Our next speakers we have Ramiro and Niels and about two years ago at the CCC camp Ramiro told us about how to hack microcontrollers cheaply with an Arduino and similar electronics. Now here Niels are going to present the topic of Niels master's thesis. They are both security analysts and they have turned their attention towards cars and towards all the little microcontrollers and all the electronics inside it and they will show us why even a car that's where the code is coded to safety standards isn't necessarily secure. So please give a big warm welcome to Ramiro and Niels. Thanks everybody for being here. In the next 45 minutes more or less we'll talk about automotive microcontroller security. So first we will introduce a little bit what is for injection we will introduce what is the standards for automotive security. We'll explain as specific experiments we run on these microcontrollers and how we break how can we break JTAG in these microcontrollers and finally we will do some recommendations about how to prevent these attacks. So first let me introduce ourselves. I am Ramiro I am security analyst senior security analyst and my colleague is Niels maybe Niels you can move there so they can see you in the screen. We work at RISCure which is a small hardware security lab. We are specialized in hardware. We sell tools for hacking hardware and we also sell services, evaluations for embedded systems and chips. We have a lot of experience in many markets as markards, embedded systems, payment and in the maybe last two years we also focus on automotive. So when we came into this industry or we started to work with this industry we found the following. So this is what most of the people is doing or other analysts or other hackers are working on. So they are working on the services online or the connectivity between the car and the services or the car gateway, the buses, the cab buses and at the lowest level some of them are working at the ECU. So the ECU is the computer in the car. Maybe you know about these hacks, the Jeep hack I guess everybody knows this. Maybe you know about Tesla recently also has been hacked a few times in the past. The Nissan, Mitsubishi this was hacked with the application. So probably do you know many more examples than this. I think that in the past week they saw another attack on the car. So there are many of this. So a lot of people is working on these layers, especially in the communication between these layers, but we are focusing on what we are better in the lowest level of the hardware. So we are focusing on attacking the car from the microcontroller. This normally means side channel attacks and full injection attacks, which I don't know if you are familiar with this. So in case you are not familiar, I will explain what is full injection. So when you design embedded system, you choose a chip, a microcontroller, and then you go to the data set. And normally you find something like this. Like you can operate this microcontroller between 1.8 volts and 5.5. If you operate at lower voltage or higher voltage, they tell you that it's not safe, but they don't tell you really what is going to happen. But we can imagine that if we run for a long time about 5.5 volts, which is the limit in this microcontroller, for example, or below 1.8, we can imagine, we can guess that probably if we run about 5.5 volts, we will have fire. The chip is going to burn probably. And if we run below 1.8, the chip is going not to work, it's just going to sleep, it's not powered. But the question is, what happens if we have something like this? So we operate the microcontroller or the chip for just a few nanoseconds or microseconds above or under the range of recommended or the safe range of voltage. So when this happens, this is what we call a glitz. We have a glitz. Normally what happens is that because this signal, the glitz, the power peak is transferred to or is distributed across the chip in a different way. Certain IPs or certain hardware blocks will be affected by the glitz and certain will not. So for example, we affect the CPU and for few clock cycles, the CPU will not work, but the rest of the chip will work. So it can be that the inclusion model is still working all the way around. So when we do these glitzes, normally we have these kind of effects. We can have bits that flips. So we have in the memory or in the register, we have 0s and then they flip to 1s or we have 1s and they flip to 0s. We can prevent accesses to memories. So for example, the CPU tries to access to an internal SRAM or to an internal register and then with a glitz, you prevent the access. You make the logic to access to the memory to fail and then you return, you get 0s or you don't write whatever you wanted to write in the memory. We can skip instructions. So we have a CPU and it's running a set of instructions and then we inject a glitz in just one specific point. That point, the instruction that is running that point probably will not be executed. It will just skip. Sometimes we can disable modules. So we inject a glitz and a hardware module just will fail. JITAC or will be encryption or whatever. And sometimes we have a chip destruction. So we inject a glitz. Even for few nanoseconds or microseconds we have a set of voltage. It happens that maybe an internal trace of the power within the chip will be fused, will be burned. So this can happen. So in order to understand better what is if I for injection, I will let my colleague Nils to do