Cube, covering Cisco Live 2018. Brought to you by Cisco, NetApp, and the Cube's ecosystem partners. Welcome back, I'm Stu Miniman, and this is the Cube's coverage, wait, we're surrounded by green. I've got two gentlemen from Veeam here. No, but we're not at Veeam on. We're at Cisco Live 2018 here in Orlando. Happy to welcome back to the program. Carrie Stanton and Rob Emsley, gentlemen. Thanks so much for joining us. Thanks too. All right, yeah, so I was with you guys not too long ago at the Veeamon conference. Had a lot of fun, and Chicago brought back some of the famous popcorn for my family, but we're here in Orlando. So way bigger convention center, 26,000 people. We're all walking a lot, talking a lot about networking and multi-cloud and everything there. Tell us a little bit about your experience here at the show and what you've taken. Yeah, yeah, it's great, thanks Stu. We have, as you may know, a tier one partnership with Cisco. We're a platinum sponsor at this event, and we're here all around our relationships with them on their data protection with their HyperFlex and their 3260 and S240 relationships, and we continue to see rapid growth in the channel, and we have a direct dedicated team selling with them on a global basis. So here, making a lot of new connections across their other business units. Rob, I see the green Veeam booth at almost every show I go to. Absolutely. How's Cisco different from some of the other ones that we go to? Well, one of the things that Chuck Robbins talked about in his keynote yesterday was how they summarized the focus of the company. There's two specific areas that Veeam works very closely with Cisco on. One is the powering the multi-cloud and unlocking the power of data. Those are two big focuses for us. You remember in Chicago, we're all about multi-cloud. On-premises, managed cloud, software as a service, the public cloud, that's the reality of where data lives. So we're very much in lockstep with Cisco. We've been working with Cisco for several years. We last year became available through their global price list. So we're actually finding that Cisco in the data center, especially when you think about conversion infrastructure and hyper-coverage infrastructure, it's an area where we can really complement what they're doing with their opportunities. Yeah. Kerry, it's interesting because we go to a lot of shows and we're hearing a lot of similar themes. Even, you know, I think last time I'd come to the Cisco Live USO it was 2009. Applications and data, it's like, come on, those are just bits running through our pipes. It's not really a big deal. Well, we're here in the DevNet zone. We're talking about how Cisco's been moving up the stacks, how they're enabling companies to build new applications, do cool things with wireless and SD-WAN and everything like that. I'm sure you must be seeing big change in a lot of your infrastructure partners that fits as Rob said, that power of data and where that fits. Yes. Yeah, I mean, we're seeing it across the board and what we like about the relationship we have with Cisco is they look to us as their, you know, data availability experts, right? That we go into the data center conversation and they bring us in as their subject matter experts and that's where I think, you know, they want to expand their footprint and their TAM with their product lines, whether it's UCS or HyperFlex and they're bringing us into those discussions because we solve, you know, a unique problem that they otherwise wouldn't be able to solve. Yeah. Rob, you saw the keynote yesterday. We were a little surprised. Diane Greene comes walking out.  I've actually interviewed a number of Cisco executives at things like, you know, AWS re-invent and the like. Does the Veeam partnership with Cisco, do you touch on some of the public cloud pieces as well as? Yeah, very much so. One of the things that Cisco is very focused on is their service provider, you know, right to market. So that's an area where we've been, you know, very focused over the last probably three to four years, you know, building out and enabling often our resellers to become managed service providers themselves. But the reality is, is that, you know, you're starting to look at that public cloud tie-in, whether it be Microsoft Azure, whether it be AWS or IBM cloud. So these are really all areas where, you know, we can provide an on-ramp to connect any Cisco data center environment and provide a relationship with the public cloud, provide that data management level layer. Yeah, you know, I think back, you know, Cisco really helped a lot of the channel community mature their market. Went from being, you know, the silo network to building data center businesses back, you know, eight years ago when we started talking about converged infrastructure. Today, you know, this week, I've interviewed Presidio and WWT. They're talking a lot about how they're helping customers enabling that cloud. Love to hear your perspectives on, you know, the maturation of the channel and how they fit in this multi-cloud world, yeah. Yeah, I mean, if you look at Veeam with our 55,000 channel partners, our brand promises remain channel, you know, at 100% channel-driven company. But having these relationships that are primary Cisco predominant partners like a WWT, Presidio, E-plus, I think it's just opening up discussions that we otherwise wouldn't have had. And, you know, we're seeing 50% of the opportunities that we're closing in the field are Cisco-led opportunities that are being driven from these new channel partners. And so again, I think this is the one plus one equals three story that we talk a lot about that we're bringing a lot to the table and 50% of the opportunities for them and vice versa for us. Yeah, one of the things that we really like about Cisco is their focus on their partner community is extremely high. Both from an enablement perspective and an education perspective, you know, they have a fully resourced partner marketing team and we've been doing a lot of work with them.  So we've been working very closely with them to do joint digital marketing. You know, it's very easy sometimes to do joint event-based marketing, but when you start getting into digital, you really have to think outside the box about how you bring two companies together to meet kind of in the digital world. So we've been really doing that to drive joint opportunities. And that's been something that, you know, we've really, you know, got some success with from our relationship with Cisco. In fact, you were just in Barcelona and...  And we actually won the Cisco Marketing Innovation Award for a digital marketing always-on campaign site, which is full of assets for joint digital, for joint Cisco and Veeam customers. Yeah, congratulations. I did see some of that on some of the social media. Yeah, it's interesting to look at how, you know, marketing changes in this new digital world, something, you know, I ask every CMO I talk to these days as to, you know, how is digital changing the way things happen? And I find, you know, you mentioned our other infrastructure partners that there's no other partner that we've worked with at the size of Cisco than Embrace at day one. So they look to Veeam as, okay, we're going to work with Veeam, we're going to go deeper, we're going to bring them on our global crisis. And day one, they were, how can we, you know, kind of get intertwined into what Veeam does extremely well as our digital marketing machine. And just from the get-go, they've just continued to accelerate through that process. Yeah, one of the things I know every partner loves when they come to a event like this, there's a lot of customers here. Yes, there is. It gives a little insight if you can either specific examples or give us some of the themes you're hearing from customers at the show. What's top of mind? What are some of the biggest challenges that they're facing today? Yeah, I mean, I think what they're looking at doing is, you know, from a refresh of legacy backup solutions and replication solutions into modernizing their data center. And so they're looking to Cisco as their experts, you know, through the last decade plus. And now that Veeam is, you know, kind of tied directly in with Cisco and some of those relationships. So it's from a refresh standpoint, from a modernizing their data center to the hybrid cloud strategies that it's intertwined. You know, we fit very well into those discussions and we're seeing our customers come to us in these, you know, large ELAs where Cisco is bringing us in as part of those discussions. So again, we're otherwise, we would have had a hard time getting into it. Their customers are coming and saying, what is the relevancy? Should I really be looking at this? And Cisco's backing up those discussions. I don't know. I mean, certainly to tap down on the data center, converge infrastructure and hyper-coverage infrastructure is top of mind for a lot of the customers that are coming by the booth.    