Community members in Ponima gathered today to bring together awareness for the many missing and murdered Indigenous people. Lakeland News reporter Sherell Moore shows us how the event is helping family members heal. It's not something that you get, it's something that you work to get through. You've seen their names on missing posters, or right here on the news. Sometimes their families go years without figuring out what happened to their loved ones. Today's missing and murdered Indigenous people event was meant to bring awareness to a problem that's been happening for too long. There's so many of us that are being impacted and grieving and it's really important that we come together as a community and try to build each other up. Today started with a prayer and a few songs. Then people took turns speaking about their missing and murdered family members. Meanwhile, an artist painted a mural. Morrison helped plan the event. Her own daughter went missing in 1996 and was found 12 years later, buried in a cemetery under a different name. It was Christmas Eve when they brought her to us. And so on December 26, 2008, we had her wake here in Ponima. Now the handprints on this mural were created by the people who are here. But it's important to remember what they represent. They actually represent the people who not be here. I like this event because it's something that we've never addressed before because we've, of course, had missing and murdered Indigenous people for years. And so it's nice that we're finally acknowledging that and bringing it forward. Later, attendees took to the streets to march in honor of their loved ones. The day ended with food and a few more speeches to remind the community to not lose hope. The more we share stories, I think it builds our hearts back together, somewhat repairs our hearts. And I think that's what's most important is to try to put our broken hearts back together again. It does help. It does help to know that there's other people that haven't got to bury their loved ones like I haven't yet, you know. And that's the hardest part is not having closure. Reporting in Ponima, Sheryl Moore, Lakeland News. This was the first missing and murdered Indigenous people walk organizers plan to make it an annual gathering. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


The vast majority of our popes were holy men who had tremendous and deep love for the Lord Jesus. A pretty large percentage died martyrs in defense of the gospel. So some really tremendous and amazing people and powerful accounts of discipleship, vast majority. But we have a small percentage that were just some real, for lack of a better term, just some real scumbags and really just dragged the papacy through the mud.


That feeling. It's all too familiar, isn't it? The hype, the excitement, the anticipation, the disappointment, the letdown, the questioning of why I'm even excited to begin with. Sony and Marvel finally threw out the red carpet tonight for Spider-Man No Way Home's final trailer. They had a big reveal event for fans where they even got to do a meet-and-greet with Tom Holland, and the rest of us sheep got to watch it on YouTube at 7.30 on the dot. Imagine gathering everyone all at the same place at the same time to collectively disappoint them. Instead of just silently throwing it out there on YouTube and letting the disappointment kind of fester for days and weeks at a time. Hi, I'm Adam, and this is a reaction video where I'm actually reacting to what I saw and talking about it. Instead of, you know, hamming it up by pretending I'm really focused on the trailer that I've already probably watched two or three times and giving really obnoxious facial expressions and reactions to every single tiny little thing that plays out. Let's just talk like adults or older children about what we saw. If you are here to see some god-awful reacting, here are a couple seconds to tide you over, and then we'll get into some real stuff. What's up guys? It's your boy, A-Double here reacting to another Spider-Man trailer. This is the final one before the movie hits. It was a big deal. Sony really pushed this on Twitter. I'm excited. I can't wait. It's gonna be a star-studded event, too. I hear that Andrew Garfield's in town. He's in L.A., Toby McGuire, basically all the villains. I can't wait to share the news as it unfolds. Let's check out this trailer, though. Oh, what? Oh my god. Wow! They did! They got him! Oh, was Sandman's in this? Yes! Is that Green Goblin? I'm so glad they got Jimmy Fox back. He needed that. He needed that after Amazing Spider-Man 2. Whoa! Is that the scaffolding from those leaked photos by John Kampia? Critical Review Darling Online YouTube sensation John Kampia? Man, he cracked this one wide open. This goddamn event. What was- what were they thinking here? How do you even keep the expectations in check? Everyone on planet Earth, at a bare minimum. Know that Toby McGuire and Andrew Garfield are in this damn movie, and if they are for some reason, some small chance not? I mean, Sony and Marvel couldn't drop the ball any harder if they tried at this point. I was convinced that they went back after the hype a year ago and did some reshoots and restructuring to get these other guys in it. I don't think we see more than 10 minutes of Toby and Andrew in this film, and that's a damn shame. So they're not in the trailer, obviously, but their villains are. We got Sandman, we got Dr. Octavius, we have the Green Goblin, we got Electro.  And by the time the trailer starts to wind down, it looks like they're fighting other characters that have been digitally removed or off-camera. You just look at the placement of some of these guys, and they're jumping in directions that aren't even close to where our web slinger is. That's just my two cents. Not having Toby McGuire and Andrew Garfield in this trailer, whatever. Fine. I was kind of 50-50 on whether they'd be in it or not. The trailer itself just was not good. It felt like they threw it together last minute for this event. They just scrambled to grab random sequences and toss them in.  It feels very kid-ish. There's a Scooby-Doo joke that's repeated for some reason. What? It's not even funny. Why are you using this in your trailer? That's concerning. That's a bit concerning. We get no further details on the story of this movie other than Dr. Strange and Peter apparently do some spell together. Someone screws it up, sounds like it was Peter's fault, and things go awry. The multiverse is happening. The dimensional rifts or whatever are opening up. Bad guys and good guys are possibly spilling in. And Dr. Strange is having a hard time fixing it, so he needs Spider-Man and his pals to stop it. We already knew that from the last trailer, so what does this one provide if it's not more story insight? Not much. A lot of CG. Some of it looks unfinished, honestly. It looks pretty rough. That fight on the bridge, for instance. The choreography is miserable. It's very choppy. It really looks like they're cutting around a lot of things that they're trying to keep secretive. It just doesn't make for a compelling trailer. It doesn't mean the movie's gonna be bad. It could be great. What I did see? Not very compelling. Not very engaging stuff. We're doing scaffolding still. Is that the best we can come up with a scaffolding fight? Are we not done with this yet? I just watched that in red notice, and then only a couple months earlier in Shang-C. Do you not have another type of situation you can get these guys in for a fight? I'm sure there are people that watch this trailer and are genuinely wowed by what they saw, and I don't want to take that from you. This is just my thoughts. There's also a lot of people that are gonna pretend that they're very excited, and they don't really care. I do care. I want a good movie. That's why I'm being honest about it, and that's why I always am honest on this channel. Subscribe for honesty. The first impression of the Spider-Man trailer I had with my son collectively, he's nine. He's all in on Spider-Man, likes them all, was arousing. Okay. I guess they're saving it all for the movie, hopefully. I watched it a second time right before hitting record on the camera, and I was even less impressed. This is Spider-Man. This is the third entry to a third set of live-action Spider-Man films. You have to be on your A-game. People love this character. They love this property. It's part of the MCU. It's owned by Disney. You have all the money, all the talent, all the resources at your disposal to make something kick ass, and this is the best you come up with for a final trailer? No. Hard no. I don't think this is the best you can do. I don't buy it. Here's really what's troubling me. If you have Andrew Garfield and Toby McGuire in this with Tom Holland, why are you keeping them a secret? Unless they're not a very major part of this film, which I'm once again saying they're not. These guys should be celebrated and given the red carpet treatment like the Force Awakens cast was when that came out. Love or hate Force Awakens? They went all in on nostalgia, and they should absolutely be doing that again. People love Toby McGuire's Spider-Man. There's a lot of people that love Andrew Garfield's. I think the guy's pleasant is all punch. I'd love to see them suiting up with Tom Holland hand in hand and web and web and web, walking down that runway, greeting fans, smiles on the face. Super excited to tell you how monumentally epic this film is. Yeah, this is a joint universe. We're all in it together. It's going to be so amazing. You aren't going to believe what you see. They're not doing that because that's not this film.  