Hi everyone, this is Dr. Ruscio and let's discuss a few audience questions. One regarding if a low FODMAP diet can be used to predict if someone has SIBO, small intestinal bacterial overgrowth. And the other, what to do or what does it mean if you have SIBO and you've diagnosed it via a breath test, you treat for SIBO, your symptoms respond but your lab tests don't. So let's start with the first of these questions from Jeff Rothschild. Hey Michael, how are you? I've been enjoying the listener Q&A podcast you've added. It's a nice compliment to the interviews. On that note, I had a question. Please forgive me if you've already answered this in a podcast or video and I'd be happy to be directed somewhere. What I've been wondering is if a low FODMAP diet could be used somewhat diagnostically for SIBO. For example, they complain of bloating when eating certain foods and they go on a low FODMAP diet and all of their symptoms resolve. Is there anything else that could mean? I understand you would want to know if it was SIBO or what type for treatment purposes but if someone can't do a breath test for whatever reasons, does the dietary intervention have any predictive use? Now unofficially, no. Now officially to be able to diagnose SIBO, you need to perform a breath test in order to diagnose it. In my opinion, a low FODMAP diet can be one tool that could suggest someone may have small intestinal bacterial overgrowth. So if someone responds favorably to a low FODMAP diet, that is suggestive that they may have small intestinal bacterial overgrowth because small intestinal bacterial overgrowth and irritable bowel syndrome, IBS, there's definitely a degree of overlap. It might be minimal. It might be fairly large depending on what study that you read but there is an association there and the low FODMAP diet has been shown to be very effective and there's some pretty compelling research for the low FODMAP diet in IBS. So because of those connections, yes, in my opinion unofficially if someone responds favorably to a low FODMAP diet that may be indicative that there is SIBO present and it may indicate that there is a mild case of SIBO. What I suspect is that we'll eventually learn that for mild cases of SIBO, people who go on a low FODMAP diet essentially balance out or eradicate their SIBO because the low FODMAP diet will starve the microbiota, starve the bacteria of substrates that are highly effective at feeding them, which is not a bad thing in my opinion. For example, some studies have shown that a low FODMAP diet can lower inflammation, lower leaky gut, and lower immune activation. So the low FODMAP diet is low in compounds that feed bacteria therefore, starves bacteria therefore my opinion is that the low FODMAP diet will likely address mild cases of SIBO. But also remember that those with IBS, not everyone with IBS is going to have SIBO. But some studies have shown that those with IBS are hypersensitive to gas pressure even though some studies have shown equivalent levels of gas pressure because some gas pressure is normal between those that are healthy and those that have IBS. So they both have comparable levels of gas but those with IBS are hypersensitive to that gas. So they are equivalent gas levels in those IBS may be enough to cause symptoms and what likely happens is the low FODMAP diet decreases that gas pressure and it goes from normal to subnormal and that may be one of the reasons why we see improvements especially with things like abdominal pain and bloating in the IBS trials using a low FODMAP diet. So Jeff, I think the answer is your question and now we'll transition to the next. Okay, into the next question, Sandra asks, I'm curious what you have to say about someone who tests in the severe category of both methane and hydrogen, gets treatment, refaxmen, flagell, alimed, neem, these are pharmaceutical and herbal treatments for SIBO and feels a lot better. Then retests and the test score is still the same as in no change. What is that supposed to mean? By the way, the testing was done at your SIBO clinic in Oregon, Dr. Seebecker. So it was done for the proper protocol. So I'm assuming she's directing this to a post that was both between Dr. Seebecker and myself. Okay, so a few thoughts there. The utility of SIBO breath tests in retesting after treatment has not been fully established and this was outlined in the most up to date consensus report, which is the North American consensus paper on SIBO breath testing. So we don't exactly know how to use a SIBO breath testing or SIBO breath test after someone has been treated and why this is relevant is because you may or as you're describing have elevated gas levels, but be symptom free and that might be okay. It's not to say that everyone who has SIBO via the breath test is going to have a problem and we've reviewed a few cases wherein people have become completely symptom free yet they still have elevated gas levels. Now that might be disconcerting to you, but keep in mind that SIBO is not tied to any mortality, meaning it won't shorten your life, it won't increase your risk of heart disease, of neurodegenerative disease, of what have you. It does have morbidities associated with it, meaning it's inconvenient and the symptoms may cause morbidities, meaning you may not go to work one day if you have a flare of diarrhea, you may withdraw from some social engagements due to food reactivity or due to abdominal cramping or pain, but it doesn't seem to have any mortality associated with it. It might be in the future as we learn more, but because SIBO, at least according to the evidence to date, is only associated with inconvenience in terms of symptoms, then if you have SIBO but you have none of those symptoms, I'm not highly concerned about it. Now finally, you may also have a number of factors present that may be skewing the results of the test. You may have rapid small intestinal transit, which is giving you a false positive. You may have an anatomically short small intestine and actually some Asian populations have shown this that SIBO breath testing may suffer from higher degrees of false positives because anatomically Asians apparently have shorter small intestines than what I'm assuming they're comparing to predominantly being a European population. You may also have colonic overgrowth that may be skewing the test and this may be more so responsible for a prolonged or a flat line type methane presentation, but at the end of the day, I would not be overly concerned because it seems that the SIBO test has the most utility for establishing if someone may be a candidate for SIBO treatments, probiotics, low-fob map diet, antibacterial treatments, and not necessarily something that can be highly utilized in terms of follow-up retesting. And also because if you have SIBO, that doesn't mean you're going to have other factors. For example, if someone has chronically elevated high C-reactive protein that has been correlated as an independent risk factor for heart disease, this type of information you do not have for SIBO. Now, we may have that in the future, but at least to date, we don't have that. So for all those reasons, I would focus predominantly on your symptoms and how you feel, make that the primary barometer. As long as your symptoms are faring well, I wouldn't be overly concerned about a breath test that is remaining positive. Okay, that's it. A few thoughts on the low-fob map diet, SIBO, SIBO testing, retesting, and lack of responsiveness of the test to treatment. And this is Dr. Ruscio, and hopefully this information helps you get healthy and get back to your life. Thanks.