a demo. Okay. So now to show you that it actually works. I have a small setup to demonstrate what fault injection can do. And I have a camera here to show you what I have on the table. So what I'm attacking is this small Arduino nano. It communicates over UR through these cables here. And the power comes through these two cables here. And if we follow the power, it goes through this amplifier which increases the amps because the tool that actually sends the power signal does not provide enough amps. And this power line will be glitched like we saw in the few slides ago. Now we need to figure out when we have to do this glitch. And for this we monitored the UART communication coming out here, which goes into this GPIO pin and it watches for a certain UART pattern. And when that pattern happens, this to this cable, a glitch, a trigger signal goes from one core to the other core. Because this little box here, spider is one of our in-house tools. And it is it contains two cores, spider core one and two. And spider core two can sniff data and then using the GPIO pins here, we send the signal to the other spider core. On this Arduino, there's a small piece of code running from a hardware capture deflect that we were running last year called the riskier hack me. And this is one of the challenges from that capture deflect. So what it does is it prints an initial message that says level one. And then it goes into an infinite loop here, which will print lock all the time. And now you have to exit this loop in order to obtain the flag in this final lines of code. And this code is running right now on the target, which I will show you in this terminal. So you can see here the lock message going on and on and if I reset, I get this level one message and then chip status lock, lock, lock, lock, lock. And now the goal is to use fault injection on this loop here. And then we go out of this loop and we try to get the flag that's hidden here. So for this, I have a small Python script to control the spider. Here's some setup, blah, blah, blah, blah. And this is where we I program the trigger on UART on the pattern lock. And then here we wait for this trigger. And when we see the trigger, we do a glitch, which is the short drop in power that we called the glitch before. So this will run with, will run not. Okay, so now it tries various parameters for this glitch to try and find parameters for which the glitch causes a fault. And that fault should contain the flag message in its output. So here we see a bunch of attempts being made. And depending on how difficult your target is, this can take days or weeks or minutes. In this case, the target is not that complicated. So if we leave this running for about an hour, we will start seeing a bunch of successful glitches. For this demo, I have some parameters that will do that a little quicker that I already found, which I will run now. And now you can see in the output that we get this flag message that we were looking for. And that's fault injection. Okay, one comment, we did the demo with our own hardware, but you can do the same with just very cheap hardware. You can just spend 20 years and a half a setup to do exactly the same. Actually, my colleagues here are going to think today or tomorrow to do some demonstrations of how to use cheap hardware to do this kind of attacks. If you're interested, just come to our village, RISKUFEFE, and then we can show you. Okay, so we see that if we, in this case, we were dropping the voltage. It was dropping the voltage, right? We were dropping the voltage below the recommended, and we were having these glitches. We could also go higher, and probably we would get also glitches. But we can also do more things. So for example, we can just try to play in this area, which is not recommended. So operate at higher speed, this micro controller, and with a voltage which is not in the safe area, and then we will have glitches. But basically, if we go to the data set of the micro controller, and we find specifications that the data set recommends you not to exceed, that's an interesting point to do a glitch. So for example, this is the data set of this device. Oh, sorry. Sorry, back. Yes. Exceeding these specifications will produce a glitch. Always that you exceed it in a very short period of time. If we go through the data set, for example, we find this specification for clock. And this is very interesting. Here they tell you that you cannot have between two periods, clock periods, you cannot have a difference bigger than 2% of the period. What happens if you exceed it? They don't tell you. What will happen is that you have a glitch, a clock glitch. The same with the reset. They tell you in the data set that what is the voltage for the reset, and what is the minimum pulse width of the reset. If you have a reset which is smaller, that 2.5 microseconds, what happens?  