Aloha, welcome. I'm Sharon Thomas Yarbrough and today we are going to celebrate in honor, Jerry land, our beloved queen, Jerry lands Bay Area media legend social activist educator and author. Our beloved Jerry land, one of the first African American journalists and television top show host in the San Francisco area, passed away peacefully on April 10 2021 from natural causes at 96. Despite several physical challenges, Jerry remain positive and powerful force and continued to share her wisdom and experiences with her vast circle of friends, family and admiring. Jerry is divided by her two sons. James Cohen, a print media businessman and Ted land, a playwright and actor best known for his stellar performance on Isaac. As Isaac on the television series, the love boat. Along with Ted two sons Jerry's grandson TV for and Turner Ted for and Turner Jerry George response, the late Michael ledge a playwright after a professor in heaven. Jerry was an award winning journalist who from 1969 to 1979 post a community based television shows in the Bay Area. And where she became the first black woman to host a national talk show turnabout and where she serve on the board Jerry interviewed so many television legends rock cousin Maya Angelou Sammy Davis junior and so many, many more. It's her passion to empower people, especially young black Americans, and I am so thrilled to have a group here from the Bay Area who they're going to talk about the Jerry ledge experience. Welcome to city power. Thank you Sharon. You know, I'm going to start with you Barbara, you know we were speaking earlier. You are the founder and executive director. Well, that's, that is the deep but I'm going to start with Barbara because last year, you were. I met Juliana Richardson and she is the founding executive director at the history makers. Now you have received numerous honors for your community service and your life was added to the National archive of African American oral histories being collected by the history makers. Congratulations and welcome. Thank you, thank you. I was so honored when they called me and said they wanted to add my story. And then year before last they said we notice very nicely done like a engraved look like a wedding invitation, but it was really to say that I had been chosen as one of the biographies that would be permanently housed in the Library of Congress. I started to cry, because you know I grew up very poor in Tennessee during segregation and I just wished that my parents were still alive to see that their little girl was going to be permanently housed in the Library of Congress in Washington DC is one of those kinds of things that you just don't expect is ever going to happen when you're growing up the way I grew up. I think when I met Jerry I saw that same kind of spirit in her. I did not ever get to see her when she was doing her regular programs because she finished in 79 and that's when I came to the Bay Area in 1979 to work for the CBS station KPX TV. So I met her out and about in the community where she was all the time, but I really met her sons before I met her and didn't link the two until much later. But she was always so much fun to meet out and about because she was so energetic, you know, and I knew she was older than I was but I didn't know how much older, because she had the same level of energy. It was hard to tell she was sort of one of those ageless women, you know, you really never went when she died and I, and they said she was 96 I was really shocked because I didn't actually know she was that she was 96. I was kind of thinking she was 80 something. And so, you know, it was just it was just wonderful to meet her and to talk with her. She had had so many interesting experiences and knew so many interesting people and it traveled and I am really one of those people who loves to travel so we had a lot in common. Oh, good. Did you feel that there were some similarities between Jerry's life and yours. Oh yes. In addition to what I was saying about how I grew up and then never quite expecting that that was where I was going to wind up in the Library of Congress. One of the other similarities was that I recognized about her very early on, is that she was a risk taker, and she wasn't afraid to confront to speak as as Barbara and it's congresswoman Barbara Lisa likes to say, speak truth to power. And, and she also was a visionary. You know she sort of saw things ahead. And when I was very young when Robert Kennedy was running for president of the United States and he used that quote you know some people see things as they are and say why I see things as they could be at ask why that really resonated with me I think I was in ninth grade when that happened ninth or 10th grade. And I always sort of was like that to where I looked ahead. When we were in ninth grade we had to do career scrapbooks. And at that time I did not know I was going to get to go to college because my parents had no money to send me to college. So I did my career scrapbook on becoming a secretary which is what I thought I was going to do because I would be able to take typing and shorthand in high school. But it was interesting on my mother had saved everything and I didn't even remember I had done this but on the front page of my career book. I was only 14. I found a quote in a magazine that said what man has done man can do, and these days so can women too. So I was a feminist before I even knew the word. I mean, just that amazing that that spoke to me at age 14. That quote, and I put it on the very first page of the book so you know you never know what's what lies ahead I mean I had no idea the life I was going to be living 50 years later, but that quote said something about what was in my head even before I knew what to call it. Thank you. Thank you. Yeah we're here celebrating Jerry at black woman's life in the media. And I'm going to come to you D, you know founder and executive director of the land a foundation widely known for providing low income. You know, with students with school supplies during the year, your organization supplies during your organization provided over at 98,000 school supply bags to children in youth that's and that is awesome. Thank you for that. Thank you. Thank you. And thank you for having me on the show. I'm just so in awe. When I got the call from Carmen and just been waiting to hear what we were going to do about our dear Jerry. And she said well here's an opportunity for us to come together and just speak some of her truth and just how amazing she was and the fact that when she first met me. She just took to me, and she wanted to know who I was and for me I was just D Johnson graduated from the climate high school that's all. And, but she saw something in me and she just encouraged me and I just will never forget her. She's amazing woman I was just reading and part of an anthology that she did. And it talked about I know it had to be probably 2015 or so maybe 2016, and she talks about how we could make the change in the world. If we have time I'd like to read a little bit of that. Okay, we're going to make so powerful. Yes, we're going to make time, because you know, Jerry was such an instrumental woman when it comes to organizations that give back. She came out here and helped me with the Hawaii Valentine's Day for veterans, and she was my speaker and the veterans were just. They were told me about that too. I want to ask you D. What do you remember most about Jerry. Her passion, her energy as they all say and her loving to dance and live and love life and she often talked about making sure when you're speaking speak positive, put out the positive keep out the negative. If you keep the positive going then that's when the positive things will continue to be in your life. And if people put out love that will just take care of everything. Wow, you know, and she lived on a street named Alice, and that was my mother's name. I just fell in love with her all over again.  She sent me that Jerry is on that mural. Oh my God, that is just such an honor, an honor for that. So comment, I'm going to come to you again thank you for putting this panel together. You know you're a public relations consulted and document design specialist who worked with many large corporations and organizations. You help to design programs in beautiful documents from Jerry lens for many special events. Perfect, perfect. I love doing events. So I want to know from you, Carmen.  Just like everybody said Jerry inspired me with her level of energy. I used to tell friends that this beautiful woman would run circles around a 40 year old, you know, that she had such a wealth of information and experiences. Not Jerry, I was at the black history event KPI X this was 2011 person Michael brought me over and she was sitting there with her book, Jerry, a black woman's life in the media. And that was inspirational right there. But as I got to talking with her. It just kind of felt like we had known each other forever. And I thought maybe I was like a really special person because I was having this connection with her. And then I actually came to find out that Jerry has this type of connection, or had this type of connection with pretty much everybody that came into her circle. She was just a very loving, brilliant woman who just love to share her information. One of the things that stood out for me about Jerry is that she had had some really hard knocks in her life. She had a few job opportunities that just kind of went south did not pan out. She never let that discourage her. She just kept herself together. And it seemed as if when one job didn't work, the phone rang for Jerry miraculously and there was another opportunity, even better than the last one. And that just was really something that it stuck to me because I had similar experiences out there in corporate America and corporate Japan where things were just not panning out in the way that I had hoped maybe they would but then there was another opportunity that was better. And so Jerry and I connected in that way. Yeah, that's Jerry. Yeah. Here's a passionate. He was so generous with her wisdom in Roy. Yes. And the area mobile DJ and historian. Yes, over 30 years of experience has also worked on a variety of special celebratory events for Jerry.  Music is she love to dance. Yes, she did. Well, your relationship involved with Jerry. Well, like my wife, Carmen was saying, we met Jerry first at, at a black history event at Channel five API X and that was the first time that we had met Jerry, and just, you know, a vibrant person just a presence to behold I mean you know when you were in her she made everyone feel special. You know she just had that, that way about her. And I can recall. I think it was probably a couple months after we had known Jerry. I used to work for Caltrans transportation department here in the Bay Area, and I retired three years ago, and we used to do a yearly black history month program so we asked Jerry if she would mind being our guest speaker. For one of the events and, one, behold, she accepted she said yes I would love that. And she was just amazing I mean she was so good and, and just, you know just had the audience mesmerized with with her stories and things that she shared that they wanted her back the next year. That's how good she was so she came back again the next year and just did it again so just an amazing person and just someone that you know we just just through the love so much and you know she just had that motherly instinct and she was just a very special person. Yeah, I Jerry was here years ago, and I didn't show that she was a guest speaker. Women was wisdom speak and that was just awesome they wanted her back here and there you your friend Dr Barbara cannon. Also a company with the governor's wife Lynn why hey hey yeah you want her back to come back to you. And what will you remember most about Jerry. One of the things that really sort of fascinated me and I hadn't noticed it much until I was reading more about her background after she died. And whenever she encountered something new. She would talk about how it changed her life, and it really at first when I saw that you know I thought well a lot of people say that, but she was, she meant that literally. She meant that she would make changes in her life based on new information that she brought in, and she was keeping that learning going for a whole lifetime. And one of the last public appearances she did when she talked about the fact that she was thinking about becoming a professional photographer, after she had come back from Japan with all these photographs, and I, and like I said I didn't know her exact age until she died but I'm assuming now that I know she was 96 that she was probably 92 when she made that statement that she was getting ready to become a professional photographer. I love that though, because the society, especially for women and especially for black women, tries to put us into little boxes, where they want us to stay forever and as I said earlier, you know, my parents had no money to send me to college I went to college for a scholarship, but I didn't know that early on so there were the options that were available to me without a college education as a black girl in Tennessee during segregation, made. I was aspiring to be a secretary, that was a high goal because I did not know any black woman in Knoxville Tennessee who was a secretary to anybody, and I thought, maybe I can learn to type and take shorthand and I can be a secretary, but really made a super, you know, there really weren't that many options if you did not have a college education on, you know, even a high school education sometimes you couldn't get much. So, I looked at her and I thought, isn't it wonderful that she can come out of that box that they put us in, especially the one that they put us in for age, and she can say, I'm going to become a professional photographer at the age of 92. I mean, you know, and to have that as a goal whether she did it or not is not the most important thing, but to think in those terms, and to work and live your life in those terms that anything you do and she talked about you know how, when she got a chance to go to college that's one thing that I really identified with she didn't know that she was going to get to go at first and she said how education changed her life, and meeting certain people that she talked to changed her life. Every time she'd have a change she'd add something new that just enhanced her life and I that's what I'll remember most about her. You know, Jerry was so generous with her wisdom. This is what I admired about her and she was just, as my husband said school is never out. It's so deep.  