you don't have it Those are weird ones Anyway, the duration is a 16 bit field that says How long do I need the air after this packet because by the time you read this you've already seen the packet You've got this packet and the the intent is okay So I've obeyed the rules of the media access control I've won the random back off and I got the air now I'm going to send a buddy or send a pack to my buddy Dave over here right and uh It's probably a data packet and 802 11 data packets are acknowledged And you don't want dave to have to like win the battle for access control So I'm going to send a packet to dave you guys are not going to get on the air And he's going to acknowledge it back and then somebody else can try to get the media So that's the major motivation for this And so there's a couple of obvious values for this The time would be zero for packets that aren't acknowledged broadcast packets for example And it would be however long it takes dave to acknowledge me back That would be another likely one So there's really only a few discrete values for this that you would likely see 16 20 or so So what influence is this well? Obviously the rate that you transmit packets at is very important if uh dave talks faster than it doesn't take as long Also along the the long road of standards compliance, a few optimizations have been built in short slot time and short preamble It's not too important. It just affects the duration So if you want to fingerprint somebody on an access point, you've got to know the rate the slot time and uh the short preamble So uh I'm going to get into an example atheros fingerprint right here So atheros cards. I like them. They seem to follow the standard pretty well what this shows you is uh The association request bro for example says that an association request packet from the atheros card Says that it's going to use the duration value 3 14 100 of the time Poor requests are 0 97 percent of the time in 3 14 3 percent. Why? I have no idea that seems really strange to me You think they seem to be deterministic enough that it always uses the same value or maybe it alternates for some reason But 97 and 3 And uh, there's a couple of others. It's the same idea Here's a prism one, uh prism cards are older if you didn't know People are still struggling to implement the standard and it's really obvious here in the Authentication packets. You see the duration value of 5 3 3 8 9 That's a really long time. In fact, that's an illegally long time any duration value than 32 7 6 7 is supposed to be ignored So this card sends numbers that are absolutely wrong And so if you if I gave you a packet capture and I said oh It said it has this numbers of these numbers. Is it an atheros or is it a prism? You could probably tell Similarly, I wrote a program it does the same thing it can tell Here's an example. I can't stay on these slides for too long because it's short on time, but uh So here's a realistic example That's tried. I know it's kind of small, but I couldn't fit it. So I'll try to talk over it pretty well this is me telling uh Telling my program. I'm looking at a p-cap from addresses 000 a 95 I pass it the path to the p-cap and then I tell it the print database So I had to tell it. Okay. This came from an access point with this rate and this slot time and so on and so forth And you can see that the first card listed is a Broadcom mini PCI Well, this actually came from my power book. So the Broadcom mini PCI is not the right card But you'll notice that the top three cards I'll have Broadcom ship sets. So it's on the right path And in fact the score for the Broadcom mini PCI was 79 and the score for the airport was 78 So they were very very close So if you're to To repeat this and note that the the airport extreme card is one deep in the list Across all the cards I have On a database with three different samples from each one you would get numbers that look like this S1 s2 and s3 correspond to three unique p-cap samples from a given card And what a zero in that column means is the card was on top of one means that the the card was one deep in the list So the the row with a five in the left is that is actually the the p-cap I just showed you the The airport extreme one and it was one deep and basically That's getting it right an awful lot of time Which is good So how's it work? I have five algorithms. I'll briefly go over one The kind of warring I suspect to most people basically you look at the duration values You see treat them as a set take the intersection Subtract the probability of seeing them from each other and return one minus that this basically says Card a uses duration value say the legal one was at five two two six nine or whatever like a lot of the time Actually a hundred percent of the time in authentication packets and southern one uses it like never Okay, so those don't even make it in this but if they use them A hundred percent of the time and one percent of the time just still would be close to zero And if you do that you do 10 times better than random If you take into account the packet types for the same ratios It's a 21 times better than random at this point. You're well past chipset level resolution and you're probably getting device drivers And finally at this level You get to do 23 times better than time This is if you combine the two techniques and that's good That's you're getting the right chipset and device driver and probably the version so oh just the quick real-time demo of this is a So here's a program. I'm going to try to to match a p-cap I captured previously of a vulnerable intel chip driver, you know the one they patched three days ago with 130 megs So yeah, that's a patch Anyway, so here's the p-cap from an intel vulnerable driver And you can see or maybe you can't because I can't make the font big enough But I tried is that up on top it's the driver from intel that's vulnerable now if I was to run this program again On a patch version of the driver The patch driver comes out on top So this is an example of the program actually being able to distinguish different same chipset Same device driver different version and that's exactly what you want if you're going to exploit something So with that out of the way, I'm going to hand it over to Dave and he can talk all about his ring zero I just not going to be that much but We're going to be talking about uh ways to find bugs just a little bit I mean, this is all standard stuff static auditing your binary analysis and your source code analysis The problem is most people don't have access to source code So when I've gotten stuck in the past on one reverse engineering, uh, particular device drivers You know, it's always grabbed a good to grab an open source version of the driver and take a look at it It gives you some clues to what's going on and of course fuzzing fuzzing is how we found most of the site Like I like I said, we were looking at, uh, you know built-in wireless cards already part of the cards Embed devices and access points The things to think about fuzzing can be frustrating and bug can be triggered by something at eight packet chains ago And you know, uh, it's really hard to track down stuff in kernel space. I mean if you've ever had to track down why something crashed Um into kernel it it's not all that easy sometimes I mean, you'll you'll you'll find like an exception handler or something like that Uh, that's been tripped.  So, um, that's somewhat hard to track down So this is actually john's uh, uh, john and I each wrote a fuzzer and this is john's fuzzer Yeah, mine is not nearly as smart as his but i'll talk about it very briefly. Um, basically the fuzzing laptop has three interfaces And it's got an ethernet interface and two wireless one wireless interfaces out there fuzzing obviously and the other one Is sitting there just monitoring the air Basically the way it works is that um, it pings Uh, a host that you're trying to fuzz on the wired side says this is up. Great.  Is it still up? Yeah, damn, okay I'm going to go fuzz something else and eventually it'll ping something fuzz it Ping again and it's down like great. I just crashed it So then it's going to take all the packets that it logged on the passive monitoring interface All right. I'm out to a pkap file and put an entry in a log file And the packets it's sending are not Smart at all. In fact, the fuzzing program has very little grasp of the 802 11 protocol Basically, it's putting on a header that knows where it's going and that's it There's just random bytes after it over random length So it's not very smart.  It's not as smart as day is Oh, yeah, and here's a myriad of command line options, which I don't even remember This is actually notes for myself. So I want to go back to run it later So I wrote white buzz whereas, uh, john worked specifically on trying to manipulate, uh, like just like, you know, individual packets and things like that The fuzzer I wrote, uh, not only will manipulate the individual packets We'll actually chain bad packets together or send things in an out of order or an unusual request cycle I was trying to find, you know, it's not just a single packet that's going to cause some of these These crashes. It's actually what what we call a packet chain or a long chain of events that will lead up to it Uh, so that leaves us a shell code shell codes most so Most times when you write shell codes, you're looking for, you know, what we call like the connect back shell return You know the return shell or something like that So actually a lot of these things is you're attacking, uh, something that's not necessarily on the network with you or something like that One of the things that, uh, people are looking at One of the things that's hard to do is actually get the connect back shell because you don't have an ip address and You gotta need an ip address to do bi-directional communications So most most of the useful show code for a ring zero buttons like this are going to drop off a a bot or something like that And let that run, uh, and then in the next convenient time phone home um Shell code executed to the kernel level most generic overflow protection tools like you know, uh Checking to see if the shell code page is readable writeable You know these third-party tools from companies like sysco In intercepting things like that most of these don't cover kernel space that well because they take a huge performance hit And so you know that that that leads to uh being able to execute things pretty well Although you have to be careful of a lot of things especially like nx protection when you try to execute things in in user land So that leads us to a demo and our demo is actually a video has anyone seen this video yet? one person Two people Oh, one of us my boss, so Um, it's my mommy likes it So I have to hold the uh the