So that's definitely an area. If you think about conversion, hyper-converge, it's always highly virtualized. So that plays very well to where we've, you know, built the company from. A big focus on virtual machine availability, you know, but really gets more moving that now to sort of the whole concept of data management across a multi-clad world. Yeah, absolutely. One of the things, you know, we talk at all the shows is that, you know, the pace of change and how receptive our customers to making changes. What are you hearing from the customers here?  It's a little bit entrenched, you know, making changes.  Today, you know, we think things are moving faster but we'd love to hear, you know, points or counterpoints that you're hearing. Well, I think that the customers are looking to Cisco indirectly to Veeam from removing complexity. And I think what they've seen in the past is they've deployed solutions that have bogged down their process.  And so, you know, from my standpoint, the customers that we talk to consistently is, are you going to be the platform that's going to allow me to embrace a hybrid cloud and, you know, to remove the complexity that I have and to be agile? And so, you know, that's constantly what the Veeam messaging is solving, right? Mission critical, backup and recovery workloads and doing it with, you know, at a fraction of the cost and accelerating that Veeam speed. Yeah, I mean, if you just take the legacy backup market or legacy backup installed base, you know, it seems that the openness to change is greater now than I've ever seen it.   I think the big change is that backup as an insurance policy is no longer good enough. I think the ability to leverage your backup infrastructure and the data contained within it is really driving people to think about, you know, that's more of a value to me than simply having an insurance policy. Yeah, absolutely, you know, backup was never enough. We only do backup, I need to restore, but it's about that data. I want to give you the opportunity, you know, Veeam is, I think we said kind of a tweener.  Let's take that. Yeah. Well, I think that we pride ourselves on innovation. We pride ourselves on iterating very quickly and we pride ourselves on, you know, adhering to our NPS score of 73, right? Whether it's 300,000 customers and what we, you know, we are going to continue on our path on what's made us successful and we know that there's always competition. There's lots of VC money out there and you know, it's not that we're looking away from what the competition is doing is that we believe with our 4,000 customers a month or 133 customers that we close on a daily basis across all segments of SMB, commercial and enterprise is indicative that our strategy is working. We're not going to stray away. We're just going to look to partners like Cisco and others to expand our target market but stay true to the solution that we've provided in that virtualization environment and we've made, you know, you were at V-Mon, you saw the announcements that we're making to support, you know, additional workloads and additional environments in the days to come. Yeah, I think our ability to evolve and adapt is second to none. You know, I think the, and some of that is just based upon kind of the structure of the company, you know, we're still private, you know, still pretty much, you know, we're driving our own growth. You know, and I think that allows us to make decisions quickly and very strategically to allow us to go into the areas that I think people instinctively know what is needed to evolve in this space around supporting multi-cloud, supporting data as an asset, leveraging it as an asset. And I think that's where we've been fueling both in an engineering perspective and a capacity to meet with customers and grow. And that's, you know, certainly what's going to, I think, sustain us as we keep going forward. All right, gentlemen, I want to give you the final word as to, you know, key takeaways you see here from Cisco Live 2018. The, that we will be here for the duration of the time and our relationship with Cisco will continue to expand and that we look forward to meeting everyone at the Veeam booth and walking through our product solutions and meeting the Veeam team and answering any questions they may have. But we're thrilled to be part of the Cisco family and hopefully, you know, again, in the years to come that we'll just continue to expand our relationship. And I'll leave you with an African proverb. If you want to go fast, go alone. If you want to go far, go together. Absolutely. Rob Emsley, Kerry Stanton, always a pleasure to catch up with you. I'll leave it with the final aphorism of my own, which is, you know, never confuse activity with progress. Ben Franklin. So I'm Stu Miniman, back with lots more coverage here from Cisco Live 2018. Thanks for watching theCUBE.


Hi, I am Dennis Gieser and welcome to my talk about robots with lasers and cameras, but no security Where we will talk about ways how you can liberate your vacuum from the cloud Before we start here some background information about me I'm a PhD student at Nofisa University, and I'm working with Professor Gewerner Beer. Our research field is wireless and embedded security My particular interest is in the reverse engineering of interesting devices I focus on smart home devices, mostly vacuum cleaning robots My current research is in the security and privacy of smart home speakers In our most recent work, we analyzed the security and privacy of used Amazon Echo devices This paper was published on AC&Y sectors here. Let's talk about the goals of this talk First, I would like to give you an overview over the current development and routing of vacuum cleaning robots In particular, we will focus on Roborock and Dreamy. We will talk about vulnerabilities and backdoors And I will explain new methods which you can use to root your device As a general side note, I have no intention of bashing the companies I like the products and I think we have maintained a very friendly relationship However, obviously our goals are slightly different All right, let's talk about our motivation. So why do we want to root devices? Well, as devices have powerful hardware and a lot of sensors, we can play around with interesting hardware This is especially interesting for people in education Then we want to step devices from constantly phoning home Also, a lot of people have already custom smart home services running, for example, home assistant And here it is interesting to connect the vacuum cleaners to that system And finally, we want to verify the privacy claims of the manufacturers So why don't we trust IoT? Well, IoT in general, they are always connected to the internet and they are on your home network The cloud communication is encrypted and you don't really know what kind of data is transmitted From our experience, we know that developers secure hardware and software is hard And that IoT devices are not always being patched Also, vendors sometimes contradict each other in regard of their privacy claims And as an end user, you have no way to be sure All right, here's an example Roborock claims for the flagship model that nothing is sent to the cloud Especially what is recorded by the camera This claim was also certified by the German TÜV However, on the same website, they show that you can access the camera remotely from your phone For example, you can watch your pets and talk to them Let's talk about the problem of use devices A lot of people order devices on Amazon, try them and return them So use devices are not that rare As a buyer, you have no real information about the past of the device So a malicious person could have installed a rootkit onto it As a new owner, you have no way to verify the software And as a result, you might have a malicious device in your home network So rooting is the only way for you to verify that the device is in fact clean All right, let's take a look into the past, the good old times of rooting My first work with vacuum cleaning robots was back in 2017 Here, I worked with Daniel Weigemann And we were looking at the Xiaomi vacuum cleaning robot and the Roborock S5 We figured out that the firmware images of these devices were unsigned and encrypted with a very weak key And that custom firmware could be pushed from the local network As a result, it was possible to root the devices without disassembly And develop custom software and voice packages for the bin We published our findings on the 34C3 and back in 2017 And also on Defcon, exactly three years ago Here, I would like to give you some short recap about the hardware of the Xiaomi vacuum robot and the S5 Both robots were running an ARM quad-core CPU and have 512 megabit of RAM They had also 4 gigabyte of EMMC flash They had a lot of sensors, and in particular the most important ones are the LiDAR sensor on the top of the robot The infrared sensor and the retrosonic sensor These devices had also some debug ports, for example USB and URT However, USB was kind of protected and we never used it for anything To give you some background information about the software This device is run Ubuntu 14.04, mostly untouched However, the vendor is obviously scheduled to root the password Interestingly, the vacuum cleaners were controlled by the player software Which