You're Marvel. You're Disney.  They share different parts of Spider-Man's universe. It's messy. It's stuff moviegoers shouldn't have to worry about, but we do. Final thoughts on the trailer. MJ follows at the end in slow motion. Wow, it's amazing Spider-Man 2 all over again, isn't it? How profound. Spoiler, Andrew Garfield's gonna save her. 100%. You can come back after the movie comes out. Tell me I'm wrong. I'll gladly eat my own words. I have a plate and a fork around here somewhere I can use. But until that time, let me know your thoughts on Spider-Man No Way Home and what you had to say about it. Were you blown away by this like you should be? For a third and final-ish Spider-Man entry? I don't know. Is he doing more? I really don't know. Or were you underwhelmed and honestly a bit perturbed by the whole thing? There's gonna be a lot of these reaction videos out. I don't know how badly I'll get buried. There's probably 563,000 of them already on the internet before I even get this edited because people are quick to the trigger and apparently have nothing better to do with their lives. So if you made it this far, maybe think about subscribing as well. And maybe we can get some of those obnoxious over-the-top reactors off of the front page and more honest people like myself there instead. Oh, here's to hoping. Take care.  You're disrespecting Dr. Strange. Woke! This movie's woke. I'm out. Holy woke. Wow. Go broke, Sony. Go broke, Marvel. Woke.


If you are a macOS developer and you've updated to Xcode 13 and created a new project, you may have noticed that there's this new method in the application delegate. Application supports secure, restoreable state, which by default returns yes. In this talk, I'm going to describe the vulnerability that necessitated this change and show how this could be applied for three different types of attacks. I'm Thijs Alkumaren, I'm a security researcher at Compute Test. Compute Test is a security testing company in the Netherlands. We provide security services like pen testing, incident response, code, all the things, stuff like that. But I'm together with my colleague Dan Keper, part of the research department, which means that we don't work for customers, but instead we can basically research anything that we think is important. So we try to look for stuff that has a lot of users or where impact can be large, just to make the world a little bit safer. Other work you may have seen from us is our zero-click RCE in Zoom at PontoOwn last year. And we won PontoOwn Miami this year with five different vulnerabilities in ICS systems. There's write-ups of these on our website if you want to know more about these. But today I'm going to be talking about macOS security, which has been a bit of a specialty for me. I've been doing a lot of work with macOS over the years. It's a system I really know the best. All of these were just incidents, but macOS is really where I'm passionate for. This talk will consist of three parts. First of all, I'll talk a little bit about the macOS security model because many people don't really understand how the security model works. Many people still have incorrect assumptions about how the security works on macOS. And then I'll describe the vulnerability that I found, a process injection vulnerability. And then in the third part, I'll demonstrate how this vulnerability could be applied for escaping the sandbox, privilege escalation, and bypassing SIP. So first of all, the macOS security model. So to describe the security model, I'll first describe the Unixi security model that used to be used by macOS as well. And the basic idea behind the security model is that users are security boundaries, but processes are not. So if you look at the permissions for files, then that is determined by the owner and the group. And there's these nine different bits that determine whether the owner or group or everybody is allowed to read, write, or execute that file. Also, if you want to attach a debugger to another process, then in general, those need to be running as the same user. There's one exception. There's the root user who always has access to all files, can attach to any process. And therefore, they can basically access all of the data on the system by just whether in memory or on disk, they can always get access to it. Now, this used to be the same security model as macOS has, but this has changed. So in 2015, with the release of El Capitan, Apple introduced system integrity protection. And this is a screenshot from the WWDC talk where they introduced this. And the basic idea behind system integrity protection was, at the time, there were two things. There was to make a security boundary between any process running as root and the kernel. And secondly, to protect the operating system from being modified even by the root user. So this feature is also known as rootless sometimes internally. Many people thought that that would mean that Apple would take the root user away from normal users like on iOS where you have no root user. But this is really not what's meant by that name. The idea behind it is that root is less powerful, so that's why it's rootless. But of course, there do need to be processes that can modify the system because you need to be able to install updates. So for that, what they use are entitlements, which are basically metadata that is included when generating a code signature for an application. So to do dangerous operations like loading a kernel extension, modifying the system files, or debugging a system process, you no longer need to be a specific user. But instead, the system will check if the process trying to do that has a certain entitlement. Now, this is SIP has over the years been extended by Apple with more and more restrictions. For example, debugging any application is now also forbidden by SIP unless the application specifically allows that. And there's this feature called data vaults. I have an example of that here. So Apple considers your email database, but also your iChat history or your Safari browsing history. That's very sensitive. So Apple doesn't want any process to be able to read that. So this is placed into what's known as the data vault. And as you can see, you cannot just list the contents of that directory. But even if you use sudo, you cannot list the contents of that directory. So the only processes that are allowed to access that directory are those that have a special entitlement. So your mail client, of course, needs to be able to access that directory. So it has this entitlement, com.apple.rootlist.storage.mail. And that gives it access to the mail data vault, which is that location that I showed before. So mail can access the files in there with any other process cannot. Of course, this new security model also introduces new types of vulnerabilities, or vulnerabilities become suddenly more important. One of those is what's known as process injection. And that's basically the ability for one process to execute code or to add code that the system thinks is another process. So the system thinks it's process B with the entitlement of process B, but actually process A specified the code that's being run. And when Apple introduced SIP on the right, there's this one slide of that presentation. They already disabled a lot of things that could be used for that, like TOS for PID or Dtrace, dynamic library environment variables, stuff like that. And also, they added the hardened runtime to make this also possible for third-party applications. If they opt into that hardened runtime, then it's not now also harder to inject into that process. But MacOS is old, it's large, it's established. So there's a lot of code that was written before this change in the security model. And it's really hard to really reevaluate the entire system when you make a change like this. Now, process injection is a vulnerability type that's found often in an incidental way. So you find a third-party application that it's missing the hardened runtime or something like that, or it has an exception. And that kind of impacts, like you could, for example, if an application has access to your webcam and you are more installed on that machine, then if you can inject into that other application, you can use that application's permission