So we have different techniques to do glitching. We have voltage glitching, which is the one we have to do. We have the clock glitching, reset glitching, and then we have fancy ways of doing glitching, which is electromagnetic fall injection. We use a coil that generates EM pools to affect specific areas of the chip. So we want only to affect, for example, the crypto hardware. So then we put this coil on the surface of the chip, just wherever is the crypto hardware, and we inject EM pools. And then it will create a glitch in this IP. Only the IP we are targeting. Or we can use lasers. We can decap the chip, remove the packets of the chip, and then we inject photons with the laser to affect gates. So we can literally chain bits using this technique. Then you can also play with the temperature, but the problem is that you cannot do it very quickly. If the chip is operating at a room temperature, you cannot set it very high, very quickly, and then drop it again. So we use this mostly by raising the temperature, you can make the chip more sensitive to other glitches. So any of these previous techniques, I mentioned it, will have similar effects, all these effects. So you might think that this is not very common attack, that this is not very useful, that right now there is not many examples on life, on the wheel, that I will use these hardware techniques. But the thing is that many industries have been dealing with this problem for many years. And maybe you are not even aware of that. So maybe you know this. The Xbox, the chip for the Xbox was a recent glitch. You could hack the Xbox by putting a specific circuit which was glitching the recent line of the Xbox. The same with the Nintendo Wii. This one was doing a power glitch on the voltage of the CPU. This is a wasabi chip, I think. And if we go back in the time, I think it's the first reference I heard of using a glitching for breaking a game station console. The oldness, there was a way to break the anti-copy protection in the card rights in the games by using power glitch on a CPU or a security chip that they had. And maybe this is the ultimate age test. Anybody? Anybody knows the relation between these two? Yeah. Okay.  So I don't know. I remember when I was a kid, you could go to one of these arcade machines and use the PSO electric for a lighter. And this will generate a spark that will confuse the coin, the electronics that detect the coin and will give you credits for free. So still this trick is working. So there is some people that is doing it. This is a video from YouTube. They are not using a lighter. They are using something more sophisticated. It's creating electromagnetic pools. See the screen? I wonder if you can overflow it. Okay. Let's stop it. So games industry have been dealing with this problem for many years. But probably the industry that have been dealing with this problem for longest is smart cards. So this, for example, maybe you know what you heard about this. This is called Unlooper. This device at the right. It was used in the around year 2000 to unprotect, to glitch smart cards and protect them so you could watch pay TV for free. So this was used 17 years ago. The good news is that we have some techniques to prevent these kind of attacks. We can use software and we can use hardware to prevent. So we can design, we can code the software in a way that is more secure against these kind of fall-in-checking attacks. Normally these techniques are based on checking things twice. So for example, if you are checking a password, so you check first time and then you check a second time. Maybe they inject a glitch in the first time you were checking the password. But then you have a second check that will detect if there is any error and will not allow you to access to the system. So there are different techniques for software, software techniques, and there is also a lot of techniques for hardware. So team manufacturers can do something at hardware level to prevent glitches. Smart card manufacturers and secure chips manufacturers have been implementing these contraversers for many years now. One of the most common, or the two most common contraversers are monitoring the signals. So detecting any glitch, any peak in the power or in the clock or in the reset. And adding redundancy. So those models that are important or are critical for the security of the chip, they duplicate it and they run in parallel. So maybe a glitch will affect one of the modules but not the other. So by running in parallel, you have more chances of detecting the glitch. So when we started to work or to research in the automotive market, we already have a lot of experience in other segments, in other markets. And we tried to find or to assess what was the security level in automotive for against this kind of attacks, all injected on the side channel. Then the first thing we did is try to find standards against standards that define some kind of contraversers or regulations against this kind of attacks. The problem is that there is no standards. The closest thing is the ISO 26262, which is not a security standard. It's a safety standard. So if this standard regulates what happened, there is a problem in the chip that is in your car. So because the chips in the cars operate in a very noisy environment, there is a lot of noise because the engine or because, yeah, the engine, the sparks from the, you know, the book coils, I don't know the English word, the sparks for the engine. They introduce a lot of noise in the power of the ECUs, the computers in the car. There is a lot of regulations to prevent the chips to crash. So in this standard, ISO 26262, they talk about full injection, but as a technique to test if your chip is safe against this noise in normal operation of the engine or the car, the ECU. This standard defines the ACL, Automotive Safety Integrity Level. So this basically is a level which is given to devices based on the risk, the pressure to a risk, how it is to control the risk and the severity of the risk, and then you will get a level which can be from A to D, being A, the