microphone up to the uh, oh we have audio never mind I don't have to illustrate this one. Uh, uh comment over this one No, I don't mind there, right John has apple food It's a very wet sound. Hi. My name is david manor. I'm a member of the research team here at secure works And on behalf of myself and my co-presenter johnny cash Uh, I'd like to Take a minute and show you a demo Of something that we wish we could be doing live in vegas but due to security reasons we can't really Uh, so what I'm going to be doing is I'm going to be using this machine as an attacker and I'm going to be bringing in another machine Boom that we will be using as the victim and um Don't think however just because we're we're attacking an apple the flaw itself is in an apple We're actually using a third-party wireless card That's a usb wire card So normally for this attack to work, um You do not have to have the victim associated to an access point or authenticated in any way But for the ease of this demo this machine, uh, this del will be acting as a Wireless access point with the address of <IP_ADDRESS> And this machine will have a address of <IP_ADDRESS> The attack will be launched from here It will affect it will manipulate buggy code and device driver on this apple This apple will connect back to the uh to the to the attacker With the shell at which time I'll have complete interactive access So there's a couple steps required in setting this up the first point A part is turning this on a laptop into an access point. I do that with a That's actually not my portion by the way about setup.sh. This will actually create a um an access point called sw apple demo And we'll make this a wireless access point and then we will connect the apple to it So let's run that script and connect to sw apple demo We have an ip address of <IP_ADDRESS> um Now what we do is we run the exploit called bad seed This is actually what it looks like. This is the help screen for it um And now we will run it against the target machine It takes a minute or two to run it's preparing the show code for return It's getting the connection information for this laptop It's now sending the attack waiting for a response It got a shell now I am Interactively logged into this machine This place for reactions is awesome. I'm looking at the files in that home directory Uh, so what I'm going to do first is create A file on the desktop code owned o w n e d dot text As you can see it was created right there and now I want you to read it Further proof it's gone. We can open the shell under shell And we can onto the desktop We can create a file called password And in the file i'm putting this is a secret Password exclamation point. I like to use exclamation points as it's actually a secret. There it is created on the desktop I'll come back over here There it is cat This is a secret password and now We will delete it And it's gone Where did this go? This includes our presentation, but if you're still not convinced Geez, I'm fat, you know after this I I should take a couple laps around the table just to make sure There are no wires attaching the two devices And just create a file on the desktop called I walked around dot text Then I walked around more And I just deleted it The thing to keep in mind here is although we we attacked an apple The flaw is not specifically in the apple operating system as we use third-party hardware This type of a flaw will be systemic across all operating systems and hardware and the only way to prevent it is proper testing Although this flaw is And can lead to a remotely exploitable condition It's not as trivial as a generic buffer overflow On behalf of johnny cash myself david manor and skewish research team. Thank you for watching So So I don't know if you guys know this or not, but mac users love their max So I'm a mac user. This is my power book and I love it In fact, anybody who knows me knows that all my code gets written here and if you're lucky ported to linux So As soon as that that demo got run on the washington post block. We got some hate mail I mean did we ever we got some serious hate mail and we got We got asked a whole lot of questions by people that were like, oh, this is completely fake and this is why it's fake So now we have a couple of slides that will Answer some of the most popular questions and before I answer these I'd like to give people the audience a chance to Respond to why is this a bad question? The most commonly given Question is did you get root? Does anybody here know why that's a bad question? exactly So you're running in a kernel and from a kernel we get root and by root we mean super user access Roots a generic term Actually, I hear people talking about getting root on windows machines all the time It's actually an administrator account But if you compromise something that's running in the kernel You have the ability to do whatever you want on the machine So that was the first that was actually the most common question we got Second most oh wait never mind. Okay. Somebody wanted to hear me talk about fingerprinting anymore. All right so So here's a bastardization of the osi network layer model one on one because a lot of people didn't seem to get this The 802 11 device driver has an arrow next rate. We are here Your firewall is a little bit further down the stack It doesn't get these packets until we've already dealt with them So, I mean think about it a packet comes in off the air into your card on its antenna You can think of it as needing to get from the card to the rest of your computer The device driver gets it there your firewall cannot see this packet until we've already given it to it So if the bugs in the driver your firewall can't help And finally some people seem to think the antivirus will help your antivirus is like light years away So I don't even know what to say about that except it doesn't The second question was what services are running? Given the uh, the the awesome, uh charts were made by mr. Johnny cash and nominograph Just a few minutes ago. Would anybody like to tell me why this is not a good question There you go The hack attack this this attack happens at the network network link layer No ip of packets were required for this attack Question three I'll pay you 10 100 even $1,000 for a live demo and I gotta tell you okay. Well, first of all, why is this a bad uh a bad question All right for the grammar Nazis. This actually isn't a question So aside from that. Why is this a bad statement then? Well, actually that that is funny hd morrigan's offered 40,000 to 120 thousand dollars For unreleased bugs and we're getting offered a thousand Wow Come on guys. This is insulting. You should know it. Never. I won't knock. I defense. I'm sorry So this is actually a bad idea because by doing a live demo for you and something Wanted to package up a demo and ship it to them What why would I start distributing copies of something that hasn't been passed yet? That just doesn't seem like a good idea to me And that's uh, that's actually the answer to this question Question four Why was it a video? Does anyone know why? How many sniffers are there in this room right now? Because we asked this question to black hat and one guy rates his hand and I really want to give him a copy of the exploit Just because he was being honest But if if if you do this demo live on stage now, we're not the only people doing it You all are doing it too and that just doesn't seem to be a good idea right now And that's the answer Anyone with a sniffer will have a copy of the exploit and the fifth question How did you use a third party card as there are no pcmci or express card slots on your uh, your macbook This is actually my favorite one. Does it does it doesn't anyone want to know the answer to this? Does anyone know? usb usb So in addition to that I actually have to make a dynamic a gigantic apology to the mac user base as I was quoted saying I would I would like to stick mac users in the iothelete cigarette Although this was an accurate quote. I actually did say that I would like to say that I don't mean all mac users.  You'll find problems like this in linux You found problems like this in free psd problems like this exists everywhere The fact we were using a mac actually is somewhat complimentary to max because we figured if we could break into a mac Then everybody would just assume everybody else could be broken into two so You know that that's that's our you know that that's the message that kind of got lost in a lot of the Drama that happened this week is we're not focusing on max specifically We did show a demo on a mac, but specifically this is something that happens systemically You know all throughout people who write device drivers. It's not just wi-fi device drivers There's bluetooth device.   That's even fun here So, you know the thing we we want people to take away from this is these problems have got to be fixed Before you know, you're measuring the range of wi-fi in kilometers and not meters I guess you only have a few minutes for questions, but there's something we haven't covered already Feel free Yeah, other than what card was it next? I'm sorry. We hear the question step up to the mic Uh-oh someone just jacked your mic privileges Hey, uh, could you briefly go through the methodology for finding this exploit? Like was it did you start with a fuzzer and then move on from there or what? No, I'm actually not the biggest fan of the world of fuzzing actually It has a great place and because there's a lot of things that happen sometimes Like you can find bad code paths and whatnot, but it's actually hard to exercise them So the way I prefer to audit things is you open your binary and you start looking for specific You know bad code patterns and things like that And then once you have them those marked then you develop your fuzzer to try to exercise those specific code paths And once you're exercising those specific code paths then modify your fuzzer to start doing like fault injection or like bad data injection So it's actually a kind of a hybrid approach Yes, sir In the washington post article you said that the reason you used the third party card was because you were pressured by apple Not to do the exploit on the native airport card But then in the follow-up article the journalist said that you freely admitted that it was just as effective on the internal card So the question then becomes why not just do the video demo Without a third party card. Well, one of the things we're doing now is I've been in communication with apple this week And actually apple has a bit of a hold up with fixing this problem As I've been incredibly busy and haven't had the chance to get them all of the the data they need But after this talk, I'll be working on that exclusively One of the things that I'm waiting on now is