We first had our conversation at an event. She just really took to me and she asked me, What are you doing and I told her about Linda hand. And then I also told I was trying to write this book she said what do you mean you're trying to write it.  And she said I'm putting it down I think I'm in my second year of putting it down she said oh no you have to write you have to tell your story. And I don't care how many times I would say well Jerry I don't know where to start she said that's okay meet me at my house on out of the street. And I'm going to show you what to do. I got there she had some music for me and Carmen you're going to have to help me with the gentleman's name. Yeah, Andre gone y'all. Thank you. And she said I want you to take this home. And I want you to listen to this relax get in a quiet place and trust me, you're going to write. And I did that. And I was amazed. And I was my quiet time. And the music just really so like it just touched my soul. And I just started writing, and I wrote and she edited and I wrote and she edited and we would that went on for pretty good while, until I became a what a finished product. She was there for the book signing. And she was just such a joy so much wisdom encouragement. I don't care because trust me, I kept putting it down. Because it was a lot to tell, and you know, growing up, poverty, just all the challenges that I have faced. So every time I start writing I'd have to relive those times. And she kept saying just keep pushing. Just keep pushing is going to be okay because this is what God wants you to do. So that's, that's it. Yeah. Yes. What would you like people to know about the important work that Jerry. You know, I would like them to know that Jerry worked for everyone. She didn't go out and do a job to earn money. Jerry didn't do a job, because it was prestigious Jerry did a job because she had like D said a story to tell. And she had a vision for what life could be like like Barbara said what life could be like for people. She basically just kind of let the world know that she was there to create a purpose to create a drive to create a force for people. Her work was all about peace, really about bringing peace to the world about inspiring women especially to know that they have power that they are great that you're beautiful no matter who you are, and that you're intelligent and that there is so much to do to learn Jerry used to say in her in her work that if you're bored with what you're doing then you're obviously a boring person because there's just too much out there there there's just so many things that we can be involved in. So one of the things that I think that was most important about Jerry's work is how she loved people how she brought people together how she wanted to share her friends, you know, lots of times people want to hold their friends for themselves and you can't be a friend of that person because that's my friend, but these lovely ladies here are friends of mine because of Jerry, and so many more so her work was all about peace about integrity and passion commitment. She strived for not perfection, but for realistic improvement of lives, and she just has touched me.  And as our sister part views, you know, a note we're all wearing Jerry's favorite color red, you know, she had a heart of gold, always giving and boy, I'm going to come to you, and I'm going to ask you what are the most important lessons you learned from Jerry. Wow, that's a very, very interesting and deep question but I'd have to say, number one would be value, value yourself or who you are, and, you know, treating others the way you want to be treated. Those were two big things that I think that, you know, I really picked up and learned from Jerry, and, you know, just moving forward in life, those are values that you just have to carry it. And, you know, learning those from someone as powerful as she was and all the things that she went through in her life, those to me were very, very valuable lessons and so I think that, you know, I will use those and pass those along just as she passed them to me. So, you know, I'm loving this and I just, we don't have enough time, we're going to have to do a part two and three. Yes. But thank you, Carmen, Roy, Barbara and D for your wisdom. In closing, I want to leave everyone with something very special that Jerry put in her book here, the magic of the power and magic and imagination of media. In closing, Jerry Land will leave you with this. Dare to dream. Having dream, fulfill that dream at all costs. For without a dream, you cannot move one inch. With it, you can reach the star. Thank you for sharing Thomas Yarbrough. Thank you for tuning in alone.


The following is a presentation of TFNN. Boost every business day. Tom takes your phone calls toll free at 1-877-927-6648 internationally at<PHONE_NUMBER>. Oh, look at that. What's a beautiful thing? Look at that man. Jim from Minneapolis. We were taken by storm. Taken by storm, baby. I love that. That's a great saying, man. Hey, what's happening, brother? Good morning, gentlemen. How you guys doing today? Good, man, yourself? Oh, man. It's been the most incredible couple of days since when I called in on Friday, Litecoin busted out of that consolidation on the two-hour chart. Okay. And it just never looked back. It did a 100-point ABC up, and now it's very extended the way I look at it. But, holy mo- I mean, it went up to $420 last night. Now, Tom O'Brien. Oh, welcome, folks. This is Tom O'Brien of TFNN. We have five days a week. We go 10 hours a day. We go 24 hours a day on the internet at tfnn.com. Always remember, folks, whatever you think about, you bring about whatever you focus on grows. Hope everyone's having a great day, safe day. It's making a great night, folks. Always do your best, but don't overdo. When you overdo, you deplete your body, and you go against yourself, and it will take longer to accomplish your goals. Knock it off! Let's take a look at it out here. We had the Dow Industries finish down 122. NASDAQ off 12. S&P's down 6.5. Not a bad day, folks, for the amount of points that we had been down. That being said, you know, we finished down 3 tenths of a percent in the S&P, one tenth in the NASDAQ, and four tenths in the Dow Industries. Now, we were down about double those numbers intraday. That being said, guess what? The market's having a tough time catching a bid topside, because you have many of these sectors that you just have selling in, including the transports, the SMHs. The oil, in particular, is a big number. Gold contract. Gold contract down $11.90, trading at 12.72 an ounce. We had oil, we had the gold contract. Tested swing low of last week, $11.12, $67.90. It rejected it, had some volume. So coming into Friday, I expect we're going to have some volatility still in that metal market, because we've had lower prices and it's pretty hard to turn that around on a Friday. We have the jobs numbers, $8.30 in the morning. That is going to move markets. No two ways about that. Oil, oil broke with volume, with conviction. It had wide price spread, accelerated volume. Oil's down $2, trading $61.61. Oil looks like it wants to try to get into this $58 area. If we have the type of volume that we had out here today, oil can go a lot lower. Notes and bonds. You get the 10-year note down 11 ticks, $123.07, 30-year down $16 at $147.03. Let's go take a look at the 10-year. So we take a look at this 10-year out here. You're back with 1.5 million contracts. I think we're going into 1.7, 1.89 actually. So you're still coming down. You have an expansion of volume, but yet it is lighter volume than we've come down on. So bottom line is that it looks to me like this can get down into $123.03. We hit $123.05, and more than likely when the jobs number comes out, you'll get some big action in that 10-year. 30-year. We take a look at the 30-year. What do we have with the 30-year out here? 30-year. See, this is strong, man. 30-year down 15 ticks, $260,000 contracts. We're coming into $300,000, I think, $357,000, I think. $347,000, $348,000. Yeah, that's saying that this still wants higher price. Now it's going to be pretty cool. I've had Chris Crawford on before, folks. He's from Fairway, a mortgage, independent mortgage. He's going to be coming on a quarter-past, a 20-past fall. We're going to be talking about interest rates. We're going to be talking about mortgages. So it's a pretty cool time to have them on because the 10-year, we're still trading out at 2.54. And of course, what we have had happen in the last six months is that those rates have gone down dramatically compared to what most of us thought where they were going to go. Kingdala, up $186,000, trading $97,590,000. If we go over to Kingdala and we take a look at Kingdala right here, what you're going to see is that Kingdala's trying to get back outside of the top of the consolidation. Now he did 14,000 contracts. That's pretty good contract volume out here. So I suspect it looks to me like Kingdala's going to at least get to that $97,705 number. That's the number when it broke out of its consolidation last week. Pull back inside it. Bottom line, drive's number is going to probably have it get back up there at least test it in the morning. This has been an action-packed week. There's no two ways about it. Euro, yours trading at 111. Now, as we ex-numbers after the close here, we get a lot of them. Expedia, the low for the year is $108, the high is $139. Now this closed at 128. This is trading right now, $122. So let's see what they have to say. Okay, so numbers go like this. The estimate had been, first quarter revenue estimate was 2.69 billion. They did 2.46. So that's a big loss, man. That's a big number. Yeah, they expected to lose money, too. This is interesting. So they were expecting to lose $0.37. They had lost $0.35. Man, how is Expedia losing money? I'm just curious whether this is a one-time deal or they've been losing money all the time. No, this is a one-time deal. Interesting. Well, I see.  Last quarter, last year, first quarter, they lost $0.46. Then they make it up the next three quarters. That's kind of intriguing how that works. Sugar Shack, Sugar Shack. Oh, my God. I love it. Sugar Shack, that brings me back a while. That was a great song. The Shake Shack. Shake Shack closed at $62.91. This is the burger place. Bottom line is that right now, what are we trading at? Let's take a look here. This is trading at $66. So you get that baby up $4. And numbers go like this. The same-store sales. The estimate had been going up one-tenth to one percent. We're going up 3.6. So that's a good number, man. That's a big, big number. No doubt about it. Let's see what this stock is. This stock's getting crushed after the close. Astro Networks. Okay. This is cloud computing. Well, this is a high flyer, too, man. So this closed at $310. This is trading at $268. You talk about a hammer and holy cow. This is one hammering. Look at this, though. Last time with volume. Oh, my God. $268. You got to see this, folks. If you want to just... This price and volume. You want to see something. $268. This is a classic, man. I got to take a picture of this. So if you ever booked the out-of-time in the trade, folks, you know it's all about price, volume, where it is. This is a classic, though. $310. Last time with volume. Look at this. $268. Where is it right now? It goes from $310. Sick. The $267.   But bottom line, I found out over the course of years, that's where they go, folks.  And as soon as they get cracked, guess what? You go right back to the last place with volume. And if this comes down with volume, then you're going to get a destroyed stock for a good period of time, until it can basically rebuild, build some cars to build those floors. Stay right there, folks. Come right back with our man, Mr. Chris Crawford. We'll be talking mortgages.