is basically an open-source robot device interface and server So they used open-source software to run the devices They had a lot of proprietary software on them For example, they used the custom ADB version Which had some authentication and so we couldn't really use it They run a custom watchdog, which made sure that the device didn't crash But on the other side also enforced copy protection And they had the logging tool, which uploaded a lot of data to the cloud They protected the ports on the device with IP tables For example, they blocked the port 22 for SSH and blocked also the player ports However, the interesting thing was that the IP tables' rules only applied to IP version 4 So if the device got an IP version 6 address, it would not buy a watt at all All right, let's look on how the forces dragged back And how they started to lock down the devices Well, the first steps in locking down we saw with newer S5 firmware So here, Roborock did block local firmware updates Improximately, this change was also pushed through other IoT devices from Xiaomi So most devices were basically blocking local firmware updates We saw more changes with the introduction of the Roborock S6, which came out in 2019 For example, the firmware and the voice packages were now signed So we were not able to create our own custom voice packages anymore Each model also used different encryption keys So if we had encryption keys for one model, we were not able to decrypt firmware for a different model They also started to sign the configuration files to enforce region locks As many people bought cheap devices from China and modified them So that we were able to use them outside of mainland China One interesting aspect is that most of the hardware remained mostly the same So most of the changes were basically just done in software All these changes meant that in order to get root access onto the device We needed to disassemble it One thing which we thought back then when the device came out That we might need to keep rooting method secret And so in the first two weeks when I got to Roborock S6 I was able to root it and then develop two different methods One where we extracted root password via UART and the obfuscated it So I could get access to Overseerio for example And the other way was that I booted into a single user mode And modified files there so that I had SSH access Back then I didn't publish the methods for some time As I assumed that Roborock would lock them down as soon as they know about them So this is what you had to do to get root access You had basically to solder wires to the test pads to get in the UART port With rooting we made some observations over time Every time we published a method it got blocked And here are some examples for blocking For example, local updates which we published in 2017 Were blocked in firmware updates 2018 The root password method which I published in 2019 Was blocked in newly produced devices back in 2019 And the UBIT bypass was fixed for new models in 2020 So there was one model which came out at this time And it was already patched This means basically that all current public methods are basically blocked Alright, let's talk about the development of Roborock models over time So we only will talk about global models There are way more models like in Mainland China But in this case I just want to talk about global models On the left side you see the size of the RAM On the right side you see the size of the flash And this becomes more important later In 2016 Xiaomi released the V1 Which was basically an OM product by Roborock Roborock released the S5 under their own name in 2017 In 2019 we saw more devices We saw the Roborock S6 and S6 Pure and the Xiaomi M1S Which was again an OM product In 2020 we saw the S4, S4 Max and S5 Max And their flagship model the S6 Max-V And this year we saw the Roborock S7 If you add the price when you see But higher prices do not really correlate with better hardware Also one thing which we noticed is that Manufacturers are recycling hardware in different models For example the Xiaomi vacuum robot has more or less the same hardware as the Roborock S4 The Roborock S5 and the Roborock S6 are more or less the same And as you can see on the bottom the S6 Pure, the S4 Max, the S5 Max and the S7 Have the same mainboard and more or less the same hardware too However the prices are very different from them As a conclusion one thing which we noticed is that the hardware gets weaker over time Despite the devices getting more expensive Roborock has two vacuum cleaners which are special Both of them contain a camera which is a little bit more critical in regard to privacy The first one is the M1S which was released in 2019 Instead of using an all-winner chip this one uses a rock chip quad core It has 525 megabit of RAM, 4 gigabyte of EMMC It has a LiDAR sensor which we already know from other models But in addition to that it has also an upward-facing black and white camera It does have an ultrasonic distance sensor in the front and infrared sensors To give you a perspective of the camera I record this video on a rooted vacuum cleaner And I use G-streamer for that The second model with the camera is the Roborock S6 Max-V This is currently the flagship model It was released in 2020 and contains a Qualcomm octa core SOC It has 1 gigabyte of RAM, 4 gigabyte of EMMC flash In addition to the LiDAR it has also two color cameras in the front Which are illuminated with infrared And it has the usual infrared sensors In the bottom left you can see the stereo camera of the device In the bottom it has the infrared illumination So this device we'll see in the dark On the right you find screenshots from the app As you can see the vacuum cleaner can actually detect objects and can avoid them This is also quite interesting again for privacy reasons If you look at the software of both devices both of them are very similar They use Android as the operation system And the controlling software for the robot is very similar to the previous models The software access the cameras via the video for Linux subsystem There are a lot of libraries which are used But the more interesting ones are OpenCV, OpenCL and the TensorFlow Lite Roborock learned from the past And added a lot of security measures to their device For example, SecureBoot is enabled And they make use of the replay protected memory block as a downgrade protection The system partition is integrity protected with DM variety So we cannot modify it Also a lot of partitions are encrypted with looks In particular all the application specific programs are stored on an encrypted partition The keys for this partition are stored in OPTIM Which is using ARM trust zone But there are more security features For example Roborock added a kernel-based verification of binaries All binaries before we get executed are checked for a correct signature This means we cannot really put any custom binaries on through the system Also they cited encrypted firmware updates This time each of the firmware versions has a different key The master keys itself are stored in OPTIM Which is using trust zone And interestingly they modified the IP tables binary Traditionally what we did for routing We removed all the firewall routes as soon as we root the device So we could access SSH and other tools However Roborock removed the ability of IP tables to flush or delete routes So as soon as routes are added to IP tables we cannot remove them anymore And they locked also UART So we cannot use UART to get root access All right we had some partitions which are especially interesting On on these devices which we need also later for our route There's the app partition which contains the device credentials and some other configuration files This partition is not protected by loops or dm-varity Then we have two copies of the system partition One of them is the active one, one of them is the passive one Both partitions are protected with dm-varity so we cannot modify them Then we have two application partitions Again one active and one passive copy Which are encrypted with loops However we are not integrity protected We have a reserve partition which contains the calibration data This one is again encrypted And we have the user data partition Which contains the lock files and the maps And it's again encrypted with loops So let's talk about the new routing methods for Roborock Currently there are three models of vacuum cleaners which have no public route This is the Roborock S7 which came out this year The M1S and the Max-V Let's start with the Roborock S7 So the Roborock S7 has more or less the same mainboard as the S5 Max, S6 Pure, etc However the problem is that they patched U-boots So we cannot use UART anymore to route it In addition to that the route of S is a read-only squash of S So even if you have access on a device we cannot modify the partition I developed a new method for this device Which is FEL Routing This method doesn't require any soldering However it requires still that the device is disassembled This method also automatically patches the route of S and enables SS8 And it applies to all current NAND based Roborock models