you know confirmation from apple for effective platforms I realize this isn't a real solution, but are we familiar with tannin bounce work on isolating device drivers? I'm sorry. Your question is about isolating device drivers. Yeah. Um, I know tannin bound worked on it I'm probably not saying his name right No, you're talking about andrew tannin bomb Yeah, yeah Would this have helped at all? Well, so, you know one of the things that seemed to confuse people a lot is that's of course why the we we got the uh, You got root questions You don't quite understand that device drivers running the kernel once you compromise the kernel you can do whatever you want So awful out of any things like those kind of device drivers of user land although they would fix the problem You know, I'm not I'm not an os architect So I don't know what kind of performance that you would take on something like that although Actually trying to push this code away from the kernel is very difficult because there are a lot of very real time Time constraints in the 802 11 standard. It is actually It's been you know Originally the first cards that came out like prism did everything in hardware because it was too hard Or I think it was too hard just to do it in software in the kernel the real time constraints are just too high So to actually take it from kernel to user land I mean, I suspect it's probably impractical for 802 11 other things. So yeah, it's possible So maybe do more of it in the firmware of the card I'm sorry. What was that? So maybe you should be doing more of in the firmware of the card and update Yeah, you know what if they put these bugs in hardware, I don't know what happened, but I seriously doubt we'd be popping a shell All right, well, uh, we're out of time. Thanks for all the questions


Hey, this is Brett, and this 2016 Jeep Wrangler Unlimited Sport is stock number 13506Z. I am here at Summit Automotive in Fond du Lac, Wisconsin, you're new and used Jeep and Jeep Wrangler headquarters. This 2016 Jeep Wrangler has the 3.6 liter Pentastar V6 engine. It's paired up with the 5-speed automatic transmission. This Jeep has been fully safety and inspected by our service shop has a fresh oil and filter change all the fluids have been checked and topped off and it is 100% ready to go. I'm going to go all the way around inside underneath started up and show you everything that goes with this Wrangler as well as the overall condition and everything and give you the most accurate representation that I can of the Jeep. Rhino clear coat is the color and I shoot all my videos in 4K so if you have HD capabilities on your computer, tablet, smartphone or television I recommend turning them on now because it is your best way to check out the quality condition options and cleanliness of the vehicle before seeing it in person. As you go down this side you can see just how nice the rear quarter is the doors are in nice shape as well does have some crazy side steps to get up to that go Rhino roof rack this thing's got a ton of stuff with it it's got the heavy-duty rock rails has the aftermarket fenders on here as well front fenders in excellent shape and see any denser dings in there and if you like the video you can subscribe to my YouTube channel which is youtube.com slash summit auto click the bell notifications you'll get updates in the videos I do each and every day here at summit automotive so you can see it has those rock rails right there comes with ultra motor sports painted alloy rims and these are 18 inch rims and it has general grabber 275 70 r 18 tires may have I would say probably about 60% of the tread left frame and underbody is in an excellent shape for a 2016 and coming around to the front bumper is in great shape those have the factory fog lights the major dense dings on there the grille is in nice condition as well you can see they have aftermarket hood tie-downs or straps I guess you could say hood latches didn't see any major dense or dings on the hood and this passenger side front fender is in nice shape as well passenger side rim is in excellent condition too so before we go down the rest of this side I do want to show you everything else that goes with this Jeep so you can see that this one has some gates door gates even with the mirrors on there so you can take the doors off your wrangler and put these on and it also comes with a soft top and it also those are the pieces for the soft top as well as part of the back there and then it does have a carrying case for the front hard top pieces these are a couple extra brackets I'm not sure I think they might have something to do with the doors there anyways all this stuff is included with this Jeep and will be in the vehicle when you come to buy it as you go down this side of this wrangler take note of how clean the body is how reflective and mirror like that paint is I take these HD videos so if you are far away or even if you're close by and you just cannot make the trip down but you're still interested in purchasing the vehicle you can see the Jeep hear the Jeep and have confidence in what you're looking at before you even get here so when you do get here there's absolutely no surprises and you can make a smart informed buying decision from wherever you're at if this video helps you make that buying decision let your salesmen know that you saw the video that was helpful and that bread sends you back room is an excellent shape as well and the back tires have just as much tread as the front tires uh once again frame and underbody looks really good hardly any corrosion on this one little rockers look good coming around to the back has rough country taillight covers has some LED lights back here receiver hitch four pin wiring has a boomerang hard tire cover back storage area you get a weather tech floor mat back here also comes with two fire extinguishers you'll notice it has the insulated hard top you get an all-weather subwoofer back here as well and then it's got this crazy plug that in it's got this light on the back of the hard top so just a bunch of bunch of stuff with this vehicle get these hard tops off you got four bolts on the left four bolts on the right and two quick disconnects we actually do a video on how to take your jk hardtop off if you want to check that out that's in the upper right hand part of the screen and then it has this mini built um cargo thing has a bag here as well and uh that is all included with this vehicle too that shuts nice and solidly and for full disclosure this back rim is just as nice as the rest and down the rest of the side of the jeep looks really good inside you get the sport package which gives you the black cloth interior there are no rips or tears on the seats they are in very nice condition it has a driver's seat manual height adjust also has a locking um container underneath the seat weather tech floor mats you get some lights or some controls for the um highlights and everything has rough country grab bars on it power locks as well the back seats are just as clean as the front seats no rips or tears back here it does have the latch child safety system for any child car seats you may want to put back here weather tech floor mat back here as well and you can see that insulated hardtop nice feature seat goes down like so for extra storage which is nice if you have to haul a bunch of extra stuff or if you've got to put a soft top and door gates back here which we will in just a minute uh has child safety locks on the back doors as well we'll hop inside check out the miles the radio and everything that this jeep has to offer on the interior you can see that this one has 28,097 miles does have a compass and outside temperature display instrument cluster is very nice and clean comes with the leather wrap steering wheel cruise controls on the right bluetooth and information center controls on the left and audio controls on the back of the steering wheel this one does have the uconnect 430 radio amfm and serious xm radio capabilities it also has a hard drive on it where you can store music and everything in pictures and it has 28 gigs worth of space down here your climate control stability control downhill sys control your four by four shifter and your five speed automatic transmission passenger side format and seat are in excellent condition i don't think this vehicle's ever been smoked in and those front hard top pieces are in great shape too we'll start it up and take a look under the excuse me under the hood starts right up no check engine lights or anything like that see those lights work in the fenders there it does have led head lamps and led fog lamps and they are very bright get these latches off here under the hood we have the 3.6 liter pentastar v6 engine engine bay is very clean runs very smooth it does have a very loud horn on it as well there is the initial sticker once again this jeep has been fully safety then inspected by our service shop has a fresh oil and filter change all the fluids have been checked and topped off and this one is 100 percent ready to go and i would highly recommend this jeep from a quality and condition and definitely wins the award for most aftermarket parts i've ever seen on a Wrangler and but it's nicely done looks really good and see more pictures of this jeep or one of our other 550 new and used cars trucks scvs minivans wranglers you name it we got to go to that website right there is summitauto.com full pictures and descriptions of every single vehicle from two locations all at summitauto.com and if you'd like to check out more hd videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos that you see there click the bell notifications you'll get updates on the videos i do each and every day here at summit automotive in fact in a second you will see a link to subscribe to my youtube channel the upper left a link to more jeep wrangler videos i've done in the upper right a link to this vehicle on our website and lower left and a link to how to get your doors off your jk wrangler in the lower right click those check it out check those out and we look forward to help you with this ultra clean 2016 jeep wrangler unlimited sport in rhino clear coat thanks again for checking out the video remember to like subscribe and share on the youtube channel i really appreciate it


The paper compares the results of electron beam welding, EBW, and friction stir welding, FSW, techniques when joining EN AW6082T6 alloy. It was found that both techniques resulted in decreased strength and elongation compared to the base material. However, EBW showed more magnesium evaporation than FSW, while FSW caused the dissolution of MG2C particles responsible for strengthening the material during heat treatment. This article was authored by Piotronoga, Tomasz Skrzekit, Maciej Wedrykowicz, and others.