From Hollywood, it's time now for Johnny Dulling. This is the operator at the Explorer's Club. Oh, good. Have you been able to... Sorry, Mr. Dull. Well, hasn't he been there at all? He was there any calls then. Since you first telephoned, he hasn't been back. Well, do you know when he will be back? No. All right, then leave a message. I'll meet him there at the club. Is it... It's important that I keep him from being murdered. And every weekday night, Bob Bailey in the transcribed adventures of the man with the action-packed expense account, America's fabulous freelance insurance investigator... Yours truly, Johnny Dollar. From Special Investigator Johnny Dollar to Inter-Allied Life Insurance Company, Crutchfield Square, Hartford, Connecticut. Assignment? The Curse of Konoshek matter. Expense account continued. Item 6, $9.80, trained in New York, quick lunch and taxi to the Traders Bank and Trust Company. There, I picked up the American Express Traveller's checks that Eric Turnbull had left in my name, had left for expense money to take me to Egypt to make sure his nephew Donald Cronin lives safely through an expedition to open the grave of the ancient Pharaoh Konoshek. The bank teller's brief remark gave me something to think about. I'll sign, Mr. Donald. Yep. Yes, now let me check the amount for you just once more. All right. 1,000, 2,000, 3,000, 3,500, 4, 45, 47, 48, and $5,000 each. Here you are. Good. Thanks. And as I'm sure Mr. Turnbull knows, this will close out this particular account completely. I thought about that remark a little later when it began to tie in with some other learned. Right now, item 780 cents care fair to the explorer's club. Donald had not yet returned, so I left another message for him, asking him to sit tight until he heard from me. And I meant sit tight. Because apparently after the latest argument with his uncle Eric, he was quite likely to hop off to Egypt on short notice. This I didn't want. As a matter of fact, at this point, I wasn't sure I approved of his expedition at all.  And each accused the other of plotting his murder. I was about to leave the explorer's club when I was buttonholed by a short, kind of cute looking old character in gray striped suit, tatters all vests, spats, believe it or not, and all but a monocle. I say there old man. Yes. If you'll pardon me, I believe I overheard you inquiring at the desk for Donald Cronin, didn't I? Oh yes, do you know him? I most certainly do. But excuse me, I'm Percival Thronhurst Scatterday. Mr. Scatterday, I'm Johnny Dolan. Oh yes, yes, yes, Donald. I told him that he'd met you at his home. Tell me, do you plan to accompany him on the expedition to Thebes? Well, yes. Excellent, excellent. It should result, you know, in one of the most important archaeological finds of the century. Think of it. The Tomb of Kamashek. Yes. Do you know where Donald is now? Treasures, artifacts, and that should put to shame the ones that were excavated from the Tomb of Tutankhamen. Yes, I'm sure of it. But now... If history has told us the truth about Kamashek, 18th dynasty, I believe. That I wouldn't know. But now, Mr. Scatterday, it's important that I reach Donald Kroner just as soon as... No, no, no, no, now that I think of it, Kamashek was twelfth dynasty. Mr. Scatterday, if... But he couldn't be, because that was the era... Oh yes, yes, I remember now. It was the 18th, the same period in which the great temple of Queen Hatshepsut was erected at Daya El-Bahari at Thebes, of course. You've seen that, of course. No, I haven't. More magnificent and thralling. Now look here, sir. But now, Mr. Dolan... I'd like to reach Donald Kroner, so if you'll excuse me... Mr. Dolan, please, you say you are going with Donald. You do know about the curts of Kamashek, or do you? Yes, yes, I've heard of it. Oh, then you'll certainly arrange not to be present at the opening of the sarcophagus. Why? Well, as I'm certain you know, all the preliminary work has been accomplished by the advance party, of course. So I understand. The anti-chamber of the tomb was opened over a month ago. So? Well, it simply means that as soon as Donald arrives, they will penetrate to the sepulchral chamber and the sarcophagus itself. Well... Mr. Dolan, it was engraved on the stone slab, barring the way to the last chamber, Mantak Kofore El, and so on. Oh, it's not supposed to be. The warning, my boy. The warning that whosoever violates the tomb and desecrate the body of the noble Pharaoh by contact therewith shall quickly die. You don't believe in those things, do you? Mr. Dolan... As I always understood it, those warnings were just put there to discourage thieves from robbing those old tombs. Mr. Dolan, I only ask that you remember what happened to those who violated the tomb of Tutankhamer. Oh, well, couldn't the deaths of the people who entered that tomb be due simply to coincidence or other things, circumstances quite apart from their having done so? Of course, of course they could, but were they? Mr. Dolan, I assure you that if it were not for the warning of the curse of Kamashek, I would be the first to want to enter that tomb. Instead, I have refused to go on the expedition at all. Take care of Donald. Well, that's what I'm being hired to do. And of yourself, sir? Yeah, sure. Now, sorry, but I'm anxious to reach Donald and you say you've seen him here at the club? Yes, only last evening. He was here making some of his final preparations. Oh, do you know where he is now? Yes. Well, where? At his uncle's place in Stamford, Connecticut. You're sure? As sure as I am, but you've not heeded my warning about the curse of Kamashek, but I beg you, Mr. Dolan, for the welfare of Donald, Cronin, and yourself. Yeah, sure. Thanks. If this were a mystery story, instead of an accounting of expenditures on a case, I'd tank Percy Scatterday as a prime suspect for whatever might happen later, like the man who tries to throw you off his own trail by suggesting that somebody else is gunning for you. But I decided he was just an old foggy who'd been turned down on the Kamashek expedition was trying to justify his own shortcomings with the tales about the curse. But you know something? I was wrong. I should have listened to him a little longer. Item eight, 75 cents, taxi to the office of Harrison and Dilman and Co. to see David Wilt, the man Eric Turnbull had named as his stockbroker. The reason? The remark the bank teller had made about closing out an account as it turned out my timing was perfect.  I'll be with you just as soon as I finish this phone call. Oh, sure, thanks. Hello. I'm sorry to have kept you waiting, but someone just stepped into my office. If you'd rather be left alone, I'd rather be left alone. I'm sorry to have kept you waiting, I'd rather be left alone. No, it's all right. Now, as I started to say, if you dispose of the gold metal mining stock, your holdings will be reduced to practically nothing. Yes. Yes, that's right. Yes, but Mr. Turnbull... Look, you're sure you wouldn't rather I come back another time. Very well, very well. It's just that I hate to see what was once a very strong investment program. Very well, Mr. Turnbull, if you insist. Turnbull. Yes, yes. Goodbye. Now, sir. Eric Turnbull? Mr. Wilt? Yes, but... Now, just a minute, sir. It was very remiss of me to mention a client's name in front of you, at least under the circumstances. Whatever I may have said on the phone just now was quite confidential. Yeah, I'm sure it was. I can only ask that you discreetly forget anything you may have heard. Not by a long shot. What's this? Who are you, sir? Dollar, I believe, the receptionist said. That's right, Johnny Dollar, insurance investigator. And that conversation told me just what I came here to try to charm you into telling me. Mr. Dollar, please remember this. That was entirely confidential. None of your business. Yeah, my credentials. Yeah? Well... Now, you remember something. So far as Eric Turnbull is concerned, my coming here is entirely confidential. None of his business. Goodbye, Mr. Wilt. So the wealthy Eric Turnbull wasn't so wealthy after all. Big investments in the stock market, he'd said. But they didn't look so big anymore. And the closing out of bank accounts. I had a $9.30 phone call to Dorothy Harkness. Yes, Mr. Dollar. I just called to tell you, Dorothy, that if it'll be any satisfaction to you, I'm going to make the trip to Egypt. Oh, Uncle. Oh, gal, that sounds like a line out of an old melodrama. I know you don't like. You know something? I'm beginning to feel a little that way, too. I can't seem to find him. Do you know where he is? Have you tried the explorers? No, not there. Really? Well, if he does happen, get in touch with me. Where, Mr. Dollar? Right now, I'm going out to Eric Turnbull's house. After that, I'll be back in Hartford. Item 10, $7.00, even train fare back to Stanford and taxi to the Turnbull residence in the hope that there I would find Donald Cronin, the real principal in this case, and the one person I hadn't yet talked to. But it was Eric Turnbull who met me at the door. Mr. Dollar, I'm glad to see you. Come in, come in. Have you seen my nephew, Donald? Well, no. Isn't he here? No. Or is he at the explorers' club? I've called them several times. I'm worried about him and his present frame of mind... I'm worried about him too, Mr. Turnbull, but not for the same reason. Because of that girl, Dorothy Hartness, here, sir. No, that isn't what I meant. In his present frame of mind, he's likely to jump off on his flight to Egypt without... Look here, I wonder if he's with her. No, that much I do know. Oh, I wish to heaven he would call if anything happens to him. If anything happens to him, you'd love it, wouldn't you? What? What did you say?  