to access the webcam without the user being asked to give permission for that. And these attacks also often work by downgrading an application to an older version that did not have the hardened runtime. But of course, that's incidental process injection vulnerabilities. What's way more fun, of course, is if you have a process injection vulnerability that applies everywhere. So we get to this vulnerability CVE-2021-3873, which was a process injection vulnerability in AppKit, which therefore affected all of the applications that are developed using AppKit, which is basically the framework that you use for creating desktop applications on macOS. And this vulnerability was in a feature that's called SavedState, or also PersistentUI internally. And what this feature is used for is, for example, if you shut down your computer, it asks if you want to restore your open windows the next time you log in. And when it restores those windows, they will have the same locations. And if you have an unsafe document and you shut down and then the windows are recovered, then that document should still be there if they correctly implement this. Now, most of this works out of the box. There's nothing the application needs to do to opt in to this, but for document-based applications, it can be necessary that it stores some extra data about the document into that SavedState. So it can be extended, but by default, it already affects our works and all applications. Now, the way this works is that it stores a couple of files into a directory.  There's two files important here for this vulnerability. There's the windows.plist file. This is basically a list of all of the windows that the application had open with an encryption key for each window. And there's the data.data file, which is a custom format. As far as I know, it's not used anywhere else on macOS, but it's also a list of records. And each entry in that list corresponds to an entry from the Windows file, which contains an encrypted serialized object. Now, the encryption here, it's ASCBC. I have no idea why it's encrypted, because the key and the file are right next to each other. There's no different permissions for the files. So anything that can read that key can also read the file. So I don't understand why it's encrypted. There's also no integrity check on it at all. And the vulnerability here is that it was a serialized object using an insecure serializer, which means that it was possible to exploit it. Serialization vulnerabilities are very well known for languages like C-sharp or Java. They also affect Python and Ruby and a lot of other languages. But there hasn't been much published about it for macOS. Apple has a serialization format called NSCoding. And they also realized that these same serialization type vulnerabilities could affect it. So they introduced NSCure coding way back in 2012. So quite a long time ago already. And many uses of NSCoding where security is important now use that NSCure coding for variant. So it's often used for communication between processes. And it's exclusively the secure coding. And it's even apparently used within iMessage. If you send a message to another user, then that message is a serialized object. So you can see that the security of the secure version is very important. And to demonstrate the difference between the insecure and the secure version, in the insecure version, you first create the object. And then you can check, is this the correct type of what I expect? But for the secure version, you decode the object only if it is of a specific class. So the reason why this first version is insecure is that by the time you create it, it already exists. The constructor or something like that may have been called or the destructor might have been doing something. So that could lead to availability if those objects do stuff just by existing. So how would an attack like that work? So you could create a new saved state, write it to the directory with the new encryption key or something like that, and then ask the system to open the application. Then the application will automatically deserialize that object because it sees there's a saved state that it should be restoring. And then at that point you are now deserializing that object in another application, which could mean code execution in another application. But of course, now is the challenge. What malicious object can we write there? So I spent some time looking at prior work for this. One of the famous projects for generating serialized objects for Java is Y-socereal. And as for C-sharp, there's Y-socereal.net. But Y-socereal, Objective-C, does not exist. I also spent some time digging through some Google Project Sierra write-ups about serialization vulnerabilities, but those were targeting a secure version using specific vulnerabilities that have long since been fixed. So they were also not very useful for what I was trying to do. So I had to really come up with my own chain of objects to get that code execution. So how did I look for that? So I disassembled a lot of the objects that I could use. I loaded appkit into a decompiler and looked through all of the init with coder functions, which are the methods that are being called when a object is deserialized. And I noticed that many of those classes do not support secure coding. Also, often those classes are not really intended to be sent to another process. And they were also not very interesting from an attacking point of view because they were not doing very much. They were just recursively decoding some instance variables, but that didn't really help me. I wanted to do more than just decoding an object. But eventually I found a couple of objects that I could use. First of all, there's the NSRule editor. This is basically the widget that you have in mail if you create a mail rule to configure that. When this object is deserialized, it takes two objects from the archive, an owner and a keypath, and then it creates a binding using that keypath to the owner. Now, bindings are a sort of reactive programming technique in macOS, which means that you can directly connect a model to a view without having to create a controller to do all of the boilerplate work of updating the view or updating a model. And one interesting thing about creating a binding is that you can sort of specify a keypath. So that can be if your model is a person, then you can bind to the person's name or the person's child's name, something like that. You can sort of go through nested properties with a keypath. And those are intended to be used for properties, but there's basically no check that you're trying to actually bind to a property. You can also specify a method with no arguments, and that will also be possible to bind to. And at the moment that you create that binding, it will invoke that method. So you'll call that method to get an initial value for the binding. So by just deserializing this object, at this point I could call new methods, but only if they had no arguments. But it's a good first step. Then it's a second step. There's the NSKistonImageWrap. This takes two objects from the archive, a draw object and a draw method. And this is basically a selector. A selector is something like a function pointer, but for objective scene method. So it's the name of a method. And then in the draw function of this class, it would call that method on the object that it deserialized with one argument, namely the image wrap itself. So by combining this with the previous step, where we could call a method with no arguments, we can call the draw method on this object. And at this point we can now call methods even if they have arguments, but we don't have any control yet over those arguments. Now, for the sake of time, I have to skip a couple of steps here. Also for disclosure reasons, there's still some in-fix stuff in here. But I have two steps here. Now I can call zero argument methods. I could extend that to call arbitrary methods. But these are still only on objects that I can deserialize. And then I use the trick to also create objects that are not deserializable, objects that do not implement that protocol. And then I use a similar trick with a binding to call zero argument methods on those objects. Another trick to call arbitrary methods on those objects. And at this point I can... I also have control of the arguments here. So at this point I can basically call any objective C method that I want with arguments that I specify. So one thing I could do here is just evaluate Apple Scripts within the process. So this is already very powerful. So for example, if I was attacking mail, then I could use some Apple Scripts to copy some files from the data vault to a location where any process can read it or just read the contents and send it off to somewhere else. I can also execute a shell script or something like that from Apple Scripts. So at this point I was now executing code within another process, but it was limited to Apple