to 299. A.L. West. Kyle Schorber and Bubba Thompson refractor Rookie. Serious Serious Serious Serious Clinical Help. Francisco Alvarez Rookie. Jose Ramirez. Jared Young N.L. Central Base Auto. N.L. Central. Refractor of Hunter Brown. Rookie. Christian Costas. Joe Ryan Prism. Zekele Doran Refractor. Morrell Rookie. J.D. Martinez. N.L. West and Base. Refractor of Randy Rosarano. Jordan Walker Base Rookie. Adley Rochman-Titans. And Freddie Freeman Refractor. Alright last box of the break. Good luck everybody. Come out to see something big. A little bit of pristine which was awesome. J. Ram Prism of Javier Assad. You can go into the Cubs. N.L. Central. And Lenin Sosa Refractor. A.L. Central. Moe Abrams. Yordan and Juan Soto Refractor. The N.L. West. Adley Rochman Rookie. Michael Harris Rookie. Oswald Paraza Base Auto of Oscar Gonzalez. Nice one there. A smaller line on the bottom. Send an empty box and wrapper with that. Got a Bryce Terrain Refractor Rookie as well. Go to the A.L. Central. Oscar Gonzalez Auto. Francisco Alvarez Rookie. Jeter Downs. Aaron Judge Base Auto Spencer Steer. N.L. Central. Nice one there. Congrats Sintzi. On that one. Manny Machado. On the Refractor.  I know already which was awesome. Um... Like he's sold out on... Where does he start? First pristine. Second pristine is at three. The tribute mixer. The pristine divisions are sold out. Nine to go on optic choice. Seven and nine to go on flawless tiered. I mean flawless left side serial numbers. There's your break schedule with Forrest. That's not me. Oh that ain't me at all Sane. That ain't me at all. That is a good ol' factory. Hunter Green. Manny Machado Prism. Justin Verlander. Peter Lonzo. Jordan Walker Prism. N.L. Central Joey Votto. N.L. Central Refractor. Bless you. Christopher Morel. Oscar Gonzalez. A.L. Central in the negative. Cannon Smith and Jigba. N.L. Central on the Prism. Tyler Freeman Refractor. That's Brett Beatty to 399. John Soto and Wander. I see like a red auto and an orange auto. That's our last auto. That'd be awesome. Cool Hulse. James Outman Rookie. Morel Rookie Insert Rhys Hoskins Prism and Tim Anderson Refractor. Gabriel Moreno. Ryan Nelson. That is purple to 250. Nice one there. 170 out of 250. Tell me what to do. Don't know about that. I don't know about that. It's a nice drive though. Man. See you later bro. My account created today. To do the hell. There's Tim Anderson on the Prism. And Carlos Perez Refractor. Nice one there. Kodai Sengo Rookie. Trishon Kossos Rookie. Gunner Henderson Rookie. Aaron Judge. Mike Trout and Luis Castillo Refractor. Ale West. Alright, let's do a quick recap here everybody. Let me look at it. I had a couple of orders come in. I want to take a look at this first. Jim with a spot. Edward with the Cowboys. Thank you Edward. Calvin with a spot in Select. We have a three box or a select hobby. That'll be fun. Neat. Yeah, fair. I know that Shane. God dude. I know that. Believe me. I mean, no I get it. I get it. We're on a schedule. That's the only thing. Bangles. Like we break on a schedule. So we have to have like, we don't have to. But it makes it easier when we have the break done by a certain time. So we don't fall behind. Because I have forest breaking after me tonight. So I got to be out of here by a certain time. We got popular demand. Auto Relic Red to 5. Lubebub. That's a Freddy Peralta. We got Oscar Gonzalez base auto. Matthew Libertor base auto. Spencer Steer base auto. Jared Young base auto. Marcus Wilson to 499. JJ Bladet to 499. Tommy Henry to 299. Ryan Nelson to 250. Nelson Malaskas to 150. Mike Trout to 5 on the gold. Corbin Carroll around the diamond to 50. Awesome boxes of Pristine, my god. We had a red Ian Hapda 5. That is Graham Ashcraft base auto. Cannon Smith and Jigba base auto. Caleb Killian to 75, excuse me. 250, going, going, gone auto. Randy Rosarana. That is Spencer Strider to 50. And Orange George Springer. All right, that is going to do it for the break guys. Thanks again for the film. Coming up next, we've got Luminance PYTs. Appreciate that. Appreciate that everybody. Get a couple of pictures here. What are they? Probably just fed you. Cosmic Chrome. Planetary Pursuit. What? The parallels are Sun, Mercury, Venus, Earth, Mars, Jupiter, Saturn, Uranus, Neptune, and Pluto. That's an actual thing? Yeah. Got uploaded. Jonathan with a Pristine, Nate with a couple of select spots. Thank you, Nate. Appreciate you, buddy. Nate, if you're watching right now, I saw your email. I shot it over to shorting and shipping for you, by the way, as well. So you'll have an answer from them on that. Oh, man. Get this guy out of here. Oh, man. Yeah, no problem, Nate. I got you, buddy. Thank you, man. I don't know. It might not get answered today, but Serena is here tomorrow. She's like our sorting and shipping manager. She's off today, but she'll be in tomorrow, for sure. Other than Earth is the trashiest. Man, that's, oh, that'd be, that's a tough one. Let me one sec, guys. I'll be right back. What a fun logo, man. Let's go, baby. Wow. Oh, that's awesome, bro. Part of one of one. Austin Riley. Three-color patch with a stamp on it. Big hit braves.  This goes to Keith. We have Lonzo Balm. And that is a rated rookie black and gold. Come on. It is Jean and Ivy. Holy cow. This is going crazy. Oh, man. This is going crazy. Woo. John G. with the pistons. Jaden Ivy on the rated rookie black gold to eight. Donny got to get the mags going today. Seven out of eight. Boom. Downtown. It's Tom Rick E. with the bucks. Brady from left field. Nice one there. Downtown Tom Brady. Oh, Mike Trowell. 23 of 25. Orange Technicolor. Diana. Congrats. Oh, man.  This is a crazy case right here, bro. And Brown, red to 88. And that is a one of one. That's Nebula. It is Terrence Mann on the Nebula. One of one. Go Nose. Very nice one there, Bradley. Look at another mag going one of one on the Terrence Mann base. Holy cow. One Superfractors. Kareya. One of one. Superfractor. Minnesota Twins. Big time. True gold Shohei Otani. Unbelievable. Assuming he wins MVP, that's a big car for that buyback program. Whatever they announce, I'm sure that'll be worth a good amount. That's a good deal, Tani. That is going into a mag. That's beautiful. Trying to get one of these. There we go, Jason. We'll mag this one for you. Milusiatos. Ooh, we have a Super. Let's go. Come on. We go, Alvin. Come on. I see hands, please. Slam Diego. One Superfractor. That's so sick. Oh my. Congrats on the Super, Alvin. So nice. One of one, Youthquake. Seya Suzuki. Superfractor Youthquake for the Cubs. Oh my God. Ray Lewis. Ooh, Adley Ruchman. On the Ultra Violet All-Star Short Print. There you go again. God, dude. Baltimore Killin' It. Congrats, Diana. We got Papa Dingle. Is Alex De Jesus for the Dodgers for the First Bowman Papadasha. Nice one there, Dodgers. One of one. We'll mag this on the Alex De Jesus. First Bowman one of one. Very nice hit there, Dodgers. Good ahead up to 15,000 on Tiktok. What's up? So we could have had like 20 more thousand on Tiktok. Oh, I know, dude. I know. Oh my God, bro. This is so nuts, dude. I didn't know this was still out there. Let's go! Evan Mobley. One of one. Let's go, baby. Oh, that's awesome, bro. Hoodie with Foreign Asia Team All-Later. Lance with some. And Pristine. Jason with a personal. Eric with Luminance. You'll have Matt over on Channel 2 tonight. So if you order personals, there isn't the biggest queue in the world right now. Probably got like an hour, I'd say, around there. But they will fill quickly for sure. They always do.  