What do you mean? In a case as involved as this, it's necessary to check all the angles, everything, every one, even the man who hires you. Has that girl been poisoning your mind against me too? Your banker, from whom I picked up the American Express checks, let it slip that your account is in pretty bad shape. Non-existent now, as a matter of fact. Go on, Mr. Donald.  All right, tie that in with the fact that if anything does happen to Donald, you'll come into his estate. You've said enough. But it's true, isn't it? You laid so much stress on Dorothy and the museum getting his 100,000 life insurance, but you're the one who would really benefit by his death. Donald, you have talked with one banker, with one stockbroker. Why, in your snooping around, didn't you talk with the others who hold my accounts? Like who? Like, that's none of your business. But if what you are implying were true, why in heaven's name would I ever ask you to come in and protect my nephew? As a cover-up? I should knock you down with my bare fists and believe me, my boy, I could do it. Now listen to me. I am listening. If I didn't have any money, how could I afford to give you the 5,000 and expense money, pay whatever other costs may be involved in your employment? And why do you suppose, in spite of this high-handed attitude of yours, I'm still begging you to stay on this case? See, Donald, Mr. Donald, talk with him. You'll find that in spite of the angry scene between us, I'm concerned only with his welfare, that I want to protect him, that I want you to protect him. Wait, wait, that's Donald. Now, let me take it. Well, now, just a minute. Oh, Mr. Dollar, I was calling Mr. Turnbull. Mr. Scannady? Yes, at the explorers' club. Mr. Dollar, I've just talked to a couple of fellow members who saw him off. Saw him? Donald Cronin? Yes, last night. His plane has probably reached Cairo by now. Fooled all of us, didn't he? Yeah. Thanks. Well, I thought you'd want to... Well? Donald left for Egypt last night. Oh, no. Oh, yes. Then please, please, I beg of you, go. In Heaven's name, go to it. Stay with it. Protect him. For a long moment, Eric Turnbull simply stood there, sobbing, pleading with his tear-filled eyes. And suddenly, I don't know why, I found that I believed him. I wish now that he'd been lying. Two lives might have been saved. Now here's our star to tell you about tomorrow's episode of This Week's Story. Tomorrow, a flight into darkness, and when day has come, there's blood on the desert sands. Join us, won't you? Yours truly, Johnny Dollar. Today, Johnny Dollar, starring Bob Bailey, is transcribed in Hollywood. It is produced and directed by Jack Johnstone, who also wrote This Week's Story. Be sure to join us tomorrow night, same time and station for the next exciting episode of yours truly, Johnny Dollar. Roy Rowan speaking.


As Thanksgiving nears its way into homes this season, one thing you may want to consider is some safe hygiene practices before preparing that turkey this year. Wednesday we spoke with Pike County health director, Tammy Riley, about some of these practices and how you can implement them into your home. But for today I want to talk about the four C's. The CDC has really broken it down into four simple steps and you just got to remember the four C's. So the first step is clean. So remember, you know, of course wash your hands thoroughly, 20 seconds or longer. But another really important tip around clean or cleaning is do not rinse your turkey. Many individuals, you know, just well meaning want to rinse that turkey and clean it out in the sink area usually. But we highly recommend that you not do that, that's just spreading contamination. So if you cook your turkey to the right temperature, which we're going to talk about in a minute. That takes care of any potential bacteria.  The second step regarding cross-contamination Riley says to keep vegetables and meats separate when preparing and cooking turkey based on poundage. And what we recommend you use a meat thermometer and make sure that the internal temperature of the turkey gets to 165 degrees. And then finally you want to chill or put your food items, don't leave them out for an extended amount of time, typically less than an hour and don't stack items in the refrigerator. So what you don't want to do, what you want to avoid is putting like heated items up against other food items like a mayonnaise based product or a salad that has mayonnaise and if you stack like a hot turkey that's going to remain hot for a good amount of time as it's chilling in the refrigerator. Reasons why not to stack cool and hot items is due to bacterial growth. Riley also says to make sure food items aren't left out for more than an hour. So just remember the four C's. So you want to clean, you want to avoid cross-contamination, cook the right amount of time up to the right temperature and chill appropriately. For more information regarding Thanksgiving safety you can visit cdc.gov keyword holiday. For Mountain Top News, I'm Joel Korgel.


What do you think chair?  He's not dead. He's not dead He's dead. Oh my god. I thought he wasn't dead. I thought he wasn't dead, dude. Oh Wait he bubbled dude.  I think Dude this power went oom without even getting burned.  I got this field and push. I'm gonna press death as well. I was so close It's dead actually. That was a good game.  I would be an insane dude. Playing shadow with this gear. Yeah. Oh, that's an unfortunate rep. You can also dispel me, brother Press it. You're next to me The dispel. Nope. Surely the other me won't see us me shield this boy. This guy's a bot man. I swear this image


I've downloaded one of the craziest mods for Dragon Ball Z, Budokai Tengai G3, and I've done it all so that Goku and Vegeta can finally fight at their full manga power. As you can see here, when we look at Goku, we have every single form available to him in the entire manga.  But even if you have, you definitely don't remember all of this, even if you've just seen the anime. Yeah, we're talking manga-level powers here, some light spoilers even. As for Vegeta, it's more of the same, only he only has one panel, he's got God, Blue, Evolution, and Ultra Ego. Anyway, I just wanted to see him fight, so we're gonna start with a match in base form, then take it up to Gods, and then see these two in their max form. Here we go, after their last match was cut off, what is this new UI? Alright, their last match was cut off of roughly, this is Z-level difficulty CPUs. Anything can happen now. Nice block from Goku, and a grab attempt, but Vegeta not gonna allow it! The Keyblast kid and Vegeta's in control this time! A CLASH! CPUs fighting for the life, Vegeta was the clear winner. Was that a whole bar worth of damage? What was that? That had to be a visual bug, 8-Noshia. Meteor combination from downtown! Goku takes him right back to where it was all started. Looking like Piccolo right now. Damn! Bit of a chip damage here, Goku is definitely not in the lead. Goku has two blue bars. Another meteor combination, Vegeta not gonna let it go down without a clash! By God, Vegeta just in control of the match! Oh, Goku with the weave back! He's not gonna get hit by that obvious stuff! I don't think Vegeta cares though, he was just kinda laying him out for real. Cross shot! Down on his luck! Oh, okay, hit what you can't see! Will anybody transform into a Super Saiyan this fight? We've seen the original! Vegeta just seems dominant in control, he's not letting Goku do whatever he wants! Goku weaves a few of the attacks. Super explosive wave, how does he... He doesn't answer with anything, Vegeta has a huge lead! Goku's clothes are all torn up, wild sense! Not gonna be enough! Another clash, Vegeta just