Scripts. And for the attacks that I wanted to do later on, for two of them this was enough, but for one of them I really needed something that was equivalent to executing native code. So this Apple Script is very limited. There's no... Yeah, there's restriction of what you can do. So I had to go one step further. But as I mentioned, there's this hardened runtime that is meant to make attacks like this harder. So I could not create any memory pages that were JIT mapped, so not any executable and writeable pages. I could not create inside memory. I could not load any libraries that were not signed by either Apple or the same developer. This is library validation. I could not use dynamically linker environment variables, which is not relevant here. So it was really tricky to figure out how can I execute something that's equivalent to native code within all of these restrictions? And then I noticed that I could load Python framework. So Python was included in macOS at that time, and it was signed by Apple, so I can just load it into any process. And if you import the C types module, then you can evaluate basically something that's equivalent to native code. You can call C functions. You can create structures, stuff like that. And also, C types does not conflict with any of the restrictions of the hardened runtime. So many programming languages, you can create bindings, but they often need to be compiled and it doesn't work due to the hardened runtime. But now I had this challenge. I could call objective C methods, but I wanted to evaluate Python, and Python doesn't have an objective C API that I could call into. So I needed some intermediate step to bridge these two together. So I found another framework I could use, and this is the AppleScript objective C bridge. Now, this is basically AppleScript combined with access to the objective C runtime. So AppleScript that can basically call objective C methods, create objective C objects. And one interesting thing about this is that you can load new scripts into a process, but even when you have that hardened runtime and library validation, the scripts can be loaded from a bundle that is not signed. So I could put some new scripts into a new bundle, load only the scripts from that bundle, and they would be added to the objective C runtime. Now, with this I could create objective C objects, call methods, all of this I could already do before, but what is new here is that I could call C functions from objective C or the AppleScript objective C bridge. But one annoying restriction of this bridge is that I could not create non-object pointers, so pointers to anything else, then an objective C object. I could not create structs, and I could not work with any C strings that's just not supported by that language. And Python, in order to basically call anything, you need to pass it either a file path or the Python code that you want to evaluate. So you really need a character pointer to include either the path or some string that you want to evaluate. But then finally, I just break through something that worked. I could call py main with zero and nil, and that's a valid object in the AppleScript of F2C. And when you do this, it basically works as if you start a Python rappel. So it reads a script from standard input and then acts basically just like Python would if you launched it on the command line. So with this, I could then import C types and evaluate codes that's equivalent to native code. Now, if you think that AppleScript or Objective C, many people say it's verbose, but if you don't think it's verbose enough, then you really should work with the AppleScript Objective C bridge. I have an example here. So this is how you would call a method in the AppleScript Objective C bridge. So you really, you need to use that apostrophe to call new methods, and you'll get these really weird sentences that sort of look like they're supposed to be readable English, but it's really incomprehensible as a language. So to summarize the steps needed to get that code execution, we can evaluate AppleScript with the AppleScript Objective C bridge. Then we can evaluate Python. We can import the C types module. At this point, you can just evaluate code that's just equivalent to native code despite all of the restrictions of the hardened runtime and stuff like that. Now, how could we exploit this? I wanted to really make sure that I had all of the impact that this could have described in our report to Apple, so I tried to look for all of the different ways that this vulnerability could be applied. So first of all, to escape the Mac application sandbox. Now, what you see here is an open panel, and this may look like a very boring window that you see 100 times a day if you use macOS, but technically it's actually quite complicated because if you are in a sandboxed application, then that application doesn't know about all of your files. It cannot list all the files that you have because it's sandboxed. But if the user wants to open a file, then it would be really annoying if they cannot see their files in the application they are using. So Apple created this technology for that. While the window itself is part of the application, the actual contents of the window are being drawn by a different process. It basically works like an iframe on a website, so it's a different process drawing those contents. And that's an open and safe panel service. So this service does have access to your files, it's not sandboxed, and when you select a file in this panel and click OK, then the application will get temporary access to that file that it can then use to read or write that file. And one thing I noticed about this open panel if it was being opened is that this open and panel service was loading its saved state from the same directory as the application itself. So by creating a new malicious serialized object into that saved state, then triggering the opening of such a panel, it was possible to execute code within that open and safe panel service. And that service was not sandboxed, so at that point I have escaped sandboxed. I'm not completely sure why it was sharing that saved state, but it might have something to do with the user resizes that window and then they shut down their Mac, then it might need to restore the state of that window complete with the state of the panel and that might need to be separated by application. Something like that, I'm not entirely sure. And this was fixed earlier than the rest by Apple, this was fixed in 11.3 by no longer sharing that same saved state directory. The next step was to elevate privileges to root. And for this I basically used the same technique already found by Elias Morat written in all of the logic books for the WinWrited. I looked for an application with the entitlements com.apple.private.authorization services with a value for system install Apple software. And what this entitlement means is that this application is allowed to install packages that are signed by Apple without any authorization by the user. The user doesn't even see that something is happening. So this is used for example by the install command line developer tools application which can update certain parts of the system. And then this can be combined with this specific package, the macOS public beta access utility package. This package when it's installed to a disk, it will run a post install script so after the installation is finished it will run a script as root from the disk that you installed it to. But there's no check that you actually install it to a macOS disk. You can just install it to any disk, a disk image, a RAM disk, something like that. And it will still run that same path, the same command on that disk. So because mounting a disk does not require any root privileges, you can mount a disk, put a file on the same path, perform the installation of this package and then in the post install script it will invoke that script as root and therefore elevate privileges to root. And then finally to bypass SIP or the SIP file system restrictions part. Because I wanted to make sure that we had all of the possible attack servers mapped out, I looked at all of the applications I could find with what kind of entitlements they might have. So not just everything included in macOS, but they also looked at the better installation disk image. And there I found this very interesting application, the macOS update assistance application. And it turns out this has an entitlement com.apple.rootlist.install.heritable. And what this means is that it basically allowed to write to any SIP protected location or read from any SIP protected location on disk. And as a bonus, it's also heritable. So any sub-processes that start will also have the same permission, which is very easy because then you can just spawn reverse shell instead of having to work in process. And what can we do with the SIP bypass like this? So as mentioned earlier, you can read the mail database of a user. You