Save the goodin' honors or break too. 22. Come on for selling out today. Appreciate it. If Luminance box is ready to go, we'll be going in here in a minute here. Okay. Lance with the Orioles and a Pristine PYT. Thank you there, Lance. Does that go to Morrow, I think? Yeah, Pristine and Morrow. A lot of fun breaks tomorrow night. Again, as always. Two to go on Random Divisions. A puny one. A handful of teams left in the PYT. Got Almanac on Sunday night with Forrest. That's already sold out, I'm pretty sure. Ten box Tuesday with yours truly. Have a go in, Timmy. One sec before it gets started, everybody. I want to check in with a couple of things here. All right. Good luck, everybody. Let's do it. It's called Change Real Quick, though. Okay. It's changed. Good luck, guys. Here we go. What's going on, everyone? Sam here with Leighton Sportscar. Drippin' 20, 23. Penin and Luminance football hobby. Six box break, number 21. Pick your team style. Shopify is slow. Yeah, same. What are you doing, Sam? Just waiting for Shopify. I could say who's got what team in the PYT. Or else they're all going to go to me. Shopify! Stop, stop, stop, stop. Wait for that. I mean, that should probably do. That's the same requirement. I got this guy out of here.  Really? Shopify's going to do this now. Let's make it open up on the other monitor. Really? Oh, perfect. All right. We've got Bartonelle with the Commanders. Brandon J. Lyons. That is going to be Brian G. with the Ravens and Colts DiceKT Saints. Don G. Cardinals. Dustin M. Chiefs. Edward P. Bengals. Frank J. Chargers. Steelers. Titans. Jake D. with the Eagles. James F. Seahawks. Jason G. Cowboys. Jeff M. Texans. Patriots. Jets. Jerry B. with the Browns. Josh N. Jaguars. JTH Raiders. Kevin S. Dolphins. Lucas P. Panthers. Masahiro K. Packers. Bobby R. with the Bears. Rory C. Giants. Ross P. Niners. Ryan N. Broncos. Sean D. Buccaneers. Shad G. with the Rams. Steven H. Bills. Taylor T. Falcons. Todd C. with the Vikings. Dylan. It's good luck here, everybody. Let's do it. Here we go. Derek Henry. Briss Hall. Marvin Mims. The first hits. Spirit Swatches going to Lyons. Grats Detroit. Bryce Young to 175. Alvin Kamara to 250. And unforgettable. Deandre Hopkins. Will Leviss rookie. Henden Hooker. Bryce Young again. This time to 100. Panthers. We've got Israel Abakananda. That is going to be 239 out of 350. Or no, it's Abinaconda. That's what it is. Abinaconda. And Vestige of Aaron Rodgers. I'll say the Binks. Tajé Spears. Michael Meyer. Patrick Mahomes to 25. Nice one there. That's a Duce Vaughn. Year 1 Auto. Congrats Cowboys. He's killing it in the preseason, man. He looks like a stud. Encard. And Fugin. A.J. Brown for the Eagles. We're going to get this over with now. Points. Ren to all at the end. That is a Roquan Smith on the Vestige for the Ravens. Tyree Kill. Parker Washington. Tucker Krap. And Jomar Chase to 100. Yeah, no problem Dustin. You got it buddy. Mahomes is pretty solid actually. To 25. I mean any Mahomes numbered card is never going to be a bad thing. Never going to be a bad thing for sure. Could be a lot worse. A lot worse. CJ Stroud rookie. Jermere Gibbs. Aiden Hutchinson. Bright Futures. Or Bright Beginnings Jersey Card for the Lions. CJ Stroud. 2-1-50. CJ Stroud 2-1-75. And Austin Eichler. 2-50. Maybe another red card. Keep laughing. He's going over there. Moe. Dalton Kincaid. Davis Mills to 1-50. Devana Shane. Nice one there too. 10. 9 of 10 for the Dolphins. Devana Shane. And Engaged Aaron Donald. Bijan Rookie. Sean Clifford. Jordan Addison. There's a Will Mallory to 100. Jake Hainer. Rookie Otto to 100. Nice one there on the cubic for the Saints. Jake Hainer. And Savage Mike Evans. Think Bigsby. Shane Shoenmaker. Najee Harris to 2-50. Got Zay Flowers. Rookie Otto to 2-50 for the Ravens. Nice one there Baltimore. And Vestige of Stefan Diggs. DTR Sauce Gardener. Nice one there. Bright Beginnings for the Jets. Rishi Rice to 75. Josh Wiley to 175. And Unforgettable Orange. Devante Adams. CJ Stroud Rookie. Rishi Rice. Lamar Jackson to 1-50 for the Ravens. Otto is Justin Shorter going to the Bills to 3-50. Florida Gator. And Savage. Lamar. Jamiro Gibbs. Jared Goff to 2-50. Tyree Wilson to 1-1. Nice one there for the Raiders. On-Card in the pro uni. Ty with a couple of spots tonight. Ty Chris with a pristine spot. And Fugia and Lamar. Nice one there for the Ravens. Nolan Smith. Jaden Reid. Trey Tucker to 50. Rookie Otto to 100. Nice one, Lyons. Jamiro Gibbs. And Engaged of Rope Wan Smith. I'll do it for the first three boxes. We're halfway through on a box four. Seriously think we need to get Moe in here. Evan Neal. Charles Haley. Nice one there. Vintage Materials. Player Warn for the Cowboys. Rishi Rice to 1-75. Cooper Cup to 1-50. And Will Anderson to 50 on the Dynamic. Nice one there for the Texans. Saekwon. Bijan Horizontal Rookie. Christian Gonzalez. Will Anderson to 50. Nice one there. Congrats Texans. Payne Durham for the Bucks. Otto to 3-50. 78 of 3-50. Payne Durham. And Anthony Richardson. Dynamic for the Colts. Clayton Tune. Anthony Richardson. Colts Rookie. Tyree Wilson. Josh Downs to 200. Jonathan Domingo. Year 1 Auto. Congrats Panthers. Nice one there. Carolina. That's awesome. On-card Year 1. Jonathan Domingo. And T-Law. Unforgettable. Bryce Young Rookie. Derek Henry to 2-50. That is an AT Perry. Going to the Saints to 100. On the Auto. AT Perry. And Dynamic. JSN. Jackson Smith and Jigbo. Will Mallory. Daniel Jones and Eli Manning. On the Reflected Materials. Player Warn on both. Very nice. Grats on that one there. Giants. Another Mahomes to 25. There you go. Congrats Dustin. I think it's two of them. Not bad. A Josh Downs to 200. And Fusion of Cooper Cup for the Rams. Malik Willis to 2-50. Titans. Cornering the Market. Tyche Spears. Rookie Auto to 3-50. For the Titans. Nice one there, Tennessee. And Debo Vestige. Yeah, honestly though. Cornering the Market. You own 2-20 fits of that card. Entire print run. Will Anderson. Jackson Smith and Jigbo. That's Joey Porter Jr. to 1-50 for the Steelers. Yeah, Roshan Johnson. Looks really good in pre-season as well. Going to the Bears. There you go, Chicago. Bobby. Bobby Bears. And Bijan. Dynamic. Thank you. CJ Stroud. Kendra Miller to 25. Nice one. No, 75 for the Saints. Cameron Hayward. Illuminated Ink. 2-5. Nice one there, Steelers. That's cool. I think he's projected to potentially be pretty solid, I would say, Brian. And a George Pickens. Yeah, I think AT Perry is going to be decent. 