In order to find a new routing method We need to reverse engineer the PCB We knew already where the UART pins were But they are useless after they blocked this functionality However all the all-winner socks have the so-called FEL mode FEL mode is a low-level mode which allows the flashing of the device And it is burnt in the SoC ROM so it cannot be modified The idea is to load a custom OS via FEL There are two typical methods to trigger the FEL mode First we can somehow disable the flash chip For example by grounding the clock However this method might be risky if you don't do it correctly And the second one is that we can pull the boot mode pin or trigger the FEL pin The problem with this is we need to figure out where this pin is So I got myself a spare PCB and did destructively disolder the SoC chip After I did that I probed all the pins And was able to find an incorrect pin For example like JTAG or the boot mode selection And by having this we can use it to trigger the FEL mode So how does this approach actually work? The challenge for all Winner Socks is that the NAND report is proprietary So we cannot use a mainline kernel or mainline uboot So my approach was the following I extracted a kernel configuration from the Roborock kernel I created my own init ramfs with drop here ss8 keys and some tools I compiled a minimal kernel using the nintendo nes classic sources The nintendo nes classic uses the same chip as the roborock vacuums I created my custom uboot version And with an extracted roborock configuration And I triggered the FEL mode by porting the tps17 This is the boot selection pin to ground Then I loaded the uboot kernel and the init ramfs into the ram And executed it After I did that my customer was booted Patched automatically the rootfs and I had root How does the pattern process exactly look like? First we need to boot into the FEL image Then we need to just decompress the squashfs After that we patched this image For example we installed the outerwise keyfile and the custom drop here server We compressed the image again and overroyed the partition with the new image And as a result we have ss8 access and root So what are the advantages of this new method? Well of course we don't need any soldering anymore We just can short the boot pin one time and we're good to go It's a very simple process and it also allows to restore brick devices Which was not possible before And also one important thing is that it can be used for all our winner-based vacuum cleaners So now that we have root for the rubarok s7 Let's take a look at the camera-based models So if you want to root the m1s and the maxb we have some issues First all the ports are closed to firebolt The fire systems are encrypted or integrity protected And the usb interface is also protected with some custom adbd So to get root access we need to have a layered approach First we need to break in via usb Then we need to disable the se linux and then patch the application partition And as an important note while it might be possible to root these devices It might be impossible for many people So don't expect it to be that easy as for previous models All right level one get adb shell If we connect over usb we need to do a challenge response authentication This application is based on a vinder secret Which we don't have So rubarok has it properly somewhere in a database The secret is also device specific Also the adb is controlled over a special configuration file Which we might need to modify All the files are stored under default protection and are thankfully not protected So our idea is the follows First we need to connect to the flash For example via insistent programming or by disordering it Then we need to create or extract the vinder secret And then we use a tool to compute the challenge response So for the m1s we can do insistent programming By soldering small wires on the bottom side of the pcb The pictures which you see here are from my experiments Where I used the sd card as a replacement for the emmc flash But the pinout is more or less the same As an important warning if you don't know what you're doing You likely will break your device So I tried both methods But I figured out isp is can be sometimes tricky So what I did instead is I used an adapter to read out a chip Which requires reflow soldering to remove the chip And reballing and then resoldering it again Okay what are the results of level one? I have a more detailed how to on my website However what I did here is I set the vinder secret to all use After I connected the device via usb I needed to extract the serial number from it So I ran adb devices The serial number is required for the challenge response process In the next step I asked the device for a challenge So as you see here I got like a random string back which is the challenge In the next step I used the tool vinder to generate the response So at this point I want to thank Eric Willman for his support And help to create this tool Before that I was computing the response manually But he extracted in Ghidra the function and just put it in a C program So now we can just run it from the shell The result of this program is basically the response And as soon as we have that we can just Run any commands which we want to do as you see here We have no shell access but as AlienOx is still enforced As AlienOx will prevent us from doing specific things even if we are rude For example the network access is blocked and we don't have any access to the dev directory So we cannot mount partitions or access devices However we can do two things We can do bind mounts and we can issue the kill command So the idea to disable as AlienOx just follows First we copy the MEO directory to a temporary location The MEO directory contains the Xiaomi cloud client Which is launched by the watchdog The watchdog has all privileges And it makes sure that if the MEO client is crashing that it gets restarted In the next step we replace the MEO client with a bash script which disables as AlienOx In the next step we mount this temporary location back to the original location If we now kill the MEO client The watchdog will restart our bash script instead of the real MEO client So hopefully as AlienOx gets disabled Let's take a look if this works also in practice In this case what we need to verify first that as AlienOx is actually enabled So with the get and pause command we get the response that it's enforcing In the next step we check the process ID of the MEO client process So we see the original process is running Now we copy the MEO folder to a temporary location And write our bash script into the client The client is not an alpha anymore instead it's a bash script Now we bind mount this folder to the original location And we kill the MEO client And now hopefully the bash script was executed And we can check it with get and pause And we see it's permitted So now as AlienOx is disabled Let's do level 3 We have now full root access however it's only temporarily So as in the moment when we restart a vacuum cleaner we lose root access So the good thing is the app partition is not integrity protected If you modify information is there then we don't have any issue By modification of a few scripts we can disable as AlienOx And start dropper on a different port The reason why we want to start dropper on a different port is that IP tables still blocks the port 22 As I mentioned before Ruborock modified the IP tables binary so that we cannot delete roots But instead we can just use a different port We are still limited by the ELF binary signature verification However we found a backdoor in this function If you give the binary a particular name then it has a white listed We can even point symbolic links to this binary Many thanks again to Eric Oman at this point which helped me to figure that out Let's do the demo again I want to run Valetudo on my robot Valetudo is a cloud replacement which allows to control your vacuum robot locally As you can see here I downloaded it with VGET into a temporary directory And I tried to launch it however I got a segmentation fault Typically segmentation faults happen if some libraries are broken However when I was looking at the kernel lock I saw that a very far ELF function kicked in and stopped the execution So now let's try a trick with the white list So we renamed the Valetudo binary to the white listed name As soon as we run the white listed name you see Valetudo is starting happily and everything works So now we have full root access and can run our own binaries on the system So some other ideas for this vacuum clears Well we can ask Opti nicely to decrypt firmware updates for us As we have root access and as we have stored a secure system Opti will happily decrypt firmware updates for us Also we can access the cameras directly For people who understand how TensorFlow Lite works You can take a look at the machine learning models of the vacuum cleaner I myself have no idea how this works so I didn't take a look at it And we can take also a look at the error back drawers So there are some hidden functions which wait only to be explored So as a summary about Roborock Well we have an