can read the messages database of Safari history, stuff like that. We can also grant our own application permission to use the webcam. So we can just add ourselves to the database and then we can use the webcam without any permission by the user. We can also persist very well into the system because we could write ourselves to a location that is SIP protected. So for example, you could also remove the malware removal tool Apple uses to delete malware. Maybe you've even replaced it with our own malware. And at that point, Apple could still delete this from the system but any other AV vendor would not be able to delete it because it was SIP protected. And then finally, we can also load a kernel extension without user approval. So normally loading a kernel extension creates a prompt like that and then the user still needs to click a couple of times on the security preferences to really make sure that they want to load that kernel extension but we can just pre-approve any kernel extension to be loaded. Now, that doesn't directly give kernel code execution because you still need a validly signed kernel extension and because Apple is deprecating kernel extensions, getting such a certificate is pretty much impossible right now but because you can approve just any kernel extension we could look at all of them try to find one with the vulnerability we could abuse and then we could also get kernel code execution if we wanted to. But with the SIP file system bypass we already have a lot of access to all of the files on the system so we have already compromised a lot of the data there and kernel code execution. It would be a nice bonus but would not give that much extra access to the system. Now, here's a video to demonstrate this attack. This is on macOS 11.2.3, I think. First of all, it demonstrates that the sandbox application is actually sandboxed and then it will do the three steps in order here. The privilege escalation step is a little bit slower because it needs to create that RAM disk, do the installation to that. So as I'm not trying to be subtle, you can see the disk image appear on the desktop there. And then the next step should be a little bit faster. As you can see here, we now have a root shell, but not only that, we can also go to the System Policy Configuration Directory which is a location where the approved kernel extensions are stored in a database which is a very sensitive location normally protected by SIP and as we can demonstrate here, we could write a new file into this directory. Thank you. Now, about the fixes. So, with the release of Monterey, that new method that I showed at the start was added and applications can now indicate that they only accept secure, serialized objects. So Apple enabled this for all of their own applications, so the exploits previously were no longer possible, but third-party applications may use that ability to store their own objects in that saved state. So, therefore, that method is needed for applications so they can opt out if they don't support that yet. I'm not completely clear if it's still exploitable if the applications don't store any objects. I still need to look into that a bit more. This was reported to Apple on December 4th, 2020, and then they fixed the sandbox escape earlier than rest in 11.3 in April, and then they fixed it completely with the release of MacOS Monterey, which is in October 2021. Now, originally, I thought they did not backport this fix to the two older MacOS versions. Generally, Apple keeps supporting three versions, so the previous one and the one before. Within the release notes, it was only mentioned for MacOS Monterey when it was released. So I thought they didn't backport it, but then I was working on these slides and two weeks ago or something like that, I noticed that Apple had updated the release notes of the Catalina security updates. That was at the same time as Monterey. They updated this back in May, so half a year later, and they also now list this vulnerability as being fixed. And a week before I gave this for now, Apple Product Security emailed me spontaneously with ARC, you're going to do a talk at DevCon. Would you be willing to tell us what you're going to talk about? Maybe we can provide some feedback. So I just asked them, well, is it fixed in Catalina and Big Sur? Because it was not in the release notes for Big Sur, which is weird because it was in Catalina, which is the older version. And then yesterday at about 8 a.m., they got back to me and told me, yeah, it's supposed to be fixed in all of these. If you can still reproduce it, then please let us know. But that really wasn't enough time for me to look into it a bit more if it is actually fixed. So I still need to look a bit more into whether it was actually fixed in those older versions. So to conclude, Mac OSS security boundary between processes, not only between users, and process injection vulnerabilities are now very important because it can break those boundaries between processes and allow dangerous entitlements to be used by other processes. The CVE-2021-30-87-3 was a process injection vulnerability affecting all app kits-based applications, therefore allowing all powerful entitlements to be abused by malware. We demonstrated how it could be applied to escape the sandbox, elevate privileges to route, and to bypass the falseness and restrictions of SIP that was fixed in October last year. Some takeaways here. Mac OSS security keeps adding more and more defensive layers, but adding new layers to a established system is quite difficult. Code-written 10 years ago or more than that can suddenly become a tech service that nobody has thought about when it was being written. And also I think an interesting point here is that the effort of attackers may not really increase if you add more layers, if you can just use the same bug for bypassing multiple layers in the same way. So to make sure that security layers work, you really need to make sure that they actually are different enough that you cannot use the same technique. I have some references here about work that I used, the writer from alias for example, and some other resources about serialized objects. And we will publish a full writer with a lot more of the technical details that I had to skip. I will do this over the next couple of days at most. If you want to know more, follow me on Twitter or our research department. And I'll take any questions if you have them. Okay, so the question is, is there a remaining risk for enterprises and users? Well, I don't really know if older versions of macOS are vulnerable, as I said at the end. So updating to the latest version would be a good recommendation and keeping updated. Yeah, if you're developing an application yourself, then being aware of this type of vulnerability would also be important, but otherwise users cannot really do that much about this. There's not really any tools that can protect against something this, yeah, against this type of attack.


Hey, happy 4th of July. I hope you guys have an amazing day. I love 4th of July time with family even Little bit of grilling. Maybe some dogs. Maybe some sashes some Broward some burgers be careful though. I know fireworks are big Be careful with your digits. Also, maybe if you hit the pool, maybe with the lake Maybe you'll hang out.  Hope you guys an amazing happy 4th of July With your family your friends hanging out getting a suntan maybe getting all burnt my head's gonna start pillings That's back up back in Costa Rica for the end of the day Love the holiday and wish you guys a happy 4th of July


Ladies and gentlemen, nothing like building up a bit of tension for an afternoon demonstration. Thank you so much for your patience with any demonstration, and particularly I've discovered with the Internet of Things, it doesn't all go as planned. Welcome this afternoon to Drupal Raspberry Pi and Alcohol. Yes, there will be alcohol, but I do ask you to drink responsibly. My name's Mark Corbyn, I work with Acquia as a support engineer. I've been there for just over two years. I've been playing with Drupals since Drupal 5, and now I'm trying to get into Drupal 8. Look more at Drupal 8, obviously, with things coming in for that. I've also, I just wanted to say, this project that I'm about to show you started, I've been involved with the robotics club at the local school. And most of the robotics that the kids have been doing there has been with Lego Mindstorm. But some of them are quite aware of Arduino and Raspberry Pi. Their focus at the moment is on that sort of stuff, but with the intent to lead on to others. So the project that I'm demonstrating this afternoon started with that. So the little picture there is, it's not the best picture, but it's a little dog light. And what I set up, and it was just to show the kids what other things you can do with things like Raspberry Pi. It's a light, it's basically got a relay connected to a Pi and a motion detector. And basically to demonstrate, not only did the light come on, but it could make sounds and things like that. So the kids were very excited when we saw that. So that's the genesis of the project I'm going to show you this afternoon. What this is this afternoon is it's about combining Drupal, Raspberry Pi, Node.js and Arduino. I'm assuming, probably incorrectly, that most of you in this room know or are aware of those things. But please, if you want some clarification, speak up and we can do it as we go along. And most importantly, I think, which is why you're here, alcohol will be involved. The reason I mention that is there is, well actually, I think, yes, let's get straight into the demonstration. For this, ladies and gentlemen, I do have some props. Quickly, let's just go, would anyone like a beer? I'm looking for a volunteer, so your hand was up first. Who would you like to come forward to? So what I've got, could you pick a beer of your choice? And I'm hoping that they're Twistop, otherwise I may have a handy dandy bottle opener. Is it Twistop? Champion. Champion. Okay, would you like to pour yourself a glass, please?  