8% of 25. Last box. Good luck, everybody. Come on, let's see something big. Big year one. There's Ed Reid. Nice. Vintage Materials for the Ravens. Player Warn. That's cool. 101 Pass from Chronicles of Draftics. Nice. Yeah, I think he's projected to be pretty solid overall, Brian. Geno Smith to 100. Josh Downs to 200. And Engage. CJ Mosley to 100. Camira Gibbs. Darnell Washington. Nolan Smith. What, 250? That's going to be Willy Roof Gridiron Grades. Nice for the Saints. That's cool. Hall of Famer right there. I think, maybe not. And Devana Shane for the Dolphins. I want to fact check Willy Roof in the Hall of Famer now. Yes, Pro Football Hall of Famer. Let's go. There we go, Jim. FedExMan just arrived with a package from Layton. Hell yeah. That's always a good day. Dylan Hyatt. Aiden O'Connell. Kayshawn Butte to 200. Got a Josh Downs for the Colts. Nice. Year one purple ink. Congrats on that one there. Colts. That's the shortest printed ink, I believe, in this set. Nice one there. Congrats. Colts. And Savage of Justin Herbert. Other points. 250. Fusion is DK on the back. And we'll do a random two everybody for those two points cards. Evans, Roshan Johnson, Will Levis Rookie. And one of one, Garrett Wilson. Going to the Jets. Nice one there. That's awesome. Last card. Last card of the break. One of one, Garrett Wilson to end it.  Let's do a quick points random here.  Yeah, I would bag that. Any one of one with the exception of like printing plates. Any true one of one, yes. Yeah, no problem. Dude, that Mingo's sweet. That Jonathan Mingo's awesome. All right, let's roll the dice. Whatever two teams are on top, after nine times, I'll get the points. One, two, three, four, three, four, five, six, seven, eight, nine. Going to the Bengals and Colts. Yes, Bengals and Colts. The points. Congrats to Sinsey and Indy. Quick recap here on our hits. This is a fun little one case, or fun half case. Ed Reid, Duel of Danny Dimes and Eli Manning. Charles Haley, Saus, Ian Hutchinson, Jared Goff. Autos, we had Willie Roof, Pajae Spears, Payne Durham, Justin Shorter, Jameer Gibbs, A.T. Perry, Zae Flowers, Jake Hainer, Devanna Shane, Israel Abinaconda, Duce Vaughn, Tyree Wilson, Jonathan Mingo, Cameron Hayward, Roshan Johnson, Josh Downs-Purple and one of one, Garrett Wilson. That'll do it for the break, guys. Thanks again for the fill. Up next is number 22. Pick this roll. Don't get that uploaded. The Viana with a couple of left side serial numbers. Phillip N with the Bears, Lions, and Raiders all tonight and NT. Those NT teams are starting to disappear here, everybody. We're about ready to go on the next one here, number 22. Let me run and just grab something to drink and we'll get going in just a sec here, guys. Thanks again. Appreciate it. Be right back. Ray Lewis. Oh, Adley Ruchman on the ultra-violet all-star short print. There you go again. God, dude. Baltimore killing it. Congrats, Diana. You got Papa Dingle. Jesus for the Dodgers on the first bowman Papadasha. Nice one there, Dodgers. One of one. We will mag this on the Alex DeJesus. First bowman, one of one. Very nice hit there, Dodgers. Good ahead. Up to 15,000 on TikTok. What's up? So we could have had like 20 more thousand on TikTok. Oh, I know, dude. I know. I haven't seen it, man. This is so nuts, dude. I didn't know this was still out there. Let's go! Evan Mobley. One of one. Let's go, baby. Oh, that's awesome, bro. One of one. Austin Riley. Three-color patch with a stamp on it. Big hit braves.  Two Keith. We have Lonzo Balm. And that is a rated rookie black and gold. Come on. It is Jaden Ivy. Holy cow, this is going crazy. Woo! John G with the pistons. Jaden Ivy on the rated rookie black gold to eight. Donny got to get the mags going today. Seven out of eight. Boom. Downtown. It's Tom. Brady from left field. Nice one there. Downtown's Tom Brady. Ooh, Mike Trout. 23 of 25. Orange Technicolor. Diana. Congrats. Oh, man.  This has been a case. This is a crazy case right here, bro. And Brown, red to 88. And that is a one of one. That's Nebula. It is Terence Mann on the Nebula one of one. Go Nulls. Go into the Clippers. Very nice one there, Bradley. Get another mag going. One of one on the Terence Mann base. Holy cow. All right. Good luck, everybody. Let's do it. What's going on, everyone? Sam here with latent sports cards. We've been 23, Panini Illuminance, football hobby, six box break, number 22. Pick your team style. We've got two of these in our teams. We've got Barton L., Commander's, and Ravens. Don G., with the Cardinals. Duncan M. Saints. Dustin M., Chiefs. Edward P. Cowboys. Frank J., Chargers Titans. Jack M. Falcons. Jeff M., with the Panthers. Texans. Patriots Jets. Jerry B. Browns. Josh N. Jags. JTH with the Raiders. Masahiro K. Packers. Richard L. Colts. Robert K. Steelers. Bobby R. with the Bears. Robert J. Niners. Rory C. Bucks. Shad G. Rams. Steve H. Dolphin. Stephen H. So Steve, H-E with Dolphin. Stephen H. O. with the Bills and Eagles. Terry F. Broncos. Todd C. Vikings. Tyler G. with the Seahawks. Good luck, everybody. Let's do it. Here we go. Got one more break after this, and then I will hand you over to Forrest. Starting at 4.45 Eastern time.  A lot of his stuff is very close to being full already, so definitely check it out. I would buy in sooner rather than later with those. Me again tomorrow night. Anthony Richardson Rookie. Airzay T.J. Hawkinson. Nice. 2 of 15 on two-colored Spirit Swatches patch. Very nice. Congrats on that. Vikings. Got a Stetson Bennett to 100 for the Rams. Deuce Vaughn to 150. An unforgettable Tyree Kill to 10. 