winning by about a million! I'm pretty sure Vegeta's the only one on the new difficulty. I'm gonna be honest, it looks like Vegeta's stakes just move a little faster than Goku's. Super Saiyan! He's decided to kick it up a notch! Damn! Goku's decided to kick it up to Super Saiyan, but is it even close? He dodges back. He didn't respond at all! Vegeta with the wide open, oh no! It's pretty much over for Goku here. Goku doesn't manage to dodge an attack. Steps up, dodges back, super energy wave volley! He's in bit of damage, he's gonna kick it up to Super Saiyan 2! Goku for the first time in his life is trying! He's finally trying! He might stand a bit of a chance against Vegeta, but he's only got a little bit of time left. Vegeta not wanting to be outdone also kicks it up at level. Here he comes! He could end Goku right here with Big Bang Attack! Goku has failed in the first fight, he's lost to Vegeta, even with Super Saiyan 2. But now, we're back and for this match, we're kicking it up to the God level. We're on Planet Beerus now for the God level fight between Goku and Vegeta. All in! And it's time to go all in. Oh, our contestants know what's on the table! Oh, a strong open! Vegeta opting to go for a Gallant Gun! Takes half of Goku's first life bar and one foul swoop! Goku is pissed about it though, very clearly. Vegeta another strong opener. Goku tries to go for the drop kick, Vegeta not playing around. Behind the back, Goku, 9 hits, not able to make it 10. He loves that drop kick move, he lands it this time! Strong combo starter! Divine Kamiyamiya! Looks a lot like a normal Kamiyamiya, I have to give a link.  It's hard to see how many health bars they have when they're layered green. Here we go, it's a transmission, he's blind! Prominence Flash! Goku says no, he's not gonna allow that to happen. Vegeta stops it! Anime! What an encounter Goku loses! Not gonna let Vegeta get Saiyan Soul off! Oh! Strong opener! Goku is down two health bars though. Is this right side favoritism? Anime! Goku wins it! I'm not sensing any favoritism anymore. He's gonna kick it up to blue! He gets by Vegeta and goes blue! But he got too concerned with the color of his hair and missed the combo. Vegeta with power. Another anime, another anime moment. Goku's on his last health bar though. He'd have to hit, land a lot of attacks if he's gonna hope to win. Vegeta's triggered a Saiyan Soul. Goku with his back turned to Vegeta, it's pretty much over. It's pretty much over Vegeta! With a Prominence Flash, could put him away! He does! My God! If the CPUs are no favoritism, this is getting bad. Alright! UI Goku, Omen versus Vegeta Blue Evolution. Here we go! The matchup in their final forms on this game before we get to manga level power. Vegeta Blue Evolution versus Omen UI. A godly display, Vegeta can't block the speed. A huge amount of damage. Actually respectable, only 6k. I thought he was losing two health bars for that. Goku charging up Vegeta! Get countered! He's gonna lose the flash! Oh my God, he got rocked! Goku running up. Vegeta with a display of ki blast. Damn! UI Goku just flipped him! Goku, Omen, but he still got the speed. Damn! Damn! Damn! Another godly display, it's over. UI Goku, Omen clearly right side favoritism, playing a huge side here. Also just a different beast, not the same one. Charges up in full control. Backflip in the final flash, but what a dodge! That'll get a health bar for sure. Could Vegeta fight back against the right side favoritism? Not when he catches supreme coming out of the odds. Big charge up here. UI Goku opting to just stand still. He actually did dodge a considerable amount of ki blast. Damn! Damn! Why you gotta do it to him like that? Here comes the clash! Yeah, the right side favoritism actually does kick in hella heavy on the sticks. I don't know if it's supposed to be that far apart, but this wasn't even... Wait. Nope, this wasn't even a match. Damn! Watch out for GD! He's right behind you! Wild tense. Damn! Ha ha! Unreal. Well, we're gonna switch over to the manga level powers now. All right, we're back with manga level powers. This time let's kick it up to UI. I'm doing it. I'm doing it. UI versus Ultra Ego. Here we go! The final battle with the modded Goku and Vegeta so they can fight at their full manga accurate power levels. Perfected UI Goku versus Ultra Ego Vegeta. Don't mind that noise. I don't know what that noise was. They're off! Getting space from one another on the Cell Games arena. Goku opting to charge. Vegeta not gonna let that slide. Damn! Oh! He's too quick! Has the manga advanced too far past Ultra Ego Vegeta? No! He's gonna respond with a headbutt of his own. Gigantic ki blast from Goku. Vegeta dodges. But the guard is too good. UI Goku has a clear health bar lead on the first one. Vegeta teleports behind him at full power. Vegeta blinks! What is he even doing? My God! What's Vegeta going for? Whoa! Ultra Ego Vegeta! With a Kai version of Hitom attack? What's even happening? He's out of this world. Kamehameha but with a full cutscene activity. Divine power! Goku's achieved his full level. He has access to his ultimate. A burst combo even. Will he go for any of them? Ultra Ego! Both fighting at their max strength now. Damn! Ultra Ego Vegeta is a different beast! What is that? Super bomb to Divine? If Goku wins this, it's over! He might do it again! He's coming! Goku dodges! Docks him down to the ground. Another clash! It's a heated combination. Goku almost had the Spirit Bomb. The Divine Spirit Bomb. I don't even know what he was going for. He's charging back at Vegeta! Vegeta goes with another clash! It's another clash of the Titans! A battle that I can barely keep my hands on. Full power of Vegeta again. He teleports. Oh my god, Goku's... What's happening? Vegeta!  It takes an easy two bars! Destroys the earth as well. Could Vegeta have turned to his evil ways? It's gone! You and Goku's lost him! He found him just in the barely... Just barely in time. I will say Goku's going to need a miracle comeback at this stage. Vegeta's just beaten him down far. Too much divine power. Could Goku try to land his ultimate one more time? Not just Vegeta's elbow. My god, could he be going for the burst combo? Vegeta just can't seem to block! Kamehameha! The Key Blast making combo! Vegeta's in three bars! Goku staging a bit of a comeback here! Goku can't be hit! Could this be a Zenkai boost? Vegeta trying to fall, but there's nowhere to go! Goku back steps with nowhere to go. Full power of Kai! Goku gets behind him, but Vegeta blocks the Key Blast from behind with no vision? What an anime clash! If Goku gets hit by this, it's over! He barely manages to dodge! Ultra ego that means he has access to full key! Divine power! Goku has access to full key! It's gonna come down to who can land their ultimate. Vegeta's going for the burst combo! Goku finds a place to block! Misses attack! Dodges the cut! If Goku can't break away from this, it's over! Another clash! Barely in the nick of time! Goku loses though! Vegeta tries to follow up! Goku's playing safe! He gets something off! But it doesn't go wild since! It's over! Vegeta wins with two bars! But I will say... Goku didn't tap into his final form, so just for funsies! We're gonna see a what if! What if Goku tapped into the full power of Ultra Instinct? He never called upon it in the match! But could we be looking at something different here? The perfected Ultra Instinct! Suceno Edition! Could Vegeta have stood up to this? Damn, he's still throwing hands! Vegeta's still not afraid! Even with the newfound power, it's not enough! In fact, the cameraman just can't keep up! That's the only difference of the fight! Maybe it's for the best Goku didn't tap into this form! He seems sluggish! Bro, he's fighting at two FPS! And he missed! Damn! The Suceno is just too slow! It was never meant to be used like this! I don't know if Goku can deflect that! But he does dodge it! Even in his giant Suceno form, he's pretty quick on his feet! What's he going for? No shot, I don't even know what this thing's ultimate is!  Vegeta grabbed his big-ass leg! He's doing something! What is this? Vegeta managed to stop it! He lands the grab! Oh, my God!  Back step and a calm anime out with one hand! That was sick!  And he dodges the technique as well! Clearly, there are some benefits to Goku's Suceno form, even if he is slow as all hell! Can he be going for his ultimate? Again, I don't know what it is! And it doesn't look like we're ever going to find out! Damn, the Suceno was too strong! Well, that's going to be the match! Goku vs Vegeta full manga powers! Let me know if you want to see this again, but maybe a best of three format, and maybe in the tournament. I think that could be fun!