Sorry, and what's your name? Gold. Could we give Gold a round of applause, please? Okay, oh. Looking at the head, that's the man who likes his beer. Gold, let me introduce you. Now, it's a little known fact that once Darth Vader passed away, and I do apologise for the height difficulties, but once Darth Vader passed away, it's a little known fact that he was actually converted into an alcohol breathalyzer. So what I've got here at the moment is Darth with a breathalyzer. Now, again, Murphy's Law, his eyes are lit up, but usually the lights will be off until there's alcohol detected. I'm suspecting there's either a wiring problem or I've had one of my props. One of my props was this, and I think the smell of the paint has actually been triggering stuff as well. So what I'm going to do, Gold, is I'm just going to set up a web page, and I'm anticipating that this won't work because I've been rushed into getting this going. Let me just test this bit, and then we should be right. I do apologise, ladies and gents. Gold, if you would like to take a sip or two of your beer, now, that would be fantastic.   I like that. No, due to his time restrictions. Yeah, and Murphy's Law, I'm now not able to load the page. OK, here we go. Wow, that's slower than I had hoped.  Now, I don't know, and I don't know if his eyes are going to light up more. So if you'd like to do the honours, please. No, write in, write in, get close into his mouth, into that grate. And I think you'll find, did we see that get brighter? No, I'm hoping, I'm hoping. The intent is that the lights should get brighter, depending on the level of alcohol. Thank you, Gold. You can actually take that beer as well. That's to say thank you very much. So that's the intent. The other intent, and I'm just going to... So what I've basically got, and let me... Yeah, let's go with that. Excuse me, could you do this, Anna, and hold that for me while I speak into it? So, ladies and gentlemen, what we've got here is a setup whereby I've got an alcohol sensor and I've got two LEDs. So this is the alcohol sensor, and that's basically stuck in the middle of Darth's mouth.  And these LEDs, as I said there, are controlled by the voltage, so the higher the voltage input, the brighter that they are. If you like, I'll pass those around, and I do trust you, Drupal, is that they'll come back. Essentially, the sensors, thank you. That's the sensors, and they're connected to an Arduino. They're not connected to a Raspberry Pi. And I'll explain why. Cool, all right, so we've done the demo. There we go. So this is the setup that we've got. Here's your two sensors, or three sensors, I should say, the two LEDs and the alcohol sensor. They're connected to an Arduino. The Arduino is connected to the Raspberry Pi, and then we're talking essentially through the browser and through Drupal and through Apache, which we'll get to, to make that all happen when it works correctly. So what I really wanted to do this afternoon is to just step you through each of those components and how they fit it together and why. So this is the first step in the project that I had to get working. The alcohol sensor, and I'm just gonna assume that the other sensors are there, is connected to an Arduino, connected to this thing called an I2C bus, which is an integrated to integrated bus. Essentially, it's a way that integrated circuit boards can talk to each other. The reason that I chose an Arduino over directly connecting it to the Raspberry Pi is that the output of the alcohol sensor is an analog output. So the Raspberry Pi will only take a digital signal. So that's 3.3 volts of a digital signal that we can only feed into that. Whereas we've got an analog here, the output of the sensor, and the Arduino will nicely take, this will actually take digital or analog, but for the purpose of this project, I'm feeding it as an analog. So the idea is basically I can get these two talking, detecting the alcohol and detect the level of voltage. And that will do that quite happily, and I could do that just with an Arduino program running on that. So the trick then was to go, how do I connect the Arduino to the Raspberry Pi? So again, yeah, I won't go through the programming for that, only because I've run out of time. But essentially, and again, if you're not very familiar with the Arduino, there's Arduino.cc, I would go to that website. It's pretty fantastic to explain about the Arduino, and more importantly, there's a free download to actually program it. So what you do is you write a program, which is essentially a loop to talk to, in this case, the analog signals to get those out and you'll talk to it over USB bus, a USB, yeah, USB link. So what we've done so far is we've connected up the sensors, and we've connected that to an Arduino. We've programmed the Arduino. I guess the other thing I didn't mention is that that Arduino is set up to ping every couple of milliseconds to say, is there any change? Is there any change? Or actually it says, give me the value that you're reading off the sensor. Give me the value that you're reading off the sensor. What we then do is feed this over to the ITC bus, which is essentially going into the Raspberry Pi. Now, as I went through this project, I was stuck with the problem of, I've got Drupal, which we all know and love, Apache, and I've got this thing here called an ITC bus.  So what I've discovered is this thing called Node.js, which I know the younger developers in this are probably right onto. This was a bit of a revelation for me, but essentially what we're doing is using Node.js as a server to essentially ping the Arduino, which is essentially pinging the alcohol sensor, and then we're gonna feed that to Drupal and see that on the page. So just quickly for those that aren't aware of, familiar with Node.js, it's in a C, asynchronous event JavaScript runtime. So it's essentially JavaScript, but it's triggered by events. So we're used to events such as click on a mouse, right click, left click, enter keys being pressed, things like that. All those get triggered and essentially will run a function through Node.js. Now, the other thing that I've found with Node.js is that there's this thing called Node.js package manager. So we're probably very familiar with the package management for Ubuntu or Red Hat package manager, so you're managing the applications there. This is essentially the same thing, but it's for Node.js applications. I'll come back to that. Yeah, okay, let me come back to that. So what we've essentially got, as I said, is a Node.js server, which is talking to the ITC bus to say, what have you got? But it's also talking to Drupal. So there were two things that I needed to set up to get this thing going. I had the server side for Node.js, which was basically getting the information essentially from the alcohol sensor, and then it was feeding it to Drupal to show the messages, and that's what I'll show you later. So what we're going to look at now is just a quick run through of the configuration for the Node.js server. The other thing to be aware of is that there's a package, so I mentioned before about NPM, Node.js package manager. There's a package that has been written called Drupal Node.js. That is a package that runs the server. And I'll just go back to this to say, when you have any of these packages, they will always have a thing called an app.js, so that's essentially your application that's running. To execute that, you use a command Node, and already we're confused because we're so used to Node in Drupal being associated with content. This is nothing, this is an actual executable that we run, and the argument that we give it is the app name, in this case app.js. You can also, so this will run, and depending on your application, this will run an app and finish. With this, there's another one called a forever command. That's essentially to run it as a server, so it will keep running this literally forever until you kill that process. So that's the two differences to be aware of with the Node.js stuff. So as I mentioned before, with the Node.js server, now we've got this thing called Drupal-Node.js. How do we install it?  