5 of 10 for the Finns. Right there. Good start for Show. Bryce Young. Strange. Michael Wilson on the Rookie Auto to 350. Congrats, Cardinals. Aaron Rodgers. Vestige. Devin Witherspoon to 175. Zach Charbonnet. Nice one there. Year 1 Auto for the Seahawks. Congrats, Seattle. That was a good team in this stuff, man. For the Eagles. Points to 250. Random to all. Matt Jones doing the Gritty. Stetson Bennett. Cooper Cup to 150. And Roquan Smith. Vestige. That's your quarterback right there. That's what he's doing. It's like Fortnite all over again. It's the guy from Fortnite. Will Leviss Rookie. Hemden Hooker. Breiner Locker. Nice one there. On the Vintage Materials. Going to the Bears. There you go, Bobby. Luminosity. Jamar Chase for the Bengals on the case hit. There you go. Congrats, Sency. Nice one there. Very nice. Good to throw that in the recap. Superior Gibbs to 200. Patshba Holmes to 250. And Fusion, D.K. Mecca. Jaylen Hyatt to 75 for the Giants. Israel Abinaconda to 350 for the Jets. Nice one there. D.K. Mecca. And Engaged, T.J. Y. Yeah, Luminin's case hits are awesome. I understand why Donnie is obsessed with this product. He actually kind of went crazy on his personal. Did you see his cards that he got? To 175, Will Anderson. That was a wild personal. Rishi Rice for the Chiefs to Andre. There you go, Dustin. Nice one there, buddy. Edward with a spot in Pristine. And unforgettable, Van Jefferson. Evan Holt to 200. Pets to 350 for the Broncos. Nice one there, Denver. And Vestige of Brock Purdy for the Niners. Box, Thrace. Brian Branch. Michael Meyer. Michael Wilson. Damian Pierce. Nice one there for the Texans. Nine to 50. Bright Beginning, this Jersey Guard. Baris Hall to 250. Kirk Cousins to 35. And a unforgettable Tyree Kill to 50. Going for that rainbow, apparently. I told Donnie us to go for the Rogers rainbow. Oh, we got a numbers game. These are sick, dude. Jordan Addison, Luke Musgrave. Bryce Young to 100. It is a Chris Johnson numbers game auto for the Titans. God, that's so cool. Hell yeah, man. Grats on that, Tennessee. That's so awesome. Numbers game. And a Engaged of Miles Garrett. Anthony Richardson. Tillman, there's a Michael Meyer to 175. Year one, Clayton Tune. There you go, Cardinals. Nice one there on the on-card rookie auto in the pro uni. And Chandler Jones, unforgettable. Points again. Actually, I think these are more this time. Yeah, 400. So top team will get 400 in the random. We'll just go here. We've got the Vestige of Josh Allen. Bryce Young rookie. Daniel does a Buccaneer to 150. There you go, Tampa. Sam Howell. Nice one there. Bright beginnings. Patrick Mahomes. Animation. Super short print. Congrats, Dustin. That's so sick. Oh, that's awesome. Dustin, congrats, buddy. We'll get that into a mag for you. That is nasty. Hell yeah, that's so cool. Yeah, I know, Chad. That was sad, man. A no condo to 150. Lamar to 100. And a fusion. Lamar to 50. Go, Dustin.  God, that Mahomes is nasty.  After the other SPs. Hell no. It ain't over till it's over. Dustin, it ain't over till it's over. Jalen Hyatt to 175. There's a Jaden Reed year one. Nice one for the Packers. Congrats, Packers. Viviana with a random division. And a Savage, Miles Sanders. Go, Dustin. Anthony Richardson-Rookie. A Kenny Pickett to 150. Rashi Rice year one. There you go, Dustin. Just gravy at this point. Nice one there on the on-card. Red ink. Color match. And a fusion. Etn Jr. for the Jacks. Dustin, have a break. Bryce Young-Rookie. Justin Herbert to 250. Jalen Hyatt year one now for the Giants. Nice one there on-card. You got it, Dustin. No problem, man. Engaged in all items. I know, still two boxes left.  Yeah, back-to-back breaks pretty solid. Yeah, this one is, this one's nuts. Mahomes animations are so sick. Josh Allen. Nice one there on the beacons. Light the beacons. Going to the bills. Joe Mixon, 235. Eric Gray to 200. And unforgettable Chandler Jones to 50. In an O'Connell. Joe Mixon to 250. There's a Neutron means. Nice one there. 61 of 100. Shutter signatures for the Chargers. First one of these I pulled, actually. Those are clean. I like that. And a Savage Christian McCaffery. Oh yeah, Neutron means. Neutron means. When any slander of Neutron means. Will Leviss Rookie. Zay Flowers to 100. There's a Deontay Banks Rookie Auto for the Giants to 50. The Maryland Terrapin. And Josh Allen Fusion. Those fusions are clean too. Yeah, they are clean. Can you pull number one to these? Yes, yes you can pull number ones. Yeah. I think we pulled a Lamar on this one. I think that was numbered. Kenny McIntosh. Kenny to 150. Like that. Oh, we got Tank Dell and Tank Bigsby. Dual Auto, year one. Jags and Texans. See if that is going to be a random. I believe it will be. Texans, Jeff M. Jags, Josh N. Random to those two teams at the end. Nice little duel. And A. Logan Wilson engaged. I don't like that one. I don't like that. That card. Did you see the Derek Henry one? Yeah. Actually, that was hilarious because I pulled that. I pulled the number one of Derek Henry. I was like, ha ha fun. You like this one? The next card was that one. Damn. Yeah, this half case is kind of going crazy. I'm not going to lie. This half case is fire. JSN, Russ to 100. Hending Hooker. Year one purple ink. Nice one there. Congrats, lions. That's awesome. Really quickly, I want to look the Luminance football checklist. I want to see if they have any of the odds on the year ones. Yeah, there's no parallel on it, but there's no rarity on it, but that one's pretty solid. Congrats on that, lions. Nice hooker. On the auto. And then a rope one. Engaged. That was Murphy. Mahomes. Beacons. Nice one again. Just gravy right there, Dustin. Unreal man. Nice one there. Congrats, buddy. Jix and Smith and Jigba to 175. Saquon to 150. And Jordan Addison to 50. Yes, sir. Yes, sir. That is a Jaron Hall. Justin Herbert to 250. Jaron Hall, Rookie Auto to 50 for the Vikings. Nice one there. QB Auto action. Unforgettable of Nikhil Harry. Strange. Strange. Strange that that one's in there. I guess the idea, because it's like an unforgettable moment and that was a good catch, but... Mims. Will Mallory to 25. A Jalen Carter, year one. Nice one for the Eagles.  And Nick Chubb, Bestage. All right, we got a couple of randoms to do here, guys. We'll start with the points, then we'll do the Tank Dell and Tank Bigsby. The Tank. The Tank Duel. Yeah, that was a good break for sure right there. We'll call it the Tank Duel. Texans. All right, so we'll start off with the points. Again, we're going to roll the dice. Two, whatever teams on top after six times, we'll get the 400 and the second team will get 600. I should probably put the teams in, that would help. Okay, so we got one, two, three, four, five, six. Saints, going to get the 400 and the Eagles are going to get 200. Or 250, whatever it is. Saints and Eagles, 400 and 250. And then we've got the Tank Duel. That is going to be, again, Tank Dell and Tank Bigsby. So Tank Duel is a Texan, Tank Bigsby is a Jaguar. We're going to roll the dice on this one and we're going to go four times. One, two, three, and four. Going to the Jags. Congrats, Jacksonville. All right, let's do a quick recap here. Very solid break overall. We had the Illuminosity of Jamar Chase. We had the Tank Duel and Tank Bigsby that's going to the Jags. So here's what we're going to be talking about. So there are some of the things to be said about Mr. William Holmes, Josh Allen, Sam Howell, Damian Pierce, Brian Erlocker, That is TJ Hockison, Natrone Means, Jarron Hall, Deontay Banks, Rashid Rice, Israel Abinaconda, Marvin Mims, Michael Wilson, Zach Sharbanette, Jaylen Hihat, Rashid Rice, Jaylyn Carter, Jayden Reid, Clayton Tune, Chris Johnson, Heddin Hooker, again for the filth up next we've got our