easy method to root the S7 vacuum cleaner and some other models We have also a rooting method to root the M1S and Max-V However this method is dangerous in the likely brickier device It's mostly only feasible if you have decryptment and experience So regard this root as a proof of concept and that the technique can root its devices However I don't think that it will be useful for a lot of people As a general recommendation I think at this point I would say that we should try to avoid new Roborock models if you want to have root Part of the reason is that they lock down their systems And the other reason is that due to the weaker hardware We will run into resource issues if you try to run custom software onto them All right so beneath the new alternative and the great thing is There's a new player in the field of vacuum cleaners which is Dreamy Dreamy is the great alternative for us They released their first model in back in 2019 And they produce OM products also for Xiaomi They have four different kinds of vacuum cleaners which they produce The Xiaomi One C and the Dreamy F9 are V-Slam based models So they have a camera which is looking on the ceiling and they create a map by a bed The Dreamy D9 has a more traditional LiDAR sensor similar to the Roborock devices The Xiaomi One T has a V-Slam and time-of-flat camera So it can scan, it can pretty scan objects which are in front of it And the current flagship model is the Dreamy L10 Pro Which has LiDAR, a line laser and a camera All of these devices are based on various all-winner socks Dreamy uses for their devices a custom Android Which is mostly based on the Tina Linux which is provided by all-winner The company developed their own robotic software which is Ava So let's take a quick look on what kind of sensors you can access on these devices These pictures were recorded on rooted vacuum cleaners As you can see here there's a camera which is looking on to the ceiling And if you root your devices you are able to access these cameras The Xiaomi One T has an additional camera in the front which is a time-of-flat camera With that you get a point plot of objects which are in front of the vacuum cleaner The Dreamy L10 Pro uses line lasers to detect objects in front of it As you can see on the right the device creates two laser beams And if there's any object in front of the device the laser beam gets distorted The camera will pick up this distortion and will determine how far away the object is So let's talk about how we can root Dreamy The rooting of the device is surprisingly easy So I bought my first Dreamy robot when I was in China back in 2019 And it took me only a couple days to root the device The good thing is that all the devices have the same debug connector Which can be accessed without breaking any warranty seals I did do a lot of reverse engineering and I was able to extract the key material and firmware Also I reverse engineered ways to create proper FPL images So with the help of the banana pie tools which are also based on awinners socks I was able to create images which you can use to flag the devices To flag the device you need a portion to use a Windows only software which is phoenix usb There might be also ways to flash it over linux but I didn't investigate that So how does this debug interface look like? The debug interface has two times eight pins and it has a pitch set of two millimeter The two millimeters are way smaller than the typical jumper wires which you get If you plan to connect it with wires then make sure that you connect to the right pins The debug interface gives us a couple of interesting interfaces For example we have usb we have uart and we have the boot selection pin I saw that there's also like another uart there and likely jtech but I didn't investigate further To easily root the device we created custom PCBs which enable you to easily access the usb and uart There's a simple version which just gives you a usb and gives you the uart headers And there's an advanced version which has an onboard serial controller I want to thank at this point Ben Helfrich who created these boards in kycat and At the bottom of the slides you find a link to the gerber files Here are some big examples how you can connect them for example for the pcb you can insert it And you just have to make sure that you have the right orientation that you don't try the board And you can just connect ub and uart if you don't have this board You can also use jumplvirt but you need to be a little bit more careful and make sure that The connection is properly done On the bottom there's a diagram how you need to connect everything Let's talk about some interesting findings which I saw when I reverse engineered the dreamy firmwares So all the devices have an auto ssh backdoor this can be triggered from the cloud What this will do is it will create a reverse ssh shell to run off dreamy servers The interesting thing here is that they hardcoded the credentials to the server which is public facing The bigger problem is that this user which is used to create this reverse ssh has sudo writes on that server And it appears that the server is used for development I don't really know why we did that but this seems like a really really bad idea A scary thing which I found where they start up the bug scripts These scripts were downloaded over ftp from some personal developers nas These scripts are also executed at boot up for some devices The same the bug scripts are also uploading log files onto that nas And the admin credentials are in plain text in that script All of the vacuum cleaners have predictable root passwords For example devices with production firmware you can compute the root password from the serial number For devices with debug firmware there is only one valid password So knowing that it might be a bad idea to connect your vacuum cleaner directly to the internet I found also a lot of chatty functions The cloud api allows the execution of some debug functions for example Someone can trigger the recording in uploads of pictures Or the recording in uploads of camera records for devices with cameras And the device also produces a lot of log files The only way to prevent this uploads is basically rooting I don't know if these functions are used on the regular base by the developers But the fact that these functions exist is kind of scary As a summary about dreamy the devices are cheaper than roborock and they have also performance hardware This makes the devices the perfect target for rooting As I'm working on the rooting for quite a time already I was able to work with the developer valetudo on the support on the devices So I'm happy to announce that all dreamy devices so far are fully supported by valetudo since April 2021 All current models can be rooted without any soldering and this also applies to all devices released before August 2021 There will be some devices in the future. We don't know yet if they are rootable or not, but We will figure out very soon The DustBuilder is a website to build your own custom robot firmware You can create reproducible builds. It's easy to use especially for windows users In the past we had a lot of trouble with windows and mac users where building firmwares were kind of tricky So this tool kind of makes it way easier The DustBuilder works for dreamy roborock and biome devices And it's a perfect alternative to local building. However, if you don't trust it The tools will be still published on github You find the DustBuilder under builder.don'tvacuum.me At the end I want to thank a few people Which supported me in doing this presentation and doing the research I want to thank Ben Halfrich, Carolyn Gross, Cameron Kennedy, Danny Wiggema, Eric Ulman, Gavarno Beer and Zoan Bayer If you have any questions feel free to contact me by email, telegram or twitter Visit my website for any additional information or meet me here at Defcon if you're around If you happen to have a dreamy robot or plan to get a dreamy robot I have a couple spare PCBs with me which you can pick up for free Thank you very much and have a nice con


In the Nigerian media landscape, anytime you go to Nigeria and you want some of the best media organizations to read their material and stuff, they would mention quite a few and they would tell you the rest are theirs or the rest are that because some of the politicians own some of these media organizations. So all the stories are tilted to favor them against their opponent. So we have to be very careful but being unbiased, cross-checking your facts and writing the facts as you see them is the best way to go because as we said if you are slanted, if you slanted story or if you commit any libelous act, you will be taken to the court and sometimes some people might attack you for doing the right thing but that should not stop you from doing that and as we said if your reputation is soiled, if your credibility is undermined by your actions, you are finished in that kind of profession. So you have to stay true to yourself, write the stories as you see them, check your facts and put them out there, let the citizens make their own judgment on the best information you put out there.