So in this case, so the general thing is npm install module, and that will create, it always creates a node modules directory. And then under that directory will be, will be the packages, the Node.js packages that you wanna use. The beautiful thing is that not only will it install the package that you need, it'll actually pull in the other ones to add those in. One of the important packages that I use, well, essentially the Node.js Drupal module uses, is this thing called Socket.io. And that's essentially how I'm communicating from the Raspberry Pi through to the Drupal, ah, through to Drupal. So this is just a bit more detailed to explain. This is where it gets put, under Drupal-Node.js, and your files are in there, and your app.js is essentially running under there. And again, that's just to run it, and that'll run that server. Okay, what I might do is just show you, quickly, a configuration file. So, when we get the server, there's a couple of things that we need to configure. You need to configure a host, you need to configure the service key, and what's referred to as the backend. And that's essentially how you're speaking to Drupal with that. So let me just quickly get a configuration file to give you an idea. So, as you can see, is that readable, or is it too small? Three, four, three, two, one, here we go. There's your page now. All right, actually that's big enough. So, as you can see, this is literally just running under the home directory for the Raspberry Pi. So, because it's a server, we can run it from anywhere. I've just chosen to run it from, in this case, projects, Drupal-Node.js Pi, Node.js servers, Drupal-Sanpit. And this is where we see this node modules. So that means that I've used NPM install to install node, and that's the particular module that it's running. And if we just quickly look here in that directory, you can see that there's the app.js, this configuration file that I'm about to show you. And this will be the node modules, or the modules that NPM has installed that are needed by this particular module, Drupal-Node, to run. So if we have a look at Node.js.config, I didn't realize how hard it was to manipulate the keyboard whilst you're holding a microphone. Okay, so there's essentially two sections. So we've got the settings here. We can set the scheme, so it can be HTTP or HTTPS. The port that we're running on, we're just putting the server on 8080. The host, you can restrict it to one host. If it's left null, then you're basically letting any server access it. The important thing to sync this up with Drupal is to put in a service key. So I've just chosen a random service key there. The other section here is the backend. So that's essentially how is it configured for Drupal itself. So Drupal is running on port 80. It's the local host, so they're running on the same server. The scheme is the same. And the other important bit is the base path. So Drupal 7, which I don't know if you saw when I ran that from the browser. That's where it's currently running from. So just up here, I've got slash Drupal 7 for that. So that's essentially the configuration on the server side. Okay, cool. Okay, so we've configured our server. And that means that we can talk from Node.js to Drupal. The other bit, though, is I've got this alcohol sensor. How do I get that information into Drupal? So what this node module allows us to do is add these things because extensions. So I've got an extension here, alcoholDetector.extension. That's essentially written in Node.js. And that is basically what goes and pings the Raspberry Pi to say, give me the information about the alcohol sensor. Now, I've got it set up so that every two seconds it says, give me the value of the alcohol sensor. Give me the value of the alcohol sensor. And then that will display that on the screen if it's above a certain threshold. So yeah, that's just a bit more visual about those extensions. So you can put any number of extensions in to work. So they're essentially still running under that server, almost like mini modules, if you like. Okay, so we've spoken about the alcohol sensor. We've spoken about Arduino. We've got it to the Raspberry Pi. We've got this thing called a Drupal Node server running. Node.js server. Now, what do we do in Drupal? So in Drupal, the Node.js module consists of three main modules that you can use to communicate. So there's the integration module. There's a configuration module and the notifications module. So let me just show you that in under admin. So I've obviously enabled a couple of others, but here's our Node.js config, our integration. So you can see that's grayed out, which means that's dependent. The others depend on that. And we've got notifications. This essentially lets you configure the Node.js server settings. And this will have the way to talk to the server in it. So let me just show you that configuration. Would anyone else like another beer while they're waiting? Okay, so we can go into configuration here. And you can see there that that's a similar layout to when we looked in that configuration file. So we can define our protocol. Now, this server host is actually incorrect. I'm just gonna correct that now. And we've also got, this is the port that we're gonna talk to the Node.js server on. So let me just change that. Actually, one more thing. Before I change that, what you can do, the other beautiful thing that Node.js has is, if you go to admin report status, it's actually got a line to say, am I connecting to the Node.js? So in this case, it's not. If I change that configuration, we should see that. And if we refresh the admin page, there we go. So you see now, this is saying that Drupal is actually talking to the Node.js server. And what you're seeing there, which is what I was hoping it would work at the beginning. These are messages that pops up. I'm not sure how readable that is from the back, but it's basically saying alcohol detected with a number, I can smell it on your breath. What that is doing is basically getting that information from the alcohol sensor, feeding that through the Raspberry Pi, feeding that to the Drupal Node.js server, and then Drupal itself is seeing that. Now, where that's happening is essentially in the, there's that notifications module. Let me show you here. So what I really wanted to show you was, this is what's called the notification module. It's job in life is literally to take what's happening from any message that's sent from the Node.js server and display it as a black pop-up, like you saw that, in Drupal. What's happening, and this is probably the important bit, is that we're setting up this thing called a JGrowl, which is literally does the pop-up for us.  So because we've added that in, we can then go to our JavaScript where that's referencing, and that will actually detect the message from the Node.js server, and then display that as a message. So let me just show you that. So you can see here, we've got a dot, oh, sorry, we've got a dot JGrowl with a message and a header, and how long to display that for. So that's the JGrowl popping the message up. The important bit in relation to the Node.js server is that we've got this callback here. So essentially what's happening is, you've got a callback set up in Drupal, and that receives that from the Node.js server to say, if I get this particular callback, and remember when I talked about events at the beginning, that Node.js is event-driven, that is essentially looking for that event. If a message is sent from the Node.js server, then it will trigger that callback, and then display those messages at the beginning. Messages from the alcohol sensor, sorry. That's essentially it. Yeah, are there any questions? No, that was Drupal 7? Yeah, that's right, yeah. Yeah, that was, yeah, and that's probably what didn't quite make clear. If I go back to that slide, yeah, literally here. So you had Node.js server, and then your Drupal modules here. Yes, yeah, yeah, yeah. What I probably didn't make clear is there's essentially a message bus being set up between the two. And yeah, so essentially this knows to look for messages from this, yeah. So I didn't hear the first bit. Yes? Yeah, yeah, I haven't gone down that aspect. Yeah, I'd probably have to look at that more. Yeah, I suspect it won't be too easily. I mean, look, in one regard, to get this stuff working was a challenge. Documentation-wise, some of the stuff was a little bit old. What do you mean by that? Oh, I actually don't know, to tell you the truth, I apologize. Yeah, yeah, yeah. Yeah, yeah, no, I don't know, sorry, yeah. Thank you very much. If there's no other questions, ladies and gentlemen, thank you very much for your attention.