Hi, I'm Marshal Ball and I'm excited to tell you about some new techniques for zero-knowledge. We're developed with Danedoc and Soled, and cool, cool, Carney. So to begin, just a brief reminder about what a zero-knowledge proof is. So we have a prover and a verifier, and the prover is trying to convince the efficient verifier that this statement is true, X is an L. And so they interact and we really need three properties. We need completeness. If the statement is true, then the verifier accepts with high probability. We need soundness, so if the statement is not true, then the verifier will reject with high probability. And this should hold, even if the prover is not behaving as specified, behaving in fact completely arbitrarily, and we want zero-knowledge. So the zero-knowledge says roughly that the verifier only learns the truth of the statement from interacting with the prover and nothing else. And this is captured by this simulation paradigm. So it says that the zero-knowledge holds if there exists a simulator an efficient procedure for generating a transcript which is indistinguishable from the real one, the prover and the verifier seem to be interacting with this truly magical prover. So since zero-knowledge is introduction, we now know a fair amount about sort of complexity. So if one way functions exist, we have zero-knowledge proofs for all of NP. And if they don't, basically we only have zero-knowledge proofs for languages that are trivial on average. And the culmination of this is this work by Ang-Va-Dan that says that we have zero-knowledge for language, even only if the language admits instance-dependent commitments. In this work, we're interested in understanding sort of minimal assumptions for zero-knowledge, but in particular we're interested in situations with very limited interaction and trust actually. So but non-interactive zero-knowledge is sort of set a zero-knowledge proof with as little interaction as possible. So in this setting, the prover is just going to send a single message to the verifier. The verifier isn't going to speak at all. This isn't achievable in the standalone model. So what's typically done is the prover and verifier are given access to some public randomness. So there's two settings that are typically considered. One is what we would call the common random string model or CRS model, where the randomness in the sky can be correlated, need not be uniform bits. And all their model considered typically in the literature is this uniform random string model or URS model where the bits are uniform. And this is better typically understood to be sort of a situation requiring less trust, whereas the correlations in the CRS model might require using developed, need to be generated using an NPC or something like this. Anyways, that's sort of out of the scope of this work. What do we know about these two models? One way, from one way functions, we can construct an NISIC with CRS for NP. This can be extended actually to AM. And in the uniform random string model, we know how to construct NISIC for NP from one way permutations. This can also be extended. We are also interested in sort of relaxations of zero knowledge with limited interaction. So one such notion that has found many applications is this beautiful idea from Twork and Nor called a ZAP. So in a ZAP, we have a prover and a verifier, and a ZAP follows a very specific format. So it's a public coin protocol, and so the verifier sends, it begins by sending a uniformly random message and the prover responds, and that's the end of the interaction. And the difference between what I was describing earlier is that the promise here is weaker than the one of zero knowledge. We just require witness indistinguishability. So what is witness indistinguishability? What we want is that for any two witnesses, W1 and W2, if I run the prover with W1 and let them interact with any efficient verifier, the transcript should be indistinguishable from if I ran the protocol where the prover had witness to. So one thing to note is that if the language has unique witnesses, then this property is trivially satisfiable, and the prover can just send the witness, and it will be indistinguishable. And secondly, if the prover, if we don't constrain the prover at all, then the prover can just find, say, the lexicographically first witness for any statement for the X and just send that. Yeah. So what did Dworkinor show about this notion of his app? They showed that it was equivalent to music in the uniform random string model. And you may look at this slide and you say, why do music is implied by trapdoor permutation? Then you just show it, so it holds from comparatively weaker assumption, one way permutation. And the reason for that is that this transformation critically only applies if the prover is efficient. And the transformation I showed you that was on the previous slide, the prover is inverting a one-way permutation. And so this construction from Feghe-Lapidot and Shamir is inherently inefficient. So what we are interested in this work is can we show a similar transformation from Nizik to Zapp with an inefficient prover? And that is indeed what we do. And so as a consequence, we get Zapps from one-way permutations with inefficient provers, but still non-trivial. And we have a variety of applications, or sort of zero-knowledge type proofs, with very limited interaction, non-interactive witness indistinguishability, one-message zero-knowledge, and a new notion of what we call fine-grained zero-knowledge. And I'll say more about that at the end of this talk. For now, I just want to focus on this arrow across the middle, this transformation from Nizik to Zapp. And in particular, what I'd like to show is this theorem. So what does this say? So if a language L has a Nizik in the uniform random string model and a t-time prover, then the language has a Zapp with a polyn times t prover. There's a corollary from this. Immediately, we get using this Lapidot Shamir protocol, we get Zapps with sub-exponential time provers per NP. So we want to show this main theorem at the top. Let's recall how Dworkenor showed the transformation for efficient provers. So we start with the Nizik, P and V are going to denote the prover and verifier respectively, and we want to construct a Zapp. The first message needs to be random. So we'll do just that. The verifier will sample some random strings and send them over to the prover. The prover will sample a random string of his own, S. Then he will X or S with each R.I. to generate a series of U.R.S.'s. And with respect to each U.R.S., he's going to generate a proof. He will send this back to the verifier. And she will accept if the Nizik verifier accepts all of the proofs after reconstructing the U.R.S.'s, of course. So as you can see, like, right, the first message is uniforms and satisfies public coin. The U.R.S., because we're X-orring random stuff with a random string, is going to be uniform for each proof. So, right, it should be fairly obvious by inspection that completeness holds based on the completeness of the Nizik proof. Soundness, to see soundness, we're going to fix some X that's not in the language that we care about. And we're going to invoke the statistical soundness of the Nizik to argue that there are very few U.R.S. random strings. And the U.R.S. random string is bad if there exists a pi, which makes the verifier accept. And, right, so next we will observe that for any fixed S over the randomness of R, the R.I.s, the probability that all of these uniformly random U.R.S.s are bad is, can be bounded by something that's exponential in M. And next, by simply taking a union bound over all of the Ss, we can bound the probability that there exists any sort of S that would allow the prover to trick the verifier. And we can bound this with 2 to the minus M plus N. So, as long as M is greater than N, we're good. And we have statistical soundness. The final property we need is witness and distinguishability. And I guess before I continue, there's nothing about these prior proofs, completeness or soundness that required that said anything that sort of would differ if the prover was inefficient. So, the problem is going to come up here in the witness and distinguishability. So, the witness and distinguishability is going to be proven near using a hybrid argument. So, we want to switch these proofs, pi 1 through pi M, 1 by 1, from being generated using a witness 1 to a witness 2. And so, in the ice hybrid, what we'll have is we'll have already switched over the first I minus 1 proofs to witness 2. And we'll try to switch over the ice proof. The way that we're going to do this is we're going to reduce to the zero knowledge property of the music proof system. Right, we're going to, by, we're going to swap this proof, this ice proof for a simulated proof, right? And this will, this will reduce to the zero knowledge property. The reduction will simply generate all of these surrounding proofs, run the, the distinguisher to break the underlying music zero knowledge property. And the argument for indistinguishability to go to move to from the simulated proof to proof generated using witness 2 is, is identical. Okay, so the one thing to note here, though, is because soundness is statistical, if we want zaps for NP, we want this transformation to hold for NP, and we don't want to cause some sort of collapse. It's sort of critical that the indistinguishability argument is computational. So this reduct, if we're going to follow some sort of reduction framework, it's like very important that this reduction is efficient. And the problem with applying this to an inefficient prover is that generating these surrounding proofs to feed to the reduction is simply too expensive because the prover, we don't have time to sample the proofs ourselves. Okay, so how can we get around this? So one thing, the first thing to sort of think about might be to sort of hard code these sample these proofs and sort of some preprocessing phase and hard code them into a distinguisher into our sort of distinguisher for the hybrids. So, given that this is the first attempt, what goes wrong, what goes wrong here? So let's look at the reduction from, right? So sort of the first step, we're going to sort