Alright, talk to me about the cutter. When did that happen? Your success in 96? People kind of think the cutter was there forever No, there was no cutter in 96. No, so when did the cutter come? Well the cutter came the following year became the closer Did you think you were ready? I didn't know Michael. I Only knew that I will have to do exactly what I did fishing the eighth inning And it didn't work. You know, I was pushing myself To the point that everything was going backwards the first month of April I was blowing three Safe already, I think three out of six. Yeah, amazing, but then the cutter Came it just happened. It wasn't coincidental. It's the purpose of God Mm-hmm. I was playing catch we were a mere Mendoza in the outfield. Yes normal the same routine the always the Stretching running and then we start throwing all the pictures all the Sunday both are moving Moving Michael that I was trying to stop the ball from moving And now Ramiro is mad at me because he thought that I was I was messing around.    Can you give me a ball, please? Nice You didn't hold it any different This was my foreseen fastball. Okay too many pictures. This is their foreseen fastball And this is was for me also into 1997. I Threw the ball like this and now the ball start cutting But now I thrown the ball like this. I changed the grip like this right male Samaran Well, change it like this Like this and this ball it shouldn't cut at all and this ball was cutting even more Even after you can't change even after I change the seam So the pitch that made you great. They all were afraid of it. They wanted it to stop They want to know yeah, because we have no control of it But thank God for Gerard that he was there like a champ still sometimes I just tried to throw over the plate And they both just moved to the corner amazing So amazing that that year you had 43 saves a 1.8 80 or you make your first all-star game We also get the save And you help the Yankees head to the postseason and you play the Indians and then Sandy Alomar, Jr.. Hits a home run off You what was that like that was in game for he tied the game with the home run We went to Australia and we lost the game was the firing the following Game and we are the series All right, but for me it was just a learning process again, you know, I never take situations like that Like something that will drive me down if I throw that pitch again over and over He will never hit that pitch. I learned that are if I gonna throw the ball in the corner The ball had to get to the corner Well, you learn your lesson because after that you didn't allow a postseason home run for four years. Yes And we're facing the following year


Hello everybody and welcome to Psychic Medium, Tony Green. I'm Tony Green, the Psychic Medium and I will be doing the show today. So I hope that everybody is having an amazing beginning to their week so far. There are so many things I wanna share with you guys that I think personally are hilarious. But before we get there, if you'd like to call in and ask a question, the call in number is<PHONE_NUMBER>. Yep, that's the number. If you'd like to join us live, I go live every Monday and Wednesday at noon central time. You can join us live on YouTube. You can call in and ask questions or connect with loved ones or you can join us on YouTube. Any of the podcasts that I go live on, okay. First and there's so much humor out there from our sitting potas and the funniest joke I think he told recently was that he's going to, and I wanna get this correctly. So please bear with me, release everybody that is, I'm paraphrasing, so please forgive me, in a federal prison for minor marijuana. Okay, anything less than an ounce is never a federal offense. Hey, big Joe, who you're releasing, nobody, zero squat, diddly. See, it's the way you say things sometimes and if people aren't paying attention and they don't know, here's the thing. Where I go with this, is this for votes for people who think now all the pot users are getting out of jail or is this the Britney Grimer thing again? I don't know, but Joe, get your facts straight. If you're the sitting potas and you don't know that people who have minor pot infractions don't go to federal prison, please tell me you were punking us because that's a better answer than what you said in your speech. Ay-ya-ya-ee, ay-ya-ya-ee, Joe. Are they playing with your medicine again? Okay, it's not nice to pick on people who are, you know, on bed, so I'm gonna stop there with polis. Anyway, tell me if you're on YouTube watching, tell me what do you think about that? What do you think about potas releasing all the minor state-level pot infractions from federal prison?  He's a comedian, that one, isn't he? Oh, our potas is always coming with jokes. Good for him. Okay, I wanna say hi to everybody online. Hey, who's watching on YouTube? Caroline Patrick, hey, Patrick, hi, Sal. Hey, Terry. And I also have Vaughn here, hey, Vaughn. Okay, so Vaughn asked if we could do a clearing for acceptance, that's what my inner child needs. So I'm gonna do two clearings. I'm gonna go, we feel accepted, needed. Wanted, I get a no, let's clear that. And then our inner child has healed. I definitely get a no, let's clear that. That's right at the like three minute mark of the show. And then Terry asked online. Terry asked on YouTube and the YouTube chat. Terry asked, where will I meet my man? Will he be a good match for me? Yes, the second part is yes, where outdoor event, you're gonna meet your man outdoors. And I see, I hear tiki, tiki. I don't know what that means in this. I know what tiki means, folks. I don't know what that means for this specific situation. And then I'm seeing a thing where there are like poles. And then these outdoor lights, string lights hanging from pole to pole with clear bulbs, but like the, with lights, outdoor lights hanging from them. I hear the word tiki. I hear you're gonna meet them, meet him outdoors. And I feel like you are going to, and then I hear the word game, G-A-M-E game. And I feel like they're, like, although the lights are on and I feel like this is more toward the evening, I don't know if you are, oh, maybe you're someplace watching some sort of game or at some outdoor event watching some sort of game, or you are in, at some sort, I don't know. But that's what I'm getting for you. I hope that is very, very helpful for you. And yes, you guys will be a good match. I feel like this particular situation has the potential to go a very, very, very long way a very long way, okay? I am going to start taking callers to all of my callers. I love you. And by the way, everybody, thank you so much for joining me here.  Thank you so, so very much for taking this journey with me. I am going to start taking callers. And again, if you'd like to call in, it's<PHONE_NUMBER>. When I call your area code, please let me know what your name is and where you're calling from. Also, if I'm on speakerphone or a car phone, please take me off of that so that it can be a little bit more audible and have a specific question or connection available. If you wanna connect with somebody on the other side, very, very happy to do that for you, please make sure that if there is someone you wanna connect to on the other side, and there's a specific question or conversation you wanna have with them, please let me know that right away, okay? Otherwise, I am going to get started here. I am going to go to the very first person, 216. Actually, 780, you're next. Hi there, what's your name and where you're calling from? I just turned my volume up. My name is Sharon, I'm from Ohio. How are you? I'm good, I'm good. Thank you so much for asking. Thank you for calling in. How can I help you today? Thank you. Not often I can, only on holidays because today's a Monday holiday. You know, I wanna see what you can pick up on this. I've been at my job for, it'll be three years in January. I really enjoy it. I'm asking what the spirits can say. I'm thinking about considering hosting for like another position in my, you know, in my company, like a different department. And do you think I should wait till next year or would this be a good move if I decided to? Okay. Which I just leave it alone and like learn a little bit more for the next year. No, okay, thank you for calling and thank you for asking. I like this answer. Definitely, if there is something that is a good bet, post