Hey everyone welcome back to another undead world hero survival episode I'm excited today because we have a new event for the game unless you didn't see the announcement You're not gonna notice this one, but here it is. So it is called live and let pie So ignore the number two because I'm actually right now in my Phase two I'm in phase two already. That is why it's live and let pie to the objective of this one is to Go towards phase 30. Okay, that's the main objective because The rewards there are unbelievable. So you have to we'll talk about what are the best best rewards for this event as you can see here There are actually a couple of missions where you need to Get this currency this this leaf currency here So in your missions, you'll be rewarded specific number of currency Depending on the missions that you clear. So you have your daily missions. Then you have your main mission This is going to be your missions So you have here Raging rumble novice arena. Yeah doable guild raid five times clear Midtown two times and accept 20 radio missions in this one. I'd like to do this one guys So that we could open some pie or eat some pie. Okay, so I have a couple of Gems here. Let's do one recruits see how I Do because it's a 10 Recruit so more or less you'll have to it's Murray. Yes I need him. I need him. So let's skip this one Good pull, but the more important part here is I'm going to be I'm going to have one mission Unlocked so that is 35 again as you as you gain these of these discurrency collect Then you will have to go here so For you to go to the next phase again We have to go to phase five first because that is the next Items that we can unlock So you have to Get this item the one that you were able to select here It has to be opened here Once you open it whether it be the last square or the first square You have the ability to move forward and attain better rewards. So we have eight so that's around five Let's see if I can Can catch that that item So no deal guys Still no open That's it so until I get this one this item then I can move to phase three There's also an option when you get this item if you're going to stay in that You know in in these and finish everything up So it's actually your choice But again once you get that once you get that item that you've selected then you can move to phase Three for mine and for whatever phase you have next so that is it so that is the goal and also for The prizes or the items that will be unlocking So this the first row is definitely the no limit row. The next is your phase five or phase five The better ones here are if you're into Recruitment for a rare hero. This is it. This is two and also this one is your material or This is actually to Reinforcing equipment. It's up to you guys on what you're gonna get there depends on what you need I'm gonna discuss more on let's say phase three. This is more random rare random epic and This material is reinforcing your equipment. You can farm this one. So I suggest you skip this Probably go go for this one for the random epic from a chosen faction This is good for phase 10 Sorry, that was for phase 15 this one. So skip this one. You can farm this one This one is the ticket. This is your Recruiting heroes at the continuity. This is I think your ticket for recruitment So I think I'd get this one if you are in need this is good But again, you can farm this one and For phase 20 you have here This is forgot his name and This one is Lee and this one is of course Murray Yes, who's this guy Henry? Sorry, that's Henry. So for this one It would really depend the last one is going to be Abigail out of the four The best ones here would be Abigail and Murray. I think Actually, I'm sure Lee is also good as a healer and Henry But again, these two particularly Murray and Abigail are going to be all around especially if you're new to the game These two are the best ones to start off with for phase 25. This is going to be a supply box for your weapon and This is the faction ticket That is farmable. So If I were you I would get this one the faction ticket because a faction tickets are actually good Because if you want someone for a specific faction or yeah specific faction, this would be good Especially when you've you know complete you you've saved up 10 already Okay, that's for 25 for phase 30. You have four This is the face wherein you would want to reach so you have here first and foremost. This is cookie New hero good. Very very good. If you're collegium Next is this guy is who's this guy that a we guy for hive forgot his name Back off this guy Not really not Not really in the over your overall use. Okay, so I'm basing my picks here for overall use The best here is going to be cookie Next is going to be Bella Bella is Good if you're concentrating in PvP and if you are if you want blue banshees, I forgot their name is there So Sam This is Sam should I just found Bella's name and the other one if you need a healer the deem is definitely a good pick So if you just you know, you don't you're not you're not particular with any faction the best here to get is going to be in a deem and Cookie for being overall the next would be Bella, but she's focused more on PvP and the last would be Sam That is it guys. Those are the items that you need to look for Depending on your situation, but again for the best case scenarios I've already given my suggestions and that is it So hopefully hopefully you could actually play this every day and clear this out This one is very valuable because this also gives us an epic epic hero Which we actually need copies of so that's it guys. So happy pie eating Okay guys, so thank you very much for staying this far in this video and also don't forget to Subscribe if you haven't subscribed yet. Don't forget to click the bell icon so don't miss any Undead world hero survival episodes and also guys, please put a like to this video if you find this informative. Thank you Very much. Take care. Stay safe. This is the warden and I'm out of here


So thank you. So I'm trouble Hudson and I'm going to be talking about Thunderstrike 2 which is a firmware vulnerability Or a set of firmware vulnerabilities on Macbooks You might have seen it in the press as you know the first firmware worm that affects Macs that it's you know super stealthy and backdoors them That it remains after reformatting and it can be remotely installed and it is undetectable and it can't be removed There's a lot of hyperbole in these sort of press reports But it is true that firmware malware once it's installed is very hard to detect very hard to remove And that's because it installs in the SPI flash on the motherboard also called the boot ROM and on most systems the SPI flash is really the root of trust. This is where all of Everything in the security of the boot process depends on the sanctity of the boot flash and Because this boot flash contains literally the first instruction the CPU executes when it starts up It's possible to circumvent any other software mechanism that attempts to ensure security So one other really important part about this talk is that Thunderstrike 2 is not a new vulnerability It's actually built on five previously disclosed multi-year-old UEFI firmware vulnerabilities that along with collaborators Corey Kallenberg and Zino Kova, we are able to port from commodity PCs to Mac systems And that is the real key point of this talk is that UEFI firmware vulnerabilities are Shared between these different systems because they share so much in common You might think that your shiny Macbook has nothing in common with some run-in-the-mill commodity desktop PC It has a different motherboard. It has different OS. It runs You know pretty much everything is different But under the covers they look very very similar that when you disassemble it We see the same sort of code paths. We see the same functions being called We seem the same vulnerability is appearing even though they're built with different compilers different optimization and frequently very different versions there's still a lot of commonality and The commonality goes back to the earliest days of the PC IBM's 16-bit real-mode BIOS in the early 80s was cloned by Phoenix and then everyone else Reverse engineered and cloned that one in 95 Intel started the extensible firmware interface project to try to support new CPUs bigger memory fancier hard drives and things and In the early 2000s when Apple switched over to the the Intel CPUs they Forked Intel's EFI standard and use that for their systems few years later Intel Transferred all ownership of EFI to the unified EFI forum and that's why it's called you EFI now and The forum has continued development adding a lot of features secure boot and other things and They continue development on this We can see that on Christmas Day there were commits being made to their code tree Some of these are security related you know a suspicious null pointer D reference Could be a security vulnerability So even after Ten years or so of divergence There's still millions of lines of code shared between Apple's EFI and the more recent UEFI firmware What most firmware vendors do is very similar to what Apple has done They fork the open-source tree at whatever version it is they kind of freeze at that head They port it to hardware platforms and they sell these packaged firmwares so when Intel fixes or excuse me when when the The EFI forum fixes bugs in the edk2 tree That doesn't mean that all the vendors have actually done a git pull and and and patched And even if they have fixed it on their new motherboards They haven't necessarily fixed it on their decades of legacy systems and even if they've Shipped a firmware update. There's no guarantee that users install it. Most people don't install firmware And this is an area where Apple has actually really excelled that they are actively pushing firmware updates for systems going back almost ten years When firmware security vulnerabilities are disclosed to them So that's enough of the history lesson Let's talk a little more about Thunderstrike 2 as I mentioned It's built on five previously disclosed multi-year old firmware vulnerabilities. These have been All the details have been published going back 2014 2013 some of them as late as I mean as early as 2007 This first one the speed racer was presented last year here at 31c3 by Cori Kallenberg and It is a hardware race condition that allows in a multi-threaded or Multi-core CPU Allows a second core to get right access to the BIOS And the reason for this goes back to again, you know legacy hardware The Intel Interface control hub was designed for a single threaded system. There is the BIOS write-enable bit that Prevents accidental rights to the firmware unless you're in ring zero There's the BIOS lock-enable bit that allows SMM to arbitrate writes The to arbitrate the BIOS write-enable bit when the bit is when the write-enable bit is set to one and SMI is generated SMM gets a chance to decide whether to allow it and if it doesn't want to allow it. It sets the bit back to zero But that leaves a race condition where the second thread Has BIOS write enabled enabled turned on for a few cycles and they can keep trying and trying to write to it Intel actually realized this was a problem in 2004 when they migrated to the platform controller hub and they added a third protection bit the SMM BIOS write protect disable in which all threads have to be in SMM in order to be able to write to the firmware So on a correctly configured system the write access to the firmware is controlled First by the protected range registers and then by the SMM BWP bit and then by the BIOS lock-enable bit Corey and his collaborators went through responsible disclosure and Disclosed all the details to cert and most of the firmware vendors were affected because they had not updated To use all of these hardware protection measures that the that Intel was providing Apple specifically said however that they were not affected So we wanted to find out if that was actually the case Going back to the data sheet we can read the BIOS control register, which is at offset DC in the In the hub and we can use a tool like a read memory, which is a open-source tool that lets you Read arbitrary physical memory on OS 10 and what we find is that it has the value of 8 and that means that Neither the BIOS write protect bit nor the BIOS lock-enable bit are set This is you know is not the recommended configuration and it turns out that a OS resident attacker is able to write a One to the BIOS write enable bit and now they can write to the BIOS They can't write to the entire BIOS because of the protected range registers But it does mean that they can write in Arbitrarily into the NV RAM variables. They can also write to any