of invoke the, the distinguished verifier, distinguisher, whatever to get these R1 to R1. You can think of this as sort of a worst case choice. And then we're going to set in the, for the prover, we're going to set S to be RI XORed with URS. So URS is the, is the uniform random string given to us by this Nizik zero knowledge game, security game. Next, we're going to set the jth URS to be S XORed with RJ. And finally, we're going to generate these proofs. Right. So what is it? What is the issue here? If we, if we hard coded these, if we wanted to hard code these proofs to begin with, the thing is, right? The, these, the way that we sample these URS is it depends very critically on the URS that we're given from the security game. So we don't know ahead of time how to choose them. And the sort of issue here is that they're, they're potentially, or as soon as you fix this RI, they are very, very correlated. So how can we get around this? Well, we dig up an old idea for sort of breaking these sort of correlations. The 80s. So Nizik, Nissan and Victor Sin encountered a similar problem while trying to build pseudo random generators. And the way they solved it was using combinatorial designs. So what is this thing? So you have these M subsets of integers from one to L, such that each subset is of a fixed size N. And for any two distinct subsets, their intersection is very small. So think of C as three for, for, for our purposes. So, right, as you see in this picture, right, we have two subsets that are large and they have very, very small intersection. And they showed that construction of these objects for, you know, basically any C where L is order N squared. And the way to, if you want to hint as to how to do this, consider low degree polynomials at the bottom of the slide. So how do we use this design, Nissan Victor Sin design? So let's recall our construction from before. So we're going to use these designs to, to break the correlations on the URS. So we're going to, instead of using S directly to generate the Ith uniform random string, we're going to sample the bits corresponding to TI. The Ith set in this design. So you get, so S is going to be slightly longer than before. And we're going to take some of the bits and explore this with the Ith random string that the verifier sent us. And everything else will proceed identically. And the point being here, so now if we look at the URS J versus URS I, there's very little dependence between them. If all of, like say you fix RRI and RJ, right, and all the freedom we have is over S, then there's like only a few, a few bits in common. So three C is three. So completeness is preserved. If we do this, and critically soundness doesn't change by a lot. So the S is slightly longer. So we have a slightly larger union bound. But as long as C is, you know, say three, then you get something that's, you can down this with something exponential in N. Okay. So, right. So let's check witness in the stability. So at a high level, what we're going to want, what we're doing is our reduction is going to end up being ultimately distribution over circuits. And we'll sort of view the sampling this distribution as a pre processing step for the sake of clarity. So the, the. So what we're going to do is we're going to get our R1 through RM from the distinguisher. We're going to sample our S, all the bits of S that aren't, that don't correspond to the I subset from the design. Okay, we're going to sample those uniformly. And we're going to, for each J, not equal to I, and every setting of the bits that we didn't already set. So, right, all the bits in the TI, we're going to, so for each, right, this is going to give us essentially, right, there's the most C of these bits. So we have at most two to the C settings of them. And so for each of these uniform random strings, we're going to sample a proof for the statement. Okay. And we're going to hard code this whole thing as a lookup table into our reduction. So, right, the lookup table is of size to the C. So the reduction is not significantly bigger if C is a constant. Okay, so now what do we do online? On input pi, you are as from this music security game, we simply set the ice, as I, the ice, you are as as before, but using this design and evaluate all the lookup tables to get the correct, the proofs that are correctly distributed. And finally, we continue running the rest of the distinguisher. And that completes the proof. So, right, this is what we saw. We saw this transformation, the simple transformation using this old idea from de randomization. This sort of gives us a tight way of preserving running time, prove a running time in this related transformation to that of Dworkin or this immediately gives us this one way permutations from zaps from one way permutations. It may be though that maybe you find that this idea of agreeing proven verify or agreeing on a uniform random string is already like too much to assume. So, can we get away without any setup? So, if we want zero knowledge, we know that this is not possible. There are sort of relaxations for which you don't need public randomness and sort of, which whereas you can, which are achievable in the plain model. So, one relaxation is one message zero knowledge from Brock and pause. So here, right, you, the prover sends a message, the verifier doesn't speak, and there's no public randomness. So, instead of achieving soundness against arbitrary cheating prover strategies, instead, we just guarantee uniform soundness. So what this says is that if the statement isn't true, then the verifier will check when interacting with any uniform sub exponential time prover. And another relaxation is non interactive witness indistinguishability or nearly. So here it's just witness indistinguishability exactly like this app except now the verifier doesn't send a message to begin with. And this is due to Brock on that. And so, to sort of applications of our technique by sort of modifying Brock on that and framework tweaking it a little bit to hold for this are setting. We get from one way permutations and hitting set generators for cone on deterministic circuits. I'm not going to describe what those are here, but you can look at our paper for details. We get me we for NP with sub exponential time provers. And similarly, if we also add to this sub exponentially secure uniform collision resistant hash functions. We get one message. Mizzix where the simulator is efficient after a pre processing step, which so after the pre processing is independent of the statement. But it's not sort of a standard setting. But briefly, I'd like to tell you in the one minute remaining about this notion of fine grained zero knowledge and our results there. So in the classic formalization of the verifier learning nothing. Right. If you have it start with any PPT verifier, then the transcript generated by prover interacting with this verifier should be simulatable in poly time. So, and for our notion of fine grained. Zero knowledge, right? We're just going to replace any current of PPT with some complexity class C. So if C complexity C verifier should be simulatable in time in this complexity class C and in simulatable means it's the transcript is indistinguishable to C. And we extend this also to witness indistinguishability and there's a running example of what we are considering is C equal to NC one or log depth circuits over a standard basis and we allow them to be randomized and results here we get using this from this worst case assumption. Parity L slash Polly not contain not contained in NC one. We get NC one fine grained physics in this sense that I described earlier. Uniform random string model for NP zaps for NP in this for NC one fine grained sense as well. If we add hitting such generative for codon deterministic circuits. We get fine grained non attractive witness indistinguishability. And finally, if we also add uniform collision resistant hash functions. We get one minute message. And see one fine grained this for NP. Right. The key thing here is that inefficient relative to NC one is different from inefficient relative to PPT. So all of our provers are actually poly time. We're just not as efficient as the verifiers. That's all. Thank you.


U.S. President Joe Biden and his wife will visit the site of a deadly building collapse in Florida on Thursday. The collapse has killed at least 11 people and left 150 missing and feared dead. Florida state and local officials say such crews are still scarring the rubble six days after the collapse in hopes of rescuing anyone still alive. State Attorney's Office is opening a grand jury investigation into the incident.


Hello everyone, welcome to our pre-owned vehicles of the week. I'm Gabrielle over here at Oxmer Toyota. So we have three vehicles we're going to go over some details on. Why don't we go ahead and start with this one right here. So the first vehicle we're going to talk a little bit about is a 2018 Ford Fusion SE. That actually your color is in a white. So you are going to have alloy wheels. This was well maintained. There's going to be a back-up camera, clean car fax with one previous owner, and there's going to be Bluetooth as well. That interior is in a black cloth. Mileage on here is $49,049 and the price is $25,547. For our second vehicle, this is a 2020 Chevrolet Equinox Premier. The exterior color is in a Summit white. There's going to be alloy wheels on here. There's a clean car fax, Bluetooth, heated leather seating. One previous owner, and this was locally owned. There's going to be a back-up camera. It was well maintained. Now that interior is in a jet black leather. Mileage is $37,261 and the price is $30,500. And for our last vehicle, this is a 2017 Mazda 3 Sport. That exterior color is in a Sonic silver metallic. There's going to be 16-inch alloy wheels. There is going to be six speakers. So you will get 37 for miles per gallon on the highway and 28 for the city. Now that interior is in a black cloth. Mileage is $75,498 and the price is $20,481. Alright you all, if you have any questions on any one of the three vehicles that I just went over, feel free to let us know. All of our contact info is listed right here. Thanks to all so much for watching and I will see you all soon. Bye.