for it, go for it. What the heck, just do it. I do feel like anytime we can go for something that we can bring us a little bit more money or move us up, we should always do it. Yes. I know. And you know, sometimes we just need that switch, especially inside of a company. Now, do not go outside of your company. Stay within your company. So I don't know why they're giving me that message. I don't know, maybe in a month or so, you might have a feeling like, I think it's time for me to look at something else right now for a minimum of six months, stay within your company. I do feel like I don't know if you're gonna get the first posting that you post for, but keep going for inner company postings. I know I'm not saying that correctly and I just want to apologize for- You're wrong. Yes, you are. It's a good company. Thank you. For the last opportunity. Oh, yeah. So anything internal, go for. Anything outside of the company, don't go for. And I do feel like I just wanna explain this a little bit further for you. I feel like someone's gonna come up to you with a, hey, my company or I heard this company, and it's going to be very tempting. Don't be tempted. I feel like whatever you're going to see or hear, whether it be perusing, whatever, it's not gonna be as good as what you have right now. So stay where you are. You will get moved in the company. Even if it's a bit of a lateral move, it will come with a little bit of bumps. So bump in pay, not bumps in the road, like bump in pay and bump in stature. So keep learning, keep moving. You're gonna be happy that you did that, okay? And if you apply for the first posting and you don't get it, don't worry that wasn't the right one. You will get the right one for you. Okay, there you go. That was perfect. No, it took a lot. No, I get it. I don't plan on leaving. I really don't. It's a good company, but thank you for your insight. I just wanted to see what you felt. That's all. Thank you. Oh my goodness. Thank you very much. Yeah, absolutely my pleasure. You are so welcome. And I am so grateful that this was helpful for you. I know it can be always like, and again, just one little last thing. Again, if you don't get the first one or whatever, it's not rejection. They have a listing and the sooner you start to get on that listing, the sooner you can move up, okay? Okay. Excellent. Thank you. You are so welcome.  You are so welcome. And I hope you have an amazing rest of the day and happy holiday. Thank you so much. You have a good day, okay? You too, thank you so much. You were so spot on my last question. It was about three, maybe three months ago I called. Perfect answer. You were so right. Just wanted to give you a confirmation. Thank you. Oh my goodness. Thank you so much. I really appreciate that. Thank you. Thank you so much. Have a good day. You too, thank you. Okay. So Terri, hey, Jennifer. Hey Lolly, hey Jennifer. Happy Thanksgiving, Jennifer. I'm gonna go definitely to 780 now, 780. What's your name? Where are you calling from? Hey, how are you, Jay? For a bit, usually when I'm calling you Monday I have my day off. So that's good for talking to you today. Thank you so much. Well, how can I help you, Jay? Is that like maybe a message from my mother or? Okay, so Jay, the first thing I hear is, and I wish I just would have said it right away, but I hear, stay strong, stay strong, stay strong. There is a relief coming. Not maybe all the relief that you would be hoping for, but there is relief coming. So please stay strong. I do feel like you are going to have some changes come in in approximately a month. In approximately a month, you're gonna have some changes come in. These changes are going to be, sometimes folks, sometimes I hear just a word in my head and I am waiting for the rest before I say it because maybe the word seems so whatever and they're like, just say it, just say it. So I'm just gonna say it. These changes are gonna be critical. Now, and the reason why I didn't wanna say that is because in my head, I'm going critical in what way, but maybe you already know in what way they're going to be critical, but these are gonna be critical life changing, life changing changes that are going to help you move forward. So whatever's coming in next is actually very good for you, is what I'm getting in about a month. It's gonna be very good for you.  Like some burdens have been taken off of you, like some burdens have been taken away. Like you're not carrying everything on your own and almost like I hear the word intercede, interception, like somebody something or somebody's gonna come in and help with, in some way with whatever it is that you've been carrying by yourself. They're going to relieve release or relieve some of this. Yeah, that's what I'm getting for you. And on that, let's do a clearing for you, everybody listening, re-listening. We have let go of our, how about, we have let go of our burdens. I get a no, let's clear that. And then I'm gonna do, we have let go of the past and I definitely get a no, so let's clear that. And again, that is at the 16, approximately the 16 minute mark of the show. And please spend time meditating and spend time. You know, we use the word meditation, just spend time in silence and or prayer or meditation, whatever you personally call it, spend time in that because that's the one way we can strengthen ourselves right now is by being in that space of prayer or meditation of prayer or meditation or reflection. However, whatever we wanna call it and however we wanna look at it. Okay, Jay, I hope this was helpful. I really hope this was helpful. Thank you so much. Thank you, Jay. And I hope you have a beautiful day of today. And thank you so much for calling in. Have a full day and great for people on the whole right now too. Thank you so much, Jay. Thank you. If you would like to call in the numbers eight, four, five, two, seven, seven, nine, one, three, one. Now that's not, if you want a private session, the private session is through my website, www.tonig.info or my business number<PHONE_NUMBER>. I'm going directly to nine, one, seven, nine, one, seven. What's your name and where are you calling from? I'm from New York. Hey, Tim, how are you today? Thanks for taking my call today. Absolutely my pleasure. How can I help you? I'm going to see if there's any words from spirit. I've been doing a helpful part of the energy high and just bad for the sleep, like some abundant sleep. So, you know, I'm trying to pivot from the fear and just allow the abundance of any messages that just suspended me, greatly appreciate it. Okay. So the first thing I'm going to do is for you and everybody watching and or listening, we're going to do, I am clear. I get a no, let's clear that. Our space or home is clear. I get a no, let's clear that. Let's clear that also. And then let's do, I just did this morning. I think I did, nope, I didn't. It's going to be maybe later this week, I'll do this. I am strong. I get a no, let's clear that. And this again, Tim, this is collective, but for you also, my energy is strong. I get a no. Oh, did that hit? Hey everybody, did anybody else just feel that? Oh, okay. We're going to clear that 100% getting that out of the way. Also, we, okay. So those are the clearings. Now, whenever somebody talks about abundance, I always say when you're manifesting the very, very exact. And I'm going to tell you, when I have manifested or prayed and I was extremely exact, what I was extremely exact about 100% came through. If I'm vague about it, it takes a little bit longer. So when we're manifesting abundance, abundance is a catch-all. So if you want money, say money, wealth and the amount and go incrementally, we often think people say they want to manifest winning the lottery because they want all the money at once. We forget this isn't the genie's lamp. We don't only get three manifestations, our whole life is manifesting, our whole life is creating. Every single day is one creation after the next, after the next, after the next manifestation. And we're on autopilot, so we don't realize we're manifesting, we're manifesting keeping our job or having clients or doing this, but it's just on autopilot. So if we're not continually upping our manifestations incrementally by small or large steps, then we're going to stay in the same manifestation that we originally created. So in your case, if you're manifesting money and I think everybody should be manifesting money all the time, it's just like food and we need it in this life, it's something we need.  