region. That's not protected by the protected range registers and If you corrupt with the that portion of the of the firmware it actually bricks the machine so that it is unable to boot We went through again disclosure with Apple and they rolled out a fix and it goes all the way back to 10 6 8 Which was released in? 2008 so that's almost eight years of Systems that are that are now protected and because Apple does the automatic rollout they these systems For the most part have been updated and are now protected One problem is that the fix was was just by changing the protected range register Which means that the SMM BIOS write protect is still not set And the BIOS write enable bit is still vulnerable to an OS resident attacker So only the protected range registers are preventing rights Which brings us to our second vulnerability the Darth Phenomus or dark Jedi coma attack also presented publicly for the first time last year at CCC by Rufal and some collaborators What they realized is that when the system goes into a S3 suspend to ram sleep All of the flash protection bits get unlocked and when the system comes out of sleep There's a brief race window that allows an attacker to have right access to the firmware As always they went through responsible disclosure and It turns out that Apple had was not contacted by cert regarding this, but they were informed through us RT to understand how to take advantage of this vulnerability we have to go back to the the boot script specification which Describes how the system How EFI goes through a normal boot and then when it resumes during a normal boot the system probes for connected devices looks to see what's out there and it writes a sort of a cheat sheet of memory addresses and and configuration registers into this this boot script and Then on a resume it just runs through the script right into those same addresses Not everything can be expressed in just a simple right So there's a dispatch opcode that gives you the ability to put in a function pointer So again, we can use the the read memory tool to read out the boot script which is actually the pointer to it is stored in a invi-ram variable and When we parse it we see a bunch of those memory writes and this right down here is the one that writes into the protected range registers and the flock down bit to to lock them, but that occurs too late in the boot script We've already had a dispatch to a function and because the boot script lives in unprotected memory we can Use the right mem tool to poke our own function pointer in there And then when the system goes into sleep, which is a user a user command The system wakes back up and those protected range registers are no longer protected which allows the OS resident attacker to write pretty much anywhere in the firmware for the the CPU which again It allows it to take control of the machine from that first instruction and circumvent any other chain of trust We again went through responsible disclosure with Apple and they In their notes said that a insufficient locking issue existed and it was addressed through improved locking So very brief commit log there There's an additional Sleep vulnerability that we didn't see but was also fixed in that patch OS X reverser also watched the CCC talk last year and Experimented on recreated it on his Mac book what he found was actually much worse that the the s3 implementation Left the flash protection completely unlocked after a suspend resume cycle As you might imagine, that's a bad thing And it turns out this is a rediscovery of a 2013 vulnerability called Snorlax In which Dell systems failed to properly set write protection after resuming from sleep And that was a team at MITRE that found that the reason that That we didn't see it in our tests is that Our slightly newer Mac books had a different Intel chip set and at some point there had been a silent fix that the either Intel rolled out a Improved reference implementation for that hardware or Apple fixed it But it meant that new machines were not vulnerable to this this issue but older machines were and No one publicly knew which were which There's a similar silent fix that happened with the the brand new Mac books the ones with the USB C Only that it appears to be using something like SMM lockbox, so they're not vulnerable to To the boot script hijacking So as I mentioned Apple addressed the both the Darth of Anonymous and the Snorlax or Prince Harming vulnerabilities through improved locking what they did is moved the The code that sets the the lock bits and the protective range registers to before the S3 script is executed But the S3 script is still in unprotected memory and available for an OS resident attacker to hijack They can't use it to Directly turn off the flash protection But there are other interesting interesting things that this lets you do prior to the OS kernel starting up Possibly get into SMM. I'm still looking into that So One you know with with the easy routes to get in the flash unlocked sort of taken care of There's one time when the flash is deliberately unlocked and that's during a firmware update so Corey Kallenberg Found a class of integer overflow bugs that he was able to write a scanner for that searched through lots of different firmwares and he found a That a lot of these vulnerabilities occurred When the flash was in a entirely unlocked state meaning during a firmware update one of the machines that he showed this on was a HP laptop and What's happening is that the The link there in the descriptor buffer is user controlled So it's possible to generate an integer overflow in that length, which then gives him good execution While it is parsing a firmware update so this is this is being run with the flash unlocked and Gives him full write access This affected so many systems that he won the pony award for best privilege at escalation at black hat earlier this year I As always Responsible disclosures really important and as you see almost everyone's affected except Apple Apple Claimed that because they don't use the standard UEFI firmware update routine They're not vulnerable to this to this attack Because they have their own firmware update routine if you're interested in that The Thunder strike one talk that I gave last year at CCC goes into Extensive detail about how how Apple does their firmware updates The problem comes that everything in UEFI is done via function pointers and these 128 bit GUIDs So when you want to call a function You pass in this GUID and it looks it up on a table and then returns a function pointer to you Which means that the linker can't Remove a lot of dead code because there's a reference to it in this in this dispatch table so the the vulnerable Firmware capsule update routine Turns out is present in Apple's ROM so even though Apple doesn't use this for for their firmware updates the code is still there and Through what what Cori and Zeno called BIOS necromancy They were able to generate a set of inputs that caused that code to get executed So, you know again two very different laptops But they share very similar code in that in that vulnerable routine Obviously they've been built with different compilers and different optimization levels, but you can see that the That integer overflow is still there as the result of Our work improving that and exclusion to Apple they have updated their status with cert and now a year after it was publicly announced they've they've admitted that they are affected and they have rolled out a fix The particular vulnerabilities actually kind of a very neat Wanted to look into that You know unused functions Can contain these vulnerabilities Legacy functions can contain these vulnerabilities and it becomes really important that when Code is being audited that both the new code and this legacy code Gets reviewed and gets updated So going back to another legacy feature one That goes back again to the 1980s so with the original IBM PC the BIOS at that time would Look on the motherboard to these expansion ROM sockets to see if any optional features were installed Things like the basic interpreter a hard drive controller It would also look on the expansion bus to see if any cards were installed like a video card so that it's able to Display the the boot messages as the BIOS starts up Unfortunately, this code is run in the BIOS in ring zero before the kernel and that's really a bad idea for security John Heisman in 2007 showed how this could be used to get persistence on On servers with certain network cards snare in 2012 showed how Thunderbolt is actually PCIE and it loads option ROMs off PCIE My talk at last year at CCC showed how you could use an option ROM to During a firmware update to get code execution with the unlocked ROM and then earlier this year as you know, and I presented a class of vulnerabilities at defcon Related to all these five that have been fixed Following CC's the disclosure at CCC Apple rolled out a fix that Partially addressed the Thunderstrike one issue what they changed is that the system no longer loads option ROMs during firmware updates, which Prevents Thunderstrike from getting code execution During during a firmware update, but it still gives you a way to get persistence and code running on the system There was a follow-on update a little bit later due to a rollback vulnerability And even with this patch applied as I mentioned you get code execution during the boot So if you have a Thunderbolt adapter, these Thunderbolt Ethernet adapters are super popular for this sort of research It runs before the kernel starts and it's able to log keystrokes such as the firmware and Fileval password there It also gives you a way to get persistence. So if you get a remote shell on a system You can map all of our physical memory look for PCIe devices Write your code into the option ROM on it and the next time the system boots that code is going to run This is almost as good persistence as the SPI flash It doesn't necessarily give you The ability to circumvent all of the root of trust because option ROMs are loaded much later in the boot process But it still is a very dangerous thing to to let happen Earlier today Johanna Votosko presented Something showing how much writable state there is in the system and it's really scary. How many things have writable firmware blobs You know your fancy Thunderbolt monitor has an option ROM in it Your SSD might have an option ROM in it So Intel realized this was a huge problem and For the secure boot process they required that option ROMs be signed Unfortunately, Apple has not updated to a version of the system Updated to a version of UEFI that supports secure boot. So this is not an option on on Apple systems It's also not an option if your system doesn't support secure boot and If someone gets the ability to write to the firmware flash on the motherboard secure boot won't do anything for you So But the key point is these are all cross-platform Vulnerabilities that were found on commodity PCs and we were able to port over to the To the Mac platform You know, most of them are patched at this point by Apple I've heard that the new iMacs and some of the newer systems are no longer loading option ROMs, which I think is great and Usb-c doesn't have option ROMs yet, but maybe Thunderbolt 3 will bring option ROMs to usb-c. We'll see so You know all these vulnerabilities are They're interesting. I'm glad we've got them fixed But it was really fun to package them together into a proof of concept demo. So let's let's see How could this all come together? So unlike last year It actually can start with a Just a like a software exploit. Maybe a software download or a Adobe flash Sandbox escape or something that then can escalate to root with whatever the root exploit of the day is And once it has root it can install a kernel module to let it go walk through physical memory if the system is subject to Prince Harman, it's able to immediately write malware into the motherboard boot flash It can also then search the PCIe Space for devices with option ROMs and write itself into them and in this case the you know It found a thunderbolt ethernet adapter. So I go ahead and flag that that one's infected and Now the next time the system reboots the Thunderstrike 2 proof of concept is going to be run from the motherboard boot flash It's not trying to be stealthy or anything like that. So it displays big splash screen and logo and Because this runs before the OS 10 kernel has started it can do pretty much arbitrary things It can get into SMM. It can hide in virtualization. It has you know total control of the system at this point if you Reinstall OS 10 it's still there you swap out the hard drive. It's still there Because it's you know, it's literally in the motherboard so you know if