everyone will come back to another XO heroes video so today's video it's time to update our overall tier list for the month of september but before that if you want it updated XO heroes videos please hit the subscribe button down below okay guys so this tier list is actually for september but for this one this file this excel file that i have this is the same file that i shared with you guys for august so that you can be a compare tier lists so we have here at the bottom august then september so that you make compare the differences in terms of movement on the tier list or in the tier list let's start with the tier list for september we have kind of average movement for the tier list so for tier e which just needs a lot of work they still need a lot of work they're still there still the same as august and your d is actually is going to be the same so for your e guys uh sorry so for your c so for the viable the only movement for the tier list since august is going to be the new fc mahar so fc mahar just to you know just to give you guys a you know a more or less an idea of his kit he's more of a defensive type more on luring damage to him provoke um more on sustainability survivability that is actually the theme of his kit so for me i think they should have you know done a lot more in terms of just survivability in provoke so again they they added to the provoke they added to serve to the survivability but that's it no other additions to his kit so again he's viable but it depends if you have other better um defenders than mahar like for example you have um oloom you have tantalo and the other defenders that are on the top then you would usually use them as for mahar i think he does need a core reverse immediately after he's in tier c okay so again the rest are the same so you have your corgi yaw degas luke valar kari the regular kari fc deva shufraken rachel fc sabrina luna and fc bernie or fc bernadette okay let's go and move on to tier b okay by the way guys um this tier list is actually um from the asian server and also i'll put again another link for this tier list so that you may see this in a later you know when you are more free um it has again both august and september so you may you might want to reference both um see what the differences are so for b you have here the changes um as you can see there are two changes on your right side so you have rhino or so she's a new addition since august one the august tier list was actually brought out in august one then she came out then she's now at tier b so these are solid heroes also kyla after the core reverse is actually solid right now and he can be used um in pvp or in pvp tag okay especially if you want to bring that synergy for brun they're actually one of the changes that are here in the september tier list so again you have your fc baraka fc scarlet fc anesthesia no change fc hekin otard otard despite her new core reverse is it it it's not that much um it's not as it's not going to put her above tier b i think she's going to be more solid for tier b so she stays put you also have here fc ramji leger fc leger fc emma fc leger by the way is a solid reviver and healer but is not really one of the top tier so they actually she actually gives the utility but doesn't bring that kind of boom factor that you really need to put her in your team then you have your fc emma fc balish bathery garf and schmid which is their regular form rounds out your tier b for your tier a guys there are kind a lot of not really a lot there are only two changes here so the rest are still the same fc valentina fc garf uh blue fc garf blue fc rara fc morris fc brook fc leppen fc ratio and fc gene are in the reliable so the one that's actually going up is actually fc chatty i've seen fc chatty um be more useful in EVP actually that is why she's in a um more of more of again a defensive type of green led team i've seen her there and she's she is actually fantastic and you have here fc neomy fc ramji then fc baraka goes to tier a so he's one of the reliable not too fancy he's usually built for speed and for quick damage so that's it no no other there are other things such as he can steal mana but that's probably it so and our tier a is rounded out by fc lume of course okay now we bring you to the s tier so the wingman um to your superstar so there are two notable changes here fc carry is here because of her u-release and her new fc and okay i might be wrong with her s tier she might be s st here but right now as most of you guys have haven't built her kit up to par like her signature force like her um um uh what again the the core core management core sharing sorry core sharing uh so you haven't built her yet and we don't have any data yet on how she's performing at the top of pvp and also for pve but her kit is actually very impressive as is that is why she's at s then she's joined by fc maggie fc zion fc adams fc shell fc iris fc april fc annie and also fc jinn um has been um elevated from a to s because he brings a lot to extorice not only the damage but also the speed um the ability to counter um dorka and also to give um mana bind and silence as well so she he brings a lot of utility to your team especially if you brought along s tori so and we have here fc shufracken as well and fc luna and to round out the tier list at s s okay so it's going to be fc tantalo and fc dorka okay so but let's before i discuss why they're going up again um fc garf fc rudley fc talia are very good mainstays joined by fc bathery fc rara fc rachel fc janai fc schmid and misty are mainstays of s s tier dorka was once um s s tier she actually just dropped because her usage actually dropped as well there weren't that much teams building her because before there were a signature force of course was not built there wasn't a chaos uh blue fate core and also there wasn't a brand blue fate core now there are so right now she's being used heavily especially for north war frosty so again she's one of the you know one of the must have units that we have right now even though she doesn't have a fate core she's very very efficient in what she does especially if you built her uh with the highest speed then your you know your your opponents will just cry with in terms of requiring a lot of mana they will just use your basic attack and also for just to round out the s s tier you have here fc tantalo to round it out again his stock is actually rising as well because of north one frosty dorka and him actually formed a very good tandem with north one frosty together with with fc valentina fc uh talia and fc shufraken so again they are you know they they mesh very well with the shufraken and valentina that they have catapulted north one frosty to the top so again guys um this is actually your new tier list for the month of september i'm not going to discuss the others here like your e they're still the same again your d is still the same and the others here because more or less there's no change from the previous tier list so month to month i'll be bringing you guys a tier list depending on the core versus the new heroes and the way they they perform in pve and in pvp for the month okay so that is it guys so for no for comments suggestions again this tier list is open for suggestions please put down your comments in the comment section below if you have any you know you have any comments on this this unit or this this hero should be there this that okay just put them down below and i will actually discuss it with you and consider your recommended okay guys so thank you very much for staying this far in this video and also please consider subscribing because this helps my channel a lot um guys don't forget to click that bell icon if you have subscribed also put a like to this video thank you guys stay safe take care this is the warden and i'm out of here


This study examined how the COVID-19 pandemic affected physical activity, PA, patterns, screen time, and sleep among Swedish adolescents. The results showed that moderate to vigorous physical activity, MVPA, remained unchanged while light physical activity, leaper, decreased and sedentary time increased. Additionally, sleep duration decreased and screen time increased. Girls, adolescents with overweight to obesity, BMI and percent body fat, and those with lower cardio respiratory fitness, CVF, at baseline had less favorable changes in PA patterns, sleep and screen time. These findings suggest that certain groups may be more vulnerable to the negative health consequences of the pandemic and require targeted interventions to help them maintain their physical activity levels and reduce sedentary behavior.


G'day all my Robert's here. Let's talk about scope. So we've got a very simple example of a Processing program that uses scope exercises it in some way. We don't need this down here But most and we don't need the console here. Just maybe be able to get rid of it in case not it all fits on the screen So that's good I've got the debugger open on the left here, but ignore it for now because we're in the middle That was in the middle of the last execution This is a program that wants to actually let's turn the debugger off This is a program that wants to animate a shape across the screen and animate a shadow of the same shape appearing down on the bottom of the screen There are many ways to do that and this program just happens to do it this way it does it by introducing a Two other functions one that'll draw the UFO at a position and one that'll draw the reflection at a position and the UFO one fills it with the kind of magenta color and then draws in the lips up the top of the screen and the Reflection fills with a black color and draws it down the bottom of the screen Interesting thing is both these functions need to know where they're going to draw that Shape so they both take a single parameter telling it the X position of the shape But also because we're animating that Position across both of them. We need a global variable representing the X position of the shapes both shapes So that X position up here Is a variable getting incremented so that animates across the screen and we're using it to draw the UFO And we're using it to draw the reflection The particular characteristic of this program is that this variable name here X pause is the same as the variable names here and here What we want to understand is that every time you see something that looks like a variable declaration Int pos X that's definitely a variable declaration Here's another one in pos X looks just like a variable declaration and yet another one That yes, every one of these does cause a variable to be created and a slot in memory to be set aside for that variable Even though these are here in the formal parameter position. They are in fact exactly the same as variable declarations So we're going to try and have a bit of a look inside the memory while it's running via the debugger Trying to show you what I mean So the debugger set with a breakpoint here on the first call to background which is why it stopped before it's drawn anything and You can see that there's a single variable called X pos that has a value of zero That's exactly what I expect because I declared a variable of X pos up here the codes run through this section It's run through this section. So it's set it to zero and we're here Now if I step Just the one step. I'm now down to the call to UFO at and That so nothing's been drawn yet or the background