Well, without it, we don't eat, we don't have a place to live. We don't survive just like with oxygen, okay? We need it to live, water, oxygen, food and the money to pay for said things, we need it.  Like play with it, have fun with it, test it, see if it works. Just say, hey, you know what, I want to manifest X amount. Now what amount is for you and what amount I would manifest? They might be completely different things, but I will tell people I've manifested amounts upward of 60,000. I've manifested two brand new vehicles that I tend to have to pay, not even the taxes on. I've manifested a lot of really huge, big, beautiful things. And I've manifested a lot of really little things that were very important to me too. Feel it, know it's possible, believe it's possible and then jump into it, but give exact amounts. Don't leave it up to the universe. Give exact amounts and go from there and watch the beauty that comes in and then play with that. Play with that as though you're making an actual, tangible model of something. Okay, Tim, you are so welcome. I hope you have an amazing rest of the day and thank you so much for calling in. I'm really grateful for that. I am going to say hey to Sal, Patrick. Happy birthday, Patrick. Everybody say happy birthday to Patrick. Hey Heather, so happy you're here with us. I'm trying to keep up with everybody and make sure I say hi to everybody on YouTube. Yeah. Okay, so somebody asked a question. Yeah, Patrick, I hope. If you guys follow Patrick on any of his social media, Patrick is always showing pictures of the food that he's making. I'm just going to say I've never eaten his food, but it looks amazing. Absolutely amazing, but I hope your birthday cake is really good and if you're making it yourself, I absolutely want to see a picture of it. Sal wants to know any info on the U.S. banks. Sal, I think I know what you're asking and as of this moment, steady as she blows is the answer I'm receiving. I've tested this five ways from Sunday to double down on things for myself as much as everybody else. Anytime anybody asks me as of this point, I get the same answer, cash is king. I don't know if or when that's going to change, but we will see, we will see. That is a really good question though. Thank you so much for asking that. Hey everybody, if you are on YouTube or any other social media and you're enjoying the content, please do like and share. We're going to keep going. I'm going to go to the very next caller, 2-0-1. If you would like to call in and ask a question, the number is<PHONE_NUMBER>. Okay, 8-2-0-1. How can I help you? Hi, I'm Estonia. How are you? I'm doing well. Thank you so much for asking. What's your name and where you calling from? My name is Jackie. I'm calling from New Jersey. Hey Jackie, how can I help you today? Yes, I'm trying to see if I could communicate really specifically with my dad. There's some things that I want to put in order that I know who you want me to do. And I just need some guidance to get it done because things are kind of straining me financially and dealing with other family members who are not really on board. I just want to see if I could get a connection with either him or my mother's but I know my father gets right to the point. Okay, so your dad is here. So what would be the one question you would want to ask your dad? Get the work done and at least have some cooperation. Yeah, okay, so the answer I'm getting is, okay, here's what I'm going to tell you that I'm hearing. So please do what you will with this. Those things are not going to fit together. Okay, so you can move in the house and try to get the work done but nobody's going to cooperate. You can try to get the work done and still you're going to have a lot of difficulty getting the work done, okay? Everybody's on different pages and I just see like 20 hands out, like palms up hands out. I think nobody is agreeing with what needs to be done or should be done. Some people think if you get in the house you're never going to get out of the house. They don't want this to take any longer than they feel it should take. I'm hearing as is. Some of the people involved might be thinking just let it go as is. You're just basically depending on how, where you personally are with everything and whomever is written as in charge is basically just either, if there's one person like a trustee or the power of whatever they're just going to have to make decisions and not give a happy who-who what anybody else thinks or cares about and they're just going to have to move forward and do things. Or they're going to have to take a vote and only give two choices. Choice A and choice B because everybody is all over the board wanting different things in different ways. Thank you everybody so much for calling in, listening in, watching in, taking your time and spending it with us. Thank you so much. If you think this was something you enjoyed and you would like to see it again if you're on YouTube or any other blog, podcast or radio station please like and hit that subscribe or follow button. I love each and every one of you so, so, so much, so much. I will be back Wednesday at noon for another 16 minutes. Happy birthday again Patrick and until Wednesday have an absolutely amazing rest of the day.


So let's look at loose connective tissue or sometimes it's called areolar connective tissue and think about its structure and its function. So loose connective tissue as we said earlier is very loosely put together and its general function is to bind structures together. It's found beneath the skin, it's often found connecting one tissue to the next, it's found between different groups of muscle. So loose connective tissue is found in many places throughout the body and it binds structures, tissues together. Let's look at its structure. So I'm going to use the blue dots to represent fibroblast. So fibroblast are the cells that secrete the matrix. So what these fibroblasts will do is they will secrete fibres into this liquid ground substance. So the thin black fibres are the elastic fibres. And earlier we said that the elastic fibres are made out of a protein called elastin and if they have a force applied to them they'll stretch but when you let them go they'll recoil. And the recoil part is important. There are some things that you can stretch and let it go and it won't recoil. For example if I had a piece of chewing gum and I pulled it out and let it go it would just say stay stretched out it wouldn't recoil. So elastic fibres recoil and that helps to give this tissue a lot of its important characteristics. The other thing that the fibroblasts secrete are collagenous fibres and the collagenous fibres are the tough fibres and they're much thicker and they're made of a substance called collagen. So all these fibres are suspended in this liquid ground substance.  And that's because those collagenous fibres in there are very tough and they help hold it all together but at the same time the elastic fibres give you that elastic nature and allows that tissue to stretch to some extent. So loose connective tissue contains both collagenous fibres that make it very tough but at the same time it has an elastic quality that allows it to stretch and recoil. So what we want to do next is look at a micrograph of loose connective tissue and you can see the very structures that we just attempted to draw on this micrograph. For example here is a fibrocyte at this point the fibres have already been secreted so we'll call them fibrocytes and I'm just sort of filling some of these in with the marker. So we have fibrocytes scattered throughout and see the fibrocytes are separated from one another. And then you see we have these elastic fibres and these are just the thin black lines that I'm tracing here. Here are some elastic fibres and then the collagenous fibres are the thicker fibres that we see interspersed through here. And so they're the ones that look sort of like this. So loose connective tissue binds structures together. It's found between muscles. It's found under the skin. It's found in the digestive system just deep to the mucosa. It actually is the major portion of a layer called the submucosa. It's a very good tissue because it has an elastic quality but it's also quite tough.