last break of the day upload I gotta get the random typed in for the next one as well the legacy of luminance yeah have a good one have a good one Dustin thank you buddy I would say you can fad the the Mahomes come on Shopify really this is what we're gonna do that's what I thought that's what I better hurry up this guy Carl has to be thrown out of breaks now it does Cal math twice Cory G Dana s4 and B okay James P Joseph M Josh W Carl Mark L Martin C Matthew M Nicholas P Richard L four times Roger W four times and C Steven W Tim H Vinn N and see cool all right it's got this random going and a poppy we use shoppy what's going on everyone Sam here with late in sports cards doing the random for the legacy luminance four box NFL mixer number three random team style 28 participants 28 teams and combos let's roll the dice sometimes we're gonna go six one two three four five six Richard L down to Calum F six times on your teams one two three four five six Broncos Bears down to bills Richard L Broncos Bears Cory G Colts Roger W Eagles Mark L Patriots Josh W Steelers Martin C Lions Nicholas P Titans Dane S with the Raiders Steven W Panthers Florent B Vikings Carl P Jags Vincent C Giants Joseph M Saints Adam F Bangles Roger W Dolphins Commanders Glen K Jets Browns Richard L Falcons James P Seahawks Vin N Texans Matthew M Rams Ryan C Packers Richard L Cardinals Bucks Roger W Chiefs Tim H Cowboys Calum F Ravens Roger W Niners Richard L Chargers and Calum F Bills get these copied over guys get started just a moment guys results will get going good luck everybody here we go it's going on everyone Sam here with late in sports cards ripping the legacy of luminance four box NFL mixer number three random team style here's a look again at your random results as always you can find those on the website under the results tab as well as the link in chat so good luck everybody here we go let's do it we'll start with legacy I think all that base is split even on this right that base yes okay start with legacy good luck yeah Jags could be decent I mean Trevor Lawrence has autos in in luminance so there's a potential there not many but there's some and then you've got Tank Bigsby as well Anthony Richardson hi it Devon Shane Jordan battle silver rookie Xavier Hutchinson will Anderson Donald to 125 gonna roll the dice on this card there's a handful of these that aren't the same guys so whatever the one two three top four five six bottom unless it's a one-on-one and it's gonna be a three gonna be a three gonna go to the top you go to the top on those duals I mean most of them are gonna be the same team but there's like that one and one other that are different teams under lights teal off Tank Dell and Peter Skaronsky Anthony Richardson and base taking in here that is Jake Hayner to 100 nice one there for the Saints Congrats New Orleans probably the Colts Colts and Lions I would say Colts and Lions nice that is gonna be a dream catchers Justin Jefferson on the short print that's cool there you go Lions Jalen Carter under lights blue Michael Meyer to 20 Jack Saturday will Leviss at it's a Parker Washington going to the Jags nice one there there you go Carl Parker Washington rookie auto oops there's an orange CJ Stroud behind it to 149 last question I'll ask something me personally or something overall there's Kenny Anderson to a hundred nice Jersey auto for the bangles that's sick game worn to game Ward Kenny Anderson very nice Tyree kill under the lights blue Steve Young to 50 Tank Dell Zach Evans K Sean beauty and Brian Breeze 400 points random to all at the end that is a Brian branch for the Lions to 10 7 of 10 nice one there Congrats Detroit on the gold ice mini Jamiro Gibbs base orange Devanna Shane to 199 red sake one to 299 decade of dominance Joe Montana 7 witherspoon Jalen Hyatt orange Mike Dicka to 249 my homes and Smith that press got under the lights silver Krause Shane and Hutchinson Jerry Rice last from the past a mini Darnell Washington under the lights Landersen Zach Evans is this the that's the sleet dinner yeah all right luminance two boxes of luminance good luck everybody imagine there's a teal auto in this car I'll be not every kind of French Michael Meyer Michael Wilson Kyler Murray that is going to be going to the Cardinals to 25 two-color patch nice one there Congrats Arizona Josh Downs to 175 Eric red 200 and Aaron Rodgers vestige Devanna Shane Jordan Addison Luke Musgrave to 250 Najee Harris got a Darius Davis to 350 for the Chargers rookie auto and Fugia and AJ Brown Anthony Richardson rookie Clayton Tune to 150 that's Zach Charbonnet year one auto on the red ink nice one there for Seattle that's Seahawks vestige rope one points again in there I believe Anthony Richardson dynamic 250 points also random to all at the end Bryce young rookie and Christian Watson to 100 last box of the day everybody good luck here and I missed the trash will Mallory Andre Reed for the bills player warn nice one there Congrats Buffalo very cool on the vintage materials J. Caner Saints to 175 Devante Smith to 150 infusion to 100 Christian McCaffrey Grats on that reporter Aaron Donald to 250 there's another Darius Davis rookie auto to 350 for the Chargers that's Vegas and T-Law unforgettable you Carl Will Anderson JSN Luke Schoonmaker to 25 for the Cowboys got a Josh Downs rookie auto to 350 for the Colts there you go Indy and Jackson Smith and Jigba unforgettable I can touch CJ Stroud there's a Stetson Bennett to 150 we got redemption is Joey Porter Jr. rookie luminance auto vertical that'll be going to the Steelers nice one there Pittsburgh go into the Steelers Congrats on that Pittsburgh Joey Porter Jr. and a Savage of Lamar Lamar alright we'll do a quick points random 400 and 250 now put everybody into the randomizer top team will get 400 second team will get 250 roll the dice I guess nine times on it one two three four five six seven eight and nine Jets Brown's gonna get 400 and then Patriots gonna get 250 Patriots that's gonna be sore alright do a quick recap here we had the Dreamcatchers J Jettas a Kyler married at 25 Andre Reed for the bills Joey Porter Jr. Steelers Darius Davis Josh Downs Darius Davis again year one Zach Charbonnet Parker Washington Ken Anderson Jake Hayner fair fair Carl that'll do it for the break thank you guys again for the film next up it's nothing got nothing that's it so you got again everybody Boris will be breaking at in about an hour 15 or so he'll be live there's your break schedule again he's got a lot of sold out breaks so I'm gonna say if you are interested in jumping in with him tonight I would say to get that done sooner rather than later for sure sooner rather than later I will see you guys again tomorrow night I appreciate you guys filling everything up very very quickly today too have a good one everybody I will see you tomorrow