might have been drawn, but it looks like it's struggling Actually, nothing will get drawn on the screen until a full draw loop has run So this is the UFO at call and we're passing in as an actual parameter that X pos which will be the value zero Now that's going to cause the code to jump down here to this function And run this Function definition and you can see in the function definition is a declaration So as soon as processing does that it gets past that declaration Which means it creates another slot in memory and it's done that up here So there are now two slots in memory both called X pos And the debug has been nice to us here because it's added this little magic this on the front to help I see that one of them is The new one versus the old one, but we can't really rely on that That's a kind of internals of processing thing in reality and from our point of view. We've got two entirely separate variables both called X pos and That creates potentially a problem because in this line here the very next line of the code We say please look up the memory slot X pos and find out what's in there well which X pos There are two of them and the scoping rules will tell us which X pos The other thing to realize about scoping which we'll see in this example is that if I step again It's going to go through the rest of the UFO app and back out into draw So the ellipse call gets called Step again, and we're back out of that UFO call and one of the X pos is went away Just gone So that's also a consequence of the scoping rules We'll be talking about the fact that variables have a life and that life Is finite so one of those X pos is that we created has gone away again And what we'll see if we keep tracing is that when we get the reflection at it introduces yet another X pos Because we've gone through another declaration step and again It's got a little trick that we can use to work out which is which but internal details So we can't rely on it And again that one puff disappears when we come back out The other one's hanging around and we're getting a drawing happening But this question of when I've got two variables that have the same name Two slots in memory that have the same name and Then I try and access a Memory slot with that name which memory slot will I get? We ask our scoping rules and our scoping rules tell us so I guess we better find out scoping rules work You


안녕하세요 다우트케입니다 요즘 많은 사람들이 제 인스타그램에 대한 질문을 하시는데 그래서 오늘 이 질문을 얘기할거에요 질문은 이게 짜잔! Can Muslims become K-Pop idols? 첫 번째는? short answer? yes I think it's possible Since K-Pop is really global right now So I think K-Pop Muslim member can be helpful for marketing something But you should know it it's really difficult And actually I don't recommend you to be a K-Pop idol I will tell you why Because Islam is not just a religion You know like Islam is lifestyle we have to follow But I think K-Pop is a little bit far from Islamic lifestyle Then let's go deep inside Why do I think like this? First K-Pop is music Of course different imams and different schools have different opinions in this topic Like whether music is haram or not But in my opinion K-Pop is not very halalius halalius? 다 다뤄있나? Because it's too addictive and powerful So I think it makes you far away from Allah And second is diet You know like idols extreme diet is already very famous Unfortunately Korean beauty stand wants you to lose your weight constantly So many trainees are losing their weight with extreme diet style I've heard that they eat one meal in one day One meal in one day?  Third the concept of K-Pop You know K-Pop idols always show various types of concepts Performance every time And this process you should take a strong makeup And sometimes you should wear sexy clothes And of course men should do it And this is not very close to Islam And the last is really important It's about prayer Maybe you can think what's problem But you should understand Korean culture Korea has strong rules for group life So there are big pantheists for individual actions And I think the prayer is very personal for their eyes So I think it will be not easy You should understand Muslims in Korea Always face on the prejudice and bias For Muslims The purpose of life is serving Allah And this is more important than being an idol yourself If you want to be an idol you can do it But keeping your identity as a Muslim will be not easy You should know it Of course I know many people love K-Pop And want to be an idol But I want you to think more carefully So the last thing I wanna say is that If you sacrifice something for Allah Allah will always replace it something better In this life and after life So don't forget that only Allah can send you to heaven Insha'Allah I hope it was helpful And thank you for watching my video Take care and be safe Alhamdulillah Maasana maa kamsahamnida Annyeong


I love the skiff. I am shook, you guys.  Kids' headaches are so much more than just that. The answers are delicious and very spoilscentric. I'll leave it at this. Midway through the act, I had actually written a paragraph's worth of teary-crafting, and it's validating beyond reason to see that I was completely on the money. But since I was on the money, and the money's all good and nice and green, you can go to the supermarket with it. I will not be sharing with y'all that paragraph. In fact, here. It's gone. Goodbye, glorious teary-crafting. Farewell. Back to traveling through the icy wastes. What I loved about the skiff was traversing terrain with it really gave me this epic feeling of scale. The environmental design truly is a thing of wonder. Some of the shots worthy of framing and putting up on the wall. There's some delightful exploration to be done. And I was all for it. 100% of the time. That's me. That's how much I enjoyed this. This act had a few side quests which were interesting and added a bit of flavour to the main story. More importantly, they offered upgrades for my bot, Jack. Oh, I haven't spoken about Jack yet. Here's this hovering little fellow with all the utility in the world. And then some. In addition to being a full-fledged part of the squad capable of reviving you, doing plenty of damage with his ARTO D2 shockstick and more. He's got two active abilities, one to benefit the squad and one to hinder enemies via traps, electric pull strokes and later, in Act 3, mind control. I love Jack. Useful wee bugger. Some new weapons. To be honest, after playing through the first act in the beginning of the second, I've got my finger in the gun play finally and I'm doing so much better. Progress people, it's a wonderful, wondrous thing to behold and explore and experience. There really isn't too much more to say without getting into spoilers, except of course my first bit of negative experience with the game. It's a glitch. Now, I hadn't been aware but apparently bugs are something that plays against 5 up to a point. What I've heard was a 95% slash 5% slip. Slip? What? No, I meant... What did I mean?  At any rate, the boss at the end of the second act took me a few attempts to beat, only for the game to then freeze during the closing cutscene of the act. I will say, I have a whole new appreciation for the Nash's shotgun, which this fight would have been considerably more difficult without. Of course, even appreciating a shotgun as much as I did didn't make the need to replay a boss battle I'd already beaten any more enjoyable. That one's a new Microsoft. Some really tense action heavy moments, particularly memorable and somewhat challenging, was this fight during which waves of enemies kept coming while a device was cutting through a door, barring Kate and Dell in Jack's progression forwards. I think that was the first, maybe the second time I died in the game. Not my proudest moment, thus for sure. It's a good act, tacked to plenty of lore. Some interesting revelations, a lot of high quality banter and even a few heartfelt moments of sadness. But my empathy is of the charts when it comes to fiction, so I might not be the finest judge right now. If I get to a lore breakdown of this one, some in-depth analysis, I'll be able to say more to share. Until then, thank you for watching, please like, share, subscribe. I'll see you next time, bye!


capabilities in automotive systems. That's a broad range and there's plenty of stuff to talk about for hours and hours Brief introduction of myself. I work for Bosch Bosch engineering in particular Bosch is one of the largest cars supplier manufacturer, so If you take a random car chances are high that some component is manufactured by Bosch and Bosch engineering is specifically specialized in adapting those parts For small serious customers, which is very exciting because I have exciting customers and also all the Product range of Bosch is at our disposal more or less At night. I love online privacy. So we are hosting tour relays in Vienna. I didn't mention it We're based in Vienna, Austria And in between I do digital forensics Yeah, and the meme artist is on the slide So these pictures that you're about to see our memes and they are not subtle copyright infringements, but pieces of art and There's my Twitter handle So the goal of this talk for me is to give a broad introduction into automotive security more or less Path that I've been walking the past five years my background is in IT and security I didn't know much about automotive security Of course you I saw the headlines and since I'm working now in this field for a few years I thought it might be interesting to have this one introductory talk to everybody Who is interested in this topic? The goal is to identify the most relevant hacks attacks and vulnerabilities that have been out there Of course your mileage may vary so there are numerous sources out there Just go wander on the internet to figure out what automotive hacking is all about and also to Give you your own journey to automotive security Yeah, objectives real-world attacks that have been demonstrated not theoretical attacks What to expect I'll only talk about public stuff. So everything that is found online is linked I also put the slides online you can find them on my Twitter and Every picture is usually linked to the source document so you can walk from the slides and read on the details of all the different attacks and Yeah, basically what I observe there are two groups that do automotive hacking One is the hackers for the fame and the other group is companies for the fame and some fortune So the ecosystem of companies that focus on automotive security is growing and growing And most of the time it starts by some hacker fiddling with their car and trying to get things to work that weren't supposed to work or Have it the other way round What I didn't include is in this talk is the automotive basics So there are numerous talks and resources online check out the car hacking village check out The open garage book about what a camp on bus is how Architectures of components working cars I also didn't include API's because this is just regular IT security securing an API for a car Shouldn't be different than securing an API for Facebook Twitter, whatever it is. I also didn't include immobilizer things also locking systems because There has been tremendous research going on on the megamos crypto system or high-tech to how to basically You're able to steal a car because the security is not done properly in the immobilizer. This is not covered here so I'm focusing on every other component