we put the infected system aside and But we and plug that infected adapter into a clean system When this one boots It loads the option ROM off the off the Thunderbolt adapter This is a newer laptop that is not subject to Prince Harman So it can't directly write to the flash, but it can use Darth Phenomus to hook the s3 boot script And I don't if you can see it also reports my firmware password on there And then the system continues to boot normally When the system goes into an s3 sleep such as when the lid is closed the CPUs are going to shut down and You don't have to open the machine I've just done that to show that the the fans have turned off the CPUs are completely powered down when the system wakes back up the The s3 script is executed prior to the boot flash being locked So it's able to write itself into The boot flash on the motherboard and again, I just flag it so I know which ones I've infected for cleanup afterwards So from the perspective of the the user of the system it took just a couple extra seconds for it to come out of that sleep mode But you're nothing out of the ordinary So in the next time this system reboots. It's going to also display the the boot screen Logo, so we've now you possibly You know infected another machine via this sort of viral transmission And what's interesting is this didn't touch the the OS at all. This was completely At a level below the operating system One of the other things that Thunderstrike 2 proof of concept does is it watches for the PCIe hot plug event? So when a when a clean adapter is plugged in it detects that The interrupt handler writes the option ROM to the device so this allows it to potentially spread and potentially cross air gap security measures and so if you have a Uranium centrifuge plant that you're trying to get into this might be one of those ways to do it so The proof of concept is showing a really neat sort of lifecycle for this kind of malware going from You know software exploit that's able to escalate into the bootflash or the option ROM Hook s3 get into SMM and then go on and infect other machines in the bootflash And once it's in that sort of bootflash option ROM kind of space It's completely underneath the OS so most by virus scanners aren't even looking for it And probably couldn't even see it because they have the ability to trap all of those memory references and hide from Normal scanning techniques Pretty much the only way you could see if it's in the bootflash would be to put a chip clip on the on the All in the SPI flash there and read it out and hope that nothing's interfering with that Any attempt to do in software is going to be masked by the by them the proof of concept so Johanna presented a lot of ideas about things we could do to Deal with the inevitably inevitability of root kits and firmware issues You know attempts to try to move it outside the system, but there are a lot of smaller steps We can take as well Things like checking the signatures on the option ROMs or not even loading option ROMs is a really big first step Using all of the locks that the platform provides You know is really key Making sure that the BIOS is not writable to OS residents attackers making sure that they can't hook the S3 boot script to get into SMM You know Intel has added features to UEFI like the SMM lockbox that allow the S3 boot script to be protected from attackers and there are tools like chip sec and Copernicus that can help validate these configurations to make sure that the systems are being booted and run in a safe manner Intel is also continuing some hardware attempts some of their newer CPUs have a feature called boot guard and This adds actual ROM for the first instructions the CPU executes Which is sufficient to do a cryptographic Verification of the boot flash before executing any code out of it This is great for security, but unfortunately this locks out free software developers. So systems with boot guard are not are fundamentally incompatible with with core boot and There's that's a really difficult move for for software freedom even if it does provide a good level of protection and my plea to system vendors is that when new vulnerabilities are disclosed that To really work with researchers to try to figure out if they're vulnerable I write a lot of proof of concepts and they're really difficult to get working on one machine much less a range of machines So sometimes vendors take the proof concept. They run it on their system. It doesn't work and they say oh, we're not vulnerable and there's really not any Risk to them for doing that So, you know, it would be great if vendors were more proactive and working with researchers on Helping to port these things and find that out The legacy code, you know as Corey found there's a lot of code dead code in EFI that may have vulnerabilities and even if You think that your system is not running it. It might be possible with a set of inputs to to get the code to jump into it It's super important to test the full cross cross product of old vulnerabilities and Systems that things like Snorlax being an old vulnerability that reappeared a few years later It's actually really kind of scary. You know that there was we learned about a really serious bug and Systems got fixed and then new systems got produced that were still vulnerable to that old to that old bug that that's a problem likewise new vulnerabilities Might a lot of times they don't necessarily get tested against order systems. So we don't know what Machines are actually vulnerable other than the current generation of machines and You know, please if you are in an opportunity to to fix security vulnerabilities Don't just do it silently make sure that people know, you know, these are the CVEs that are being patched against these are the things that that are being changed and what Systems will actually be secure against because when we're in the dark with this. It's really dangerous. We don't know if we're going to You know just because my machine is two years old and you've got a newer machine. It's dangerous for for For us to not have that certainty so On that I love to open up for some questions There's a lot more details about the vulnerabilities on my website. I'm also happy to take a GPG emails and You know continue the discussion on these firmware topics Thank you Not for you guys, but for the people out there in the stream So we're gonna do a little question talk And we'll do one question from the room one question From the web and then again a question from the room. So are there any questions out there? Yep Mike three, please Yes Have you seen actual? SPI flash erase commands going to your flash chips or how how is it actually managed on the background? with different SPI flash chips Are you asking Does the OS periodically do erases of some sort? Well, how the because to write to flash You also have to erase flash first before you can write to it, right? That's right So for things like the the in VRAM variables and this There's a related question of why does Apple leave the flash writeable and they store in view the non-volatile variables in in the flash So things like what is your screen brightness? What it was the last Wi-Fi network and credentials that you logged into are stored in the in the in VRAM and It's stored in a In a log a pin structure So you can add items to it and then they can set individual bits to mark To tombstone old values and once they fill up a block then they They will do a full erase rewrite cycle, but typically they just do A pinned and then a tombstone marking Okay, and do we have a question from the internet? Is there anybody out there? Yeah. Yeah, go ahead How is boot guard related or different to the trusted platform module? So the trusted platform module is unfortunately not It assumes that the SPI flash is protected that the trust in platform module is outside the CPU so and it only Signs or it only generates hashes based on what the CPU has asked it to do so if you have malware that has taken over the SPI flash it is able to Send whatever values it wants to the TPM that the TPM can't look at memory The TPM can't look at the state of the CPU the TPM only hashes. What's given to it? So boot guard moves the trust inside the CPU so it's no longer having to go to this outside device and Because boot guard doesn't even start executing code from the flash until it verifies it. This means that A malicious attempt to modify the flash will be detected or will be Detected on the next boot You know for sure I don't remember if they have the sort of soft fail versus hard fail in the boot guard implementation but yet the TPM unfortunately was a An interesting idea, but there's probably a dozen or two dozen papers on how to defeat it and get around it in different ways Okay, the next question from Mike three I I Have had my own share was Reporting bucks to Apple and getting some feedback and making sure that they actually fixed it the way that I thought it should be fixed or but I see that You seem to have that in a repetitive pattern that they thought they fixed it. They didn't Consult with you and they released the fix and then you found out. Oh, no, it didn't work. Is that kind of I mean Is I would expect that this is such a sensitive area where what where Apple would really want to have a dialogue with you Did that never happen or was it miscommunication? On some of the bugs they there has been a good dialogue and we've had they have sent me betas to test And we've had back and forth occasionally things have been put out before we've had a chance to do that and sometimes Yes, sometimes the dialogue takes takes longer than they want to To wait for the fix although I do have really good hopes They've just Acquired as you know and Corey's company like the core So I'm really hoping that this means that Apple's former security is going to go even better than Then it's been in the past few years One more question from the net No, do you have a tool to check the current state of the MacBook like is if it's vulnerable or not the difficulty the difficulty with ascertaining if the system is currently vulnerable or currently infected is that a A Sufficiently stealthy malware can trap all attempts to read the ROM and read the state of things So if it's been able to infect the system, it's very very difficult to even tell if that's happened tools like chip sec will attempt to tell you if the system is in a vulnerable state and That's one way to say if you with a clean system, you know, you can check to see if it's It whether or not it looks like it's good, but if you've had a system that you think has been infected It's very difficult to say Okay, is there one more question from the net? Otherwise we're gonna call this a baby Okay, there's one more question from the net What platform would you would you recommend to avoid? You if EFI boot systems and which are nearly as compatible to our normal computers Well, you EFI is making its way into the arm world now So I'm not sure if it's possible to avoid UEFI in its entirety The you by itself it that's somewhat of a good thing. It is extensible. It is nice to have a lot of that functionality But it is a huge amount of code in the trusted compute base and you know as Missecurity researchers will tell you that that is problematic But at this point it looks like all the hardware is going to be UEFI in the foreseeable future I do have good hopes for things like bunny's laptop Open-source hardware laptop with entirely open-source firmware Because that at least means that we're not running a bunch of Proprietary binary blobs things like the Intel management engine are you know, certainly You know it's we just don't know anything about what's going on inside of it and what it might be doing so Even if you have secure firmware You've got a binary blob running that might be doing something that you don't want and that's a somewhat of a difficult situation to be in Okay, let's have a final hand for tremel


Dr. Ranjan Shetty, interventional cardiologist in Manipal Hospital, Bagwood. There are no major restrictions. It is like angioplasty. After the procedure is done, if the things go fine, which is likely 95% of the time, patient is relatively normal and comfortable. In 2-3 days, they can go back to their normal physical activity. We have had patients whose pumping capacity has been 30-35% their ejection fraction and post-tabbing in 2 months, it has completely become normal and these elderly people are very happy. They are able to do their own activities. They are able to go around. And what we realize is these are elderly. There is no option of tabi. Most of them do not have any option because surgery is the only option and most elderly do not work under a major cardiac surgery at that age.