As 93 million eligible voters go to the poll on February 25 and March 11, the Independent National Electoral Commission, INEC, Security Agencies and other key stakeholders have been called upon to play neutrality to ensure free, fair and credible elections across the country. At a one-day sensitization program, Justice Development and Peace Caritas, JDBC, admonished all to exercise their franchise, plus CV News Correspondent Habila Darifi filed in this report. The Catholic body brings together youths, men and women to educate them on their voting rights. This is to encourage voter participation in electing outstanding leaders to govern them. The coordinator of the JDBC Kaduna, Reverend Father Joshua Archer says there is need to educate people as the many challenges we've developed in the country could lead to voter apathy. I've put this program together so that we can bring in representatives on the need for our people who are of eligible age to come out and vote this election. So we are saying to our people that in spite of all of these challenges that we have found ourselves in, we should still go out and ensure that we're able to exercise our franchise by casting out our votes on the day of election. INEC should ensure that these elections are free, fair, credible and verifiable just as they have promised. Stakeholders believe with new introduction of the Beavis Machines, votes will count. Sure voter apathy has been in the mindset of Nigerians and INEC has given us all the assurance that the Beavis Machines, when they say that we want to shift, make a paradigm shift from the usual votes that don't count to votes that count this time around. Every member of the Catholic Church is encouraged to vote for credible candidates, most especially candidates that will value your religion, candidates that will value human life which is most important. That's it a very great opportunity because there are so many things I've heard today I wish I've heard them earlier but nevertheless it's like a great opportunity for me and also to pass the information across to those who are not here. JDPC insists that four Nigerians should get it right this time around. Electroids must come out in mass to exercise their civic rights. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


My stomach was spinning so fast. I felt like I might flutter away.   I mean I don't have to go and I could drive I know how you like to get turned with your friends She smiled But I couldn't tell if it was at her phone or at me. I let my hopes rest on the former until she laughed I know she doesn't find me funny What's funny I tried to sound even it's my friend Damon. He posted something. I pulled out my phone, too Oh on Instagram. Let me check for the first time in what felt like hours She looked right at me How do you know Damon? I met him a few weeks ago for a bit. You don't remember. I mean I thought he was cool So I just followed him What you don't follow any of my friends on Instagram She raised her eyebrows Shook her head and then said something under her breath. I can't hear you How can I love you when you try to yourself in for me? My mouth went dry What did you just say? Chill I said it's hot in here. Can you take your hand off of my knee? How do you know Damon? Can you relate to either character in this story? Have you ever loved someone so intensely that you lost yourself in them? Or have you ever been loved so thoroughly that you couldn't help but lose interest and if yes, you're definitely not alone But the truth the matter is when two people become one There's no one left to connect you and love and desire are not the same things And they shouldn't be treated as such and this speaks to the work of one of my most favorite Sexologists Dr. Esther Perrell and she believes that desire needs space in order to thrive Just like fire needs air in order to grow now Of course this concept can be confusing because we often think about connectivity We think about it in the sense of love and love needs compassion Predictability it needs safety love needs to know and understand but desire the other hand desire likes mystery Desire likes separatism desire wants a sense of anxiety And that is where the balance comes in of maintaining a sense of self when we tell somebody that we need them That we can't live without them we reveal that they are the center of our world and that should never be the way that it is You have to remain at the center of your world and all things revolve around you Whatever it is that you create in your outside world You're choosing partners experiences and things that enhance you as opposed to consume you And so it's important to remember that when we are in loving relationships that yes We do want to surrender, but we absolutely still have to maintain and fight for a sense of self Now I want to ask a few questions of you guys to explore this topic more with yourself or with your partner number one Define desire and love and then answer this question do you think it's possible to be completely in love with someone else and Selfish at the same time shout out to Amber and Eva for starring in this video click this box Go on the info box below to follow them and watch my video on why I think nice people do finish last Girl


The Lagos State Governor of Ajide Somolu has reassured Legosians that his administration is determined to do more to ensure that it delivers more of the electoral promises to them. Somolu gave the assurance on Tuesday during a public lecture, book launch and stage play in commemoration of the inaugural week at the Moson Center on Nikon Lagos, plus TV news correspondent Laofi Kukou Yedekon files in this report. The hall was packed forward with people of all ages, class, creed and religion. They are here to witness the launch of the making of a bacon and presentation of a book titled The Incident Commander and a stage play titled Equals of the Drums in Honor of Governor Babajide Somolu. Governor Somolu would rather not take the moment for granted. He reassured Legosians that his administration is poised for more work to deliver on his electoral promises to them. Delivering the public lecture from our Deputy Vice Chancellor, University of Ibadan, Adigun Agbaji, urged the new administration to sustain delivery of democracy dividends to the people. He stressed that those who govern and those who envision governance needs to fully understand and appreciate the burden that they bear in the everyday life of their communities and people. Legos is one state where the leaders that govern and the leaders of thought are all imbued with the learning and the knowledge that is required to transform any community in the present circumstances to a leader in his own environment. He maintained that a state must be pointed more in the direction of greater and wider inclusion in the understanding that a democracy that works for all is not only desirable as a means to an end in itself but also achievable. Both the leaders of thought and the leaders of government and the leaders of the non-government sector in Legos who are here present. We have the responsibility to ensure that the right kind of democracy continues to be nurtured in Legos to ensure that in fact the kind of development for all that we are envisaging does continue to happen. Highlights of the event was a presentation of a stage play titled Equals of the Drums. Love Ikuku Uiedukum, Plastic the News. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


How to use Alexa to do workout? Hello everyone, this is Amit Dan of amitdan.com Today I'll have another episode of Alexa tips and tricks video and I'll talk about how to use Alexa as your gym instructor or how to use Alexa to do workout. If this is your first time here, a repeat visit, thank you for your support. On this channel I'm always trying new and different ideas. If that is something you're interested in, please visit for more. If you're only interested in Alexa videos, there will be links in the description box below. So Alexa has a skill which lets you do workout on your own using Alexa's help and in order to use the gym or workout feature, all you have to do is ask Alexa to start workout. So I'm going to show you today how you can do that. So let's say if you know what you're looking for then you can just Alexa directly. For example, let's say you'd like to do a 7-minute workout or you'd like to do a 5-minute workout. Then you can just Alexa directly. For example, Alexa start 5-minute workout. Okay, so you can see here that Alexa already started 5-minute workout and you can see. Do you want to open it? Alexa start 7-minute workout. Okay, so here we have another workout. Alexa stop. Just say like you know start your workout and if you know the name of the workout then it will start. Another way you can search through the name is that you know just to open Alexa app on your phone. So for example, I'm just going to show you right here. So let's say if you have Alexa on your phone just click on it and then you're looking for skills. So for example here you can see that you know skills, browser skills. If you click on that, if you don't see that option right on the homepage then you can also go to more which is going to be right here and then you're going for skills and games which is right here and both of them would take you to the same page. So what do you have to do? You have to just search for exercise or G-Mon workout or anything. Any word like that.  So that's one way of doing it and once you know which workout you want you can just like you know ask Alexa to open that works workout for the next time and then Alexa will do it. Now I have sorted through a few workouts and what I found out that you know these three are very popular. So for example one is called workout coach, one is called seven minute workout and one is called Tabata workout which is a high intense high intensity interval training workout. It's like you know a short burst of workouts in a very short time. There are many other workouts there's like you know five minute workout and there should be like 10 minute workout as well I haven't checked. So you can see that there's so many workouts so all you have to do is just you know ask. So let's do another example and see what Alexa says. Start Tabata workout. Welcome to the Tabata workout skill. You can ask me to start a workout. Start a workout for 10 sets or to learn more ask for help. Start for 10 sets. Okay starting 10 sets of Tabata. Get ready. Three, two, one. There are many more workouts like this you can try. Just a small tip that before you start any kind of workout please consult a physician or doctor to make sure that you know you're okay to work. Start that type of workout. This Alexa feature is very good to you know do workout or gym from home and especially when a lot of people are working from home these days it's kind of difficult to go to the gym so you can do workout at home just you know using Alexa's help. So thank you for watching this video there will be more videos coming up so I'll see you shortly. Thank you.