chips or, well, the system that are less safe, and D, the more safe systems in an automotive or in a car. There is also a QN level which is only given to devices that have no special mechanism to prevent anything, basically. So QM is just normal chips. So we took a look at this ACL-D safety mechanism that this automotive micro-controls have, and then we found the following that they implement these two mechanisms to prevent errors in the chip. So one is the CPU lockstep. So two CPUs run the same code at the same time, only that they are separated by a number of clock cycles. So if there is a problem, because, I don't know, gamma ray or because noise coming from the engine, whatever, maybe one CPU cannot execute properly the instruction, but the second CPU will. So the two CPUs are running in parallel, and they are comparing the output of the seclusion to see if there is the same. If it's not the same, there will be an interruption and there will be some kind of routine that stops in a safe way, the car, or whatever. And we also found that there is a lot of redundancy in memories. So many memories are redundant, so this way you can inject a glitch in one of the memories, flip one of the bits in the memory, but not the other. So these mechanisms are very similar to those that we found, or we find, in a full injection protected chips. So smart cars, for example. So we were wondering. We know ISO 2626, too, is about safety, can be also used as security, can be also protected, this standard against full injection techniques, because this is something that many people think. Many people think that the lockstep in the CPUs will prevent full injection to succeed in these chips. So this is the research we did. Nils? Yes. So this is where the experiments of my master thesis come in. So to investigate how effective these particular counter measures are that we find in the automotive target that microcontrollers, we took three chips. Two that fall on the ACLD spectrum, and one that falls all the way in the other side on the QM spectrum. So these two, the red and the blue chip will have these particular counter measures, so lockstep and parity checks, to prevent faults. And they also use various degrees of architecture. So these two have, the bottom two have arm, use the arm architecture, and the blue one uses PowerPC, which are the two most common architectures found in the automotive world. Then we took two techniques from the techniques that were just listed. We took voltage glitching that I demonstrated, and we also had a look at electromagnetic glitching. And the nice thing about electromagnetic glitching is that you can localize your glitch more than with voltage. In voltage you affect the entire power plane that you are glitching while with EM you can sort of target your glitch to a specific point on the chip. It's not as precise as a laser, of course, but it is still a nice upside. The downside here is that you also, in addition to finding when to glitch and how hard to glitch, you now also have to find where to glitch. So the initial thing we found in our experiments is that we could not successfully glitch the blue target with EM with voltage, so this was only glitched with EM, and the other two targets we could do both. Then we did two kinds of experiments. First we did characterization experiments, which are very simple snippets of code that was also similar to the snippet of code that was running on the Arduino that we just glitched. And the purpose of this is to find out if you can successfully inject falls in your target at all. One of the nicest characterization experiments we did here is where you simulate the behavior that happens when some authentication happens, and the result of that is stored in a flag, and in this case we just set it to one, and then if the flag is equal to zero, we are authenticated, and otherwise we are not authenticated. And you see here that the branch that says not authenticated should happen because flag is not zero. And what you can do with fault injection here, it's better to see if we switch to an assembly view of this code, so you will get a load flag instruction, then you will get a compare instruction, then based on the compare we will branch to a certain line in our instruction set. In this case we will go to the not authenticated line and continue. So if we just change this one red bit from one to zero, all of a sudden our branch instruction changes to a store instruction, which if it does not corrupt our execution flow in such a way that the system outright crashes will mean that effectively we have just erased this if check, and we are now authenticated. So any fancy authentication crypto stuff you can just bypass it afterwards. So we did these characterization experiments on the targets, and then what we have left with finding is when exactly this if check happens, and how hard we have to glitch to affect the amount of the bits that we want. So in order to do this, first we look at what happens in normal behavior, and from that we determine windows where we expect that glitches might be successful, and then we just start shooting that for a day or two, and we start plotting them in nice graphs to identify where sensitive areas are. So first you will see some green spots, which means nothing happened, and then you will also see yellow spots, which means that the target either died or reset. So we are glitching too hard in the yellow case, but not hard enough in the green