than the locking system and the immobilizers because Regulation demands that every car has immobilizer and usually this is done with some cryptographic Handshake with the key or with a phone or whatever it is So let's start the journey the first time or the first nice resource I found about automotive hacking was a paper from 2010 it was published at an academic security conference in 2010 and Basically what the researchers did is was to analyze how the car works in the inner workings to figure out what a can bus is how you can Relay or inject specific can frames to get basic functionality Just by hooking onto the communication bus. So the can bus is a very Simple communication bus. It provides real-time communication with arbitration, which is a great thing If you would like to have priorities and messages. So unlocking the car probably has a lower Priority compared to detonate the airbag. So this is very useful for most situations and What they identified was that these frames they are not protected. They are not encrypted or authenticated so getting your Debugger or your components connected to one of these buses allows to do all kind of things that are Supposed to be regular functions by the car It's rather easy to do that So you can just hook up an OBD port or any can shield for a raspberry pi And you can work from there to basically just sniff messages and then inject them again and see see what happens What they were able to demonstrate is that you could kill the engine you could apply the brakes and you could disable the brakes just by sitting on the bus, which is kind of the the Goal of all the hackers and attackers to basically Have some functionality Engaged like applying the brakes or steering which can do physical harm because this is not supposed to happen And this shouldn't happen at all cost You can also see down here. This paper was cited 2,000 times since 2010 so Going from there through the work of academics is very interesting because you can see the popular works that have been cited many times often again and again and in the picture to the right you can see that they Pwned the instrument cluster display So in the vehicle the text that is shown there is sent over some bus and they were able to manipulate it and include their own message by Fiddling with the communication content So as I said what they identified was mostly intended functionality So the threat model at that time was that if the car is locked It is considered in a secure state Of course, you can attach yourself to those vehicular buses, but at the same time you can also cut the brake lines or Temple with other sensors if you are physically so basically that was the first work to Show that the regular functionality could also be abused for malicious functionality But mostly because that was beyond the threat model back at the time In the follow-up paper and that was really cool They showed how to hack a telematics unit in one of One of their cars they published it at username security and what was really cool In that talk was that they were able to make that car join an IRC channel for command and control messages So basically 2011 botnets were a thing as they are now, but they used IRC So they connected some component from the car over the telematics unit with the internet IRC So and then were able to submit commands to the car They demonstrated that they could do location tracking. So issuing IRC commands. Hey, what's your location? They were able to exfiltrate audio. So the car had an microphone. They could activate it remotely and get that audio exfiltrated What they also demonstrated was that the update functionality of the infotainment system Was unsigned so every time someone in the dealer or in the workshop They updated the software of the infotainment system with the CD player and thing They did this with an unsigned binary. So basically just tampering with the binary you could root your CD player without actually Having to bypass any security measure They also found and this is really cool a buffer overflow in the WMA parser and they were able to Exploit this over the telematics unit via a phone call So basically what they did is they called the telematics unit because it had a SIM card It had a phone number It wasn't shown to the user that someone is calling the telematics unit because no one would ever do that And then they were able to exploit the buffer overflow in the WMA parser to get root privileges on the telematics unit, which is really cool really the holy grail of automotive hacking because With that amount of control remotely you can do all kind of nasty things and you can see it in the picture It's one of the first iPhones or whatever it is. They're holding a speaker to the microphone and Exploiting the car just like this. I've never seen anything like this again. It's really really cool All right moving forward 2013 to students Dutch students, I think yeah University of Amsterdam What they analyzed was a BMW and they analyzed the telematics unit as well how they did it was they wrapped the antenna of the telematics unit in tin foil and Put an imzi catcher or us rp or some kind of base station fakery next to it and then they were able to inspect and modify SMS content that was sent back and forth they saw that By just by intercepting the messages it works like that If there is a command waiting for the car in the back end the car receives an SMS the SMS triggers wake up of The relevant components once they are online the car connects to the back end Asks if there are commands and then downloads these commands and executes them However, what they saw was that It used an HTTP proxy. It used their own APN their own private online network more or less but There was no Authentication per se so it was a base 64 encoded authentication, which is basically no authentication and they were able to basically Simulate the back end and issue commands to the vehicle just like a regular back end would do for functionality which is part of the car What's also interesting Maybe that was replaced by the proxy But in one request they mentioned that the user agent of the car was firefox 3.5 on Windows 7 which doesn't add up Maybe they saw their own user agent string, but it's really Interesting to see that a car Identifies as a firefox whether it's legit or not. I don't know but I find it very funny Two years later The German ad at sea they took up the work of them or they replicated the work with the imzi catcher And because it's a German ad at sea Germans love their cars. So it's a quite powerful institution They redid this kind of attack. So again, they had a fake base station catching the car and Back in 2013 There was a fleet key there was a key added to SMS's for commands that added encryption and Authentication of some kind. However, there was one key for all the cars of the same kind So it was kind of a fleet key, which is not a good thing if you do it They then published that for unlocking the car the car sends and the back end sends an HTTP get Request unencrypted unauthenticated. So you have the wake up SMS, which is authenticated of some kind using encryption which shares the key and Yeah, basically What they showed was that if you see a car you have to read the win which is conveniently stored next to the windshield You can catch the telematics unit You can wake have it wake up connect to your fake base station and unlock 2.2 million cars Yeah, that was kind of not good. They also showed XML conflicts have been Unauthenticated so the car could be updated for new features or seeded heats for rent whatever it is and that was an unauthenticated XML file and By manipulating that on the fly you could unlock additional features in the same year There was also GM with their on-star system. So if you remember in 2011 There was this remote telematics head unit that Had been hacked over calling it until 2015 GM didn't have a fix and they didn't or maybe they had one and they applied it in The workshops but for cars that never made it into the workshop They had to hack their car themselves more or less to update the software So the on-star system the telematics system. They was never built at the time for software updates They exploited it to introduce update functionality and updated 2 million about 2 million cars to basically Get the fixed software by basically hacking it Which is kind of neat if you hack your own product to have additional functionality That wasn't designed in the first place 2015 was also the year of Charlie Miller and Chris Wallasek the famous G pack which has been Through the media again and again. So for every training I give it within our company This is a must-see of course Because that changed the the entire industry to some kind that it's not a good idea to just add more sim cards But you probably would like to have firewalls and regular IT security features Could be useful They demonstrated it with the famous video where Andy Greenberg was driving on the highway they connected remotely to the car and activated the radio the windshield wipers and Then shut off the engine Very powerful video and very powerful marketing of course for enhancing security in vehicles How did they do it in their 2015 paper? They identified there was a u-connect unit. It was running q and x kind of a real time embedded system This connectivity unit had a 3g connection to the back end and It had open ports Locally over wi-fi. So if you connected with your car over wi-fi You could see the open ports of the telematics unit They also saw that you could do software updates over usb for jailbreaking it. So again software updates were not signed You had to plug in the proper file name and the proper software some basic functionality like Some checksums to identify that it's a legit legit software update and Just by manipulating the software they could change the software, but of course It's not straightforward. You cannot disassemble it right away Take some pain to modify the software But what they then found and this is the the big thing is They found that each car has two ip addresses one of them is for the in vehicular services So if the car spawns a hotspot It connects to a proxy and that is the external ip then But they also saw that the telematics unit had a self announced ip address more or less so everything in the car was using the proper connection But there was also the regular ip address that wasn't firewall. They had to scan two net ranges of Sufficient size and could connect to it because The telematics unit did not expose the open ports only locally But also on the internet interface Which is not a good thing and the the video clearly demonstrates that 2000 2015 was also a great presentation at defcon Where two guys hacked their tesla They identified that of course it's a local linux. Of course it connects to some kind of back end called mothership using a vbm But by local manipulation they were able to ssh into that car and they could do all kind of Nasty things using this ssh connection So they could turn off the car or open the doors Basically everything that is regular functionality or functionality over the app They were able to demonstrate that as well again, you had to have local access, but If you put your car in the dealership You could basically back door every car again and again that is coming in And then at a later point in time go harvest all the belongings in the car or take the cars themselves One once physical access is enough to pertain physical access for the future And again, they showed all the different architectures Every car is different in the architecture and their used components. So One of the first thing most people do is to figure out. Okay, which components are in there What communication buses they use and how could this potentially be exploited? Another work from 2015 also very interesting They demonstrated in an academic publication That aftermarket OBD dongles things that you plug into your OBD ports to have diagnostics or I don't know status messages the things that you do with your car insurances sometimes do that They identified a popular brand and dissected it And found that they have the same ssh key pair on all the OBD dongles and they were sold in the thousands Not a good thing to have the same ssh key because once you compromise one of these dongles you could compromise every other and Yeah, basically they also demonstrated it on showdown 2000 devices By remotely applying the brakes. So they wrote an app They connected to the vehicle to the OBD Port in question This could be done over the internet and then they were able to inject break messages to basically Bring the car to a halt, which is again Endangering physical safety, which is not a good thing 2016 miller and valosex striked again They showed more advanced analysis of their cheap hack And what they were able to demonstrate which didn't quite work in 2015 was some sophisticated techniques to Basically denial of service specific component. So basically what they Observed was that if you put an ecu some component into boot mode into bootrom mode They wait for a software update and they will never wake up again until the software or the car is Restarted or the software is applied Also cars cannot handle conflicting messages So if the message doesn't have a counter or a cryptographic Authentication tag with them, you could simply Inject a contradicting message and the car wouldn't know which message Is the valid one? Some messages had counters and they could because they only increment counters nothing magically They could predate the counters and send the message before the next legit message and thus Prevent the legit message from arriving And yeah, what they also demonstrated in somewhere where there were plenty of cornfields was that they were able to Engage the brakes and steer using the parking assistant. So this is kind of the most physically attack that could Be possible if you're driving on the autobahn And all of a sudden your steering wheel turns to some angle is definitely going to be resulting in a crash 2016 was also the year of keen labs. They demonstrated in a blog post first how they were able to get Root access on a tesla. They did this by Exploiting the fact that teslas always connects to a known wi-fi Which is you can find it online So if you drive up to a supercharger your car will connect To this wi-fi and will ask for software updates and things like that They were able to trigger a webkit exploit So the the the screen in the middle had a browser that browser was not fully patched and By redirecting and intercepting the browser communication They were able to Exploit the browser and because the kernel had been outdated. They were able to Elevate the privileges to root access to basically do anything over the networks because they got root They also presented this at black cat in 2017 And basically i'm not sure if you can see it on on the right, but that's the infamous christmas show video Where they had two cars dancing more or less and blinking with Specific patterns to And they did this by this exploit chain They also said that okay, there's The the software update for the gateways module isn't on is not signed After the publication everything has been signed And also tesla pushed the kernel from 2.6 ish to 4.4 ish So basically based on these public hacks the software security tremendously increased compared to the previous tesla hack In 2018 keen labs did it again. They presented their findings on the tesla x and Because the kernel has been locked down and updated no known vulnerabilities They had to find another way into the kernel and this time they did it with the kernel module for the nvidia tegra chip Which is part of if you want to use your Not sure which component it is, but if it has an nvidia tegra chip that is run in the kernel And there was a bug in tear in there to elevate privileges They also identified that and that's cool If you prepent the signature with some spaces, there's a confusion and the car Rendered the software update as legit even though you just had to add one or two spaces before the signature to bypass that signature check and they also Talked about details on the tesla xmes show In 2018 there was also the Leonard Wooters tesla hack. I know I promised in the beginning. It's not about locking But this is kind of locking because it's really cool What Leonard Wooters was able to demonstrate is that you have to get two challenges from the car So every time you pull the handle the car sends out over Not sure which frequency challenge and if the key fob or any other device used for authentication is able to answer that challenge the car unlocks and He was able to Bypass that by just using two challenges from the car and collecting one response from the key fob built a rainbow table of five terabytes and Basically was able to unlock every tesla because they all had the same Locking system the locking system itself was from an external supplier. So even though this is the famous tesla hack It also infected numerous other cars that had the same locking system implemented um, it used some proprietary crypto dst 40 and You can see on the right the wake-up signal Arrives at the key fob the key fob replies Then the car sends a 40-bit challenge and the key fob responds with a 24-bit response 24-bit isn't that much for 2018 and that's why he was able to enumerate all the challenges and all the responses In 2019 tesla participated in the poem to own contest So basically if you can compromise a thing, you can keep it You have to just publicly disclose the Way and the vulnerability that you have used they The flura at the top team they demonstrated a jit buck in the browser and successfully exploited the infotainment and They won 35 000 k again browser vulnerability Most of the time if it has a browser or if it has a linux car If it's not running on the latest version chances are high that there's something hidden in there In 2019 kinlabs also published or discussed at blackhead their research on bmw They more or less identified 14 cbe's some of them were remotely Triggerable and Demonstrated how they did it and what they did They compromised the head unit. You can see the picture in the middle. They had their own logo displayed They also demonstrated to compromise the gateway and also the telematics unit This is from the slides themselves So basically this is for many modern cars applicable you have an obd2 port which goes to a switch or Straight to a gateway And then you have somewhere you have the telematics you have the head unit and then you have the bus based systems like Controlling the engine controlling the doors windows headlights whatever it is Also controlling things like advanced sensory like you have front radar. You have lidar You have video all different kind of Sensors are now in a car In 2020 A different group from china skyo go 360 group published their research on Daimler e-class. I think it was They demonstrated at great length the different attack factors that they tried and What I like particularly about this is that they also described what they tried and what failed So it reads like an introductory to automotive security Next we tried this didn't work Next next and all the different steps that they Take to compromise the system is outlined in a wonderful report They didn't succeed at windows ce7. So apparently if you buy a Daimler for I don't know how many thousand euros The head unit comes with windows ce7, which is kind of Weird at least to me They they failed at that component, but they Tried and succeeded at the telemedics unit, which is running linux on some arm They were able to impersonate the car and connect to the back end What's also really great about this Presentation is that they used all the big tools that money can buy so they soldered off the nand flash from one of the components And basically rewired it to get access to the content stored in they They used an x-ray for finding the j-tag ports because they were hidden somewhere in between the layers And they also re-implanted this nand chip for Implanting a back door. So basically they took the component out of the car. They took the chip of the pcb They rewrote it with different Software and then reballed it to the component and put everything back together It must have been a tremendous amount of work that went into that And it's really hard to defend against such powerful and capable attackers, of course, you could encrypt the content, but then you can still yeah It's more or less very interesting because of the tools they used Early 2021 there was a tweet by some EA foundation and that was particularly interesting because That was not a talk. That was not presentation at some security conference. It wasn't a vendor it was just a hacker trying to get additional features for their infotainment system and Basically with that tweet he or she described at great length what steps they took to Get code execution rights on the kind of not so modern infotainment system You can see in the picture it runs at 2.6 kernel. It's a Nissan and it's surprisingly it's a Bosch component. So It's a rather old Bosch infotainment system that is not sold anymore But of course it's still driving around in the thousands And in this post he or she described First how to dismantle the infotainment system find the serial ports and attach to them and using The uboot bootloader He or she were able to get read write access to the file system and modify Or at least read the entire file system that is on there Um The surprising twist in this publication then was that by reading the source code and reading all The the binaries and things like that. He found that script which is Shown here below That script assigns a unique name for a usb drive that you plug in So you have an mp3 collection. You don't trust Spotify. So you use plain old usb thumb drives You plug it in and this usb drive is then assigned the mount point and If it has a udu id this usb thumb drive It will get that udu id Assigned as a mount point But if it has a label like a name or things like that The mount point will be created using that label and really interesting part is by having a label that has semicolon dash dash Uh Some functionality or some command you can get command execution simply by renaming your usb thumb drive to a specific name and It's genius because it's so simple you once you have this vulnerability You need to just plug in a specific usb thumb drive wait five minutes or five seconds And you have root and can activate wi-fi ssh. Whatever it is Brilliant tag And of course, it's also very easy to to Defend against because basically you just need to Change that line to not include semi-colons or every Thing that is not a character um to defend against that Another work from Leonard Wooters was Again a tesla hack, but this time the tesla x what he demonstrated was that the and you can see it in the brilliant presentation at Defcon 29 car hacking village from last year and The keyfob itself is a combination of different chips. So you have a bluetooth component in there You have a microcontroller in there and you have a secure element and What he demonstrated was that with this self-built machine He is able to wake up the bluetooth chip of the keyfob Then update the software over bluetooth, which is a usual process and Once the software is uploaded it is checked against Signature with the secure element, but the vulnerability here is that this Response from the secure element was ignored. So regardless of the secure element saying yes, this is a legit signature or No, do not apply this software. It's not legit It applied the software update and installed the malicious software Yeah, with that he was able to extract unlock tokens for for all the doors and Everything wireless you can see it in a brilliant video demonstration You just need to be within range of the keyfob to basically do all the necessary steps for this attack With those stolen tokens. He then approaches the car mimics a keyfob and Sends the tokens to unlock the doors Once he's inside the car. He attaches to the body controller There's no authentication involved, which is surprising But then he could train a new keyfob. So he bought a used keyfob on ebay once he's connected to the To the car He's able to say hey, I have a new keyfob. It's this and drive away with his new car Another tesla hack wineman and schmotzler. They demonstrated at kentse quest how to use Overflow buffer stack overflow over wi-fi to get root permissions on the component in question They showed it in a video you can't see it here But there's a drone and basically the attack is exploitable using this drone Because you all you have to do is send some wi-fi packets and connect and What they were using is conman.  This is unencrypted so it can be sniffed They can then connect with this wi-fi and then Do nasty things and one of the things that was provided by the head unit was The proprietary high q-net protocol. I've never heard it before. I don't know what it is But it included buffer overflows. So basically From there, it's fair game to Basically just compromise everything Yeah In 2021 also At black hat collin of linn Demonstrated that glitching ecu's is useful to bypass protections So usually nowadays you have a ecu That is protected. So you have a jtech password. You have a ur password and by glitching these Password checks, you can get access to the component without needing to know The password he demonstrated in Covet and the the microcontroller in question was a nxp microcontroller with power architecture Which still is commonly used For automotive even though everything is moving towards arm nowadays Early 2020 so 2022 so we're reaching the end of the timeline Willem melching is working for comma ai. He dismantled the steering ecu from his golf It's from 2008. It's rather old But what it demonstrates nicely that It's not only about the engine controller for tuning or the body controller for locking You can also control the steering module simply by manipulating the software on it comma ai the company he's working for is doing a business with that So they hijack the steering and use the I think it's a stereo optical system to basically steer the car on the highway Yeah, very powerful right up because again shows Again and again how you analyze such an automotive embedded component At point to own in may Synecative demonstrated again a tesla exploit. They used wi-fi. There's no write-up yet But they will talk about it at hexagon in In october in paris How they did it i'm really looking forward to that. I really hope it's getting recorded Argus the company Demonstrated at blackhead asia and this is really some high level exploitation That they could exploit using a buffer overflow and embedded automotive components So usually the components they don't have linux. They don't have q and x the smaller components have their own software stack specifically for automotive usually autos are or something like that And they demonstrated that they could use a buffer overflow in processing of those CAD messages To get code execution on that embedded component Really powerful. Um, this is going to keep me for the next one or two years busy Not only to understand how it worked, but also how to derive counter measures Head tip to niels who showed me that that's really really powerful attack Martin herford. He's somewhere here. He's going to present tomorrow on His tesla hex. He demonstrated a kensek west Bluetooth relay attack against tesla 3 so basically with a tesla 3 you have your key in your smartphone and over bluetooth they exchange the cryptographic Dance for authentication And what he showed was that you can do this wirelessly over the internet. So he built two raspberry pies With bluetooth interfaces and one is next to the key fork. The other one is next to the car Which basically allows anywhere to unlock the car There have been two other groups about the same time that showed this one is an academic publication They did it with a wired connection And sold done from ncc group. He showed this two days prior So basically bluetooth relay attack works and He will present tomorrow about his Wonderful vulnerability that he identified Basically there was in If you unlock your tesla with an nfc card It's unlocked a window of 130 seconds where You do not need to re authenticate for example to retap the card to start the engine But what he identified was that There's no user notification of any kind. You can also pair a new bluetooth key And thus have a new car key As a mobile phone paired with that vehicle I've seen Somewhere on twitter kevin 2600. He tweeted that there's a software update now available I didn't verify it if you're interested in that go to his talk tomorrow It's a close proximity attack and you need to have someone tapping with the nfc card for Entering the vehicle But once you see this you can pair a key and you have a new tesla really really impressive Yeah, that's about it. Um This was the really rushed timeline of automotive hacks that I find fascinating Usual disclaimer do not hack cars. You might hurt yourself or others. You should know what you are doing And if you would like to be informed twitter, of course has plenty of resources. There's the asrg The automotive security research group. They are hosting an online event. I think it's in september It's called secure our streets and it's will it will be an online conference dedicated to automotive security And there's the car hacking village, of course defcon is around the corner and i'm really excited for The things that are going to be published there with that. Thank you very much and happy to answer questions Martin, thank you very much. There was an excellent concise Overview of everything that happened in the last few years in car hacking and i'm i'm i'm really happy to see everything Just going on and and and people working on the security of that Having said that any questions could you come to the middle and talk close to the there's a microphone here next to the pool Stand closely to the microphone and use that test. Yes Um, i'm not quite sure how long it's been, but i remember there was a chinese group Hacking a tesla rain sensor camera with General adversarial network attack. Yeah, it wasn't in the hacks. So was that like too boring or what's i mean k? There was no access good question the what they managed is to confuse the recognizer for street and Things like a stop sign i didn't include it because It's really modern and i wanted to of course if you build such a system It should be obvious that you could trick it to some extent But it didn't include it for Time constraints. Yeah, okay, because i think like the visual attack vectors Stay will be a big role and as you said also nobody's securing stuff on the lower level So yeah, absolutely and all those camera based systems. They are connected using ethernet because calm bus is way too slow Hackers love ethernet. So let's see where that goes Yeah, thank you. Thank you for the talk I saw that you are Lamed with the kernel versions which are in the system. So do they get updated on the lifetime of the car or does it have the More or less all the software components from when the car was designed This is going to change so for Vehicular rich now For getting a type approval car manufacturers now have to prove that they have some kind of update management So if you build a car and you want to have a type registered in UN ECE which is more or less whole of europe South africa South america South africa australia and things like that You have to have a concept at hand how you will be able to update the software. So it's not mandatory To update the software. This is of course an economical question. Of course, it's cheaper to do it over internet or any other mean But i'm not sure if it's obliged. You just have to demonstrate that you have an update concept And this will get more and more. So everybody is attaching sim cards to stuff like crazy We will get there that a car will update itself overnight Thank you. I've got one question myself As a user of a modern car My eldest already told me earlier with my former car It's nice that you use that obd port but take it out when you're not near the car because someone can hack into it So yeah No more than I did any other hints and tips for people What to do and what not to do with your car Good question. So every car is different. You should know at least the wireless things that are going on You should understand if you pair a new car key over bluetooth That at least you should verify that there's some code you have to enter things like that You can understand the apps that you are using. So if you use an android app Pipe it into one of those analyzing frameworks and see what they do what requests they do Besides that neck the manufacturer they they have the all the knowledge and documentation And also things like the german adiate. They know how to secure things physically Thank you Oh, there's one more one more. Yep, and but I'm going to ask for that applause but one more question Which is one quick question So since they are now popping up a lot of small companies that build electric cars because you need to don't need that Mechanical drive shaft and all that stuff anymore Are you aware of any company that kind of tries to build a secure car open concept wise?  Then I don't want that Yeah, it's more or less about the time of market So if a manufacturer is really keen on hitting time to market early They will take available components block them together and not put much effort into changing them On the other side if you have a robust background and Robust knowledge of a vehicular chances are high that you have a concept for security and key management and things like that So I expect that New companies that make an electric vehicle They will do the same mistakes again and again just like all the big ones did But eventually we'll get there every supplier will be Required to do security Updaterability things like that. It will change Yeah, it's more like is there like a offline per design thing that was like I don't know any It's all about convenience and apps and I like that sentence eventually we will get there and I think let's keep it on that for today Ladies and gentlemen big hand again