case. And then if you set up your experiment correctly, you also start seeing successful glitches, and that's indicated by this red dot in this particular plot. And then we have one additional category, which is this pink on the left, which means that the glitch was detected by the countermesh is present in the targets. And then when you run this overnight, you do 100, 200, 300,000 attempts, and then you start getting these nice graphs where you can see that if you are glitching hard enough, but not too hard, then if you go into that sweet spot, you will have successful glitches, which in this case are not detected, which was a surprising result. So in this particular case, about 25% of the attempts were detected. And if we look into the registers of the target, we see that over 90% of these detections originate from the lock step mechanism, so where you have two cores doing the same thing. And then a smaller amount is because of the parity checks that are in place. Yeah, just to draw some numbers at you, if we find very specific fixed parameters for our ideal glitch, we are able to glitch the simple targets all the time. We are successful with our more ASIL D targets around 60% of the time. So for us this confirmed that safety is not the same as security, at least according to this standard. No, just a single fault. The question was, do we need two glitches? And the answer is no, we only have one glitch to do this. Why? That's a good question. We have some theories about that. We were expecting to have two glitches to need two glitches for affecting both CPUs, but we found that one single glitch is enough. And then we have two theories. One is that we are affecting the flash, so the flash pad. We are basically glitching before we are going here. So here somewhere. And the second theory is that because this is an ARM core, ARM Air 4, I think. It has seven stages pipeline. I think it was seven stages pipeline. So maybe because the pipeline seven stages needs, its instruction needs seven clock cycles. The CPU lockstep is separated for two clock cycles. If we inject a glitch, we are actually affecting the same instruction, but in different stages. So maybe the first core we affect during the fetching and the second core we affect during the seclusion. So still, we found this quite surprising to be honest. We were expecting to have, to need double glitch. Yeah, but we don't have detailed documentation and views into these targets, so it's very hard to determine exactly what happens. Okay, so now that we know that successfully inject false at our target, we wanted to do something more meaningful. And for this, we chose to attack the locking mechanisms in these targets that lock the JTAG down.  And from a more academic point of view, this is also interesting because before we knew what was running roughly so we can make guesses about where we have to inject our fault. And all these locking mechanisms happen in hardware or in ROM code that we don't have access to. So now we are basically, we have no idea where we have to glitch. So we need to find other techniques to investigate where we need to do fault injection. For this, we resorted to site channel analysis because by looking at the power consumption of a target in a locked target and in an unlocked target and then comparing the two power traces, we thought well, maybe we'll see a difference and that's likely where the JTAG is being locked. And we, if we do fault injection on that point, we will either keep the target in an unlocked state or unlock it. So, yes, what we do here, we take our power measurement, we see that we have power on, power off, but we still have no idea what's happening in the middle. And that's why we look at an unlocked and a locked version. So for the first target, we have, you see here, a brown line and a blue line. And that's, those lines represent the locked and the unlocked power trace. And when, here we see a very clear difference at this point. So here we do fault injection and we were able to keep the JTAG unlocked. Sorry, just to clarify what we did is just, we run. So from the data set, we knew that somehow the JTAG lock is being set up during the boot process of the chip. So we run the chip, unlock it, unlock it. So we have this chip, we both have developed a development board and then we program this board, one board with the JTAG lock and the other board without the JTAG lock. And then we were acquiring with a scope the boot up process and we compare both boot up process and we found a place where the power signal was different and we were assuming that because the only thing that changed from one board to the other is the JTAG lock, we assume that this is the point where the JTAG is configured. So what happens if we click here? Yes, thanks for clarifying that. We did the same on the other target and we found a similar pattern that if we configure more or less configurations for JTAG, we see a clear difference in how much power is consumed at this point and we do a fault injection here and again we were able to keep it open. The success rates are slightly lower than for the characterization. So if we start again with broad parameters, we narrow them down to what we find to be the optimal parameters and you see the percentages here. The simple target was very trivially unlockable, however the ACLD targets were slightly harder. We need around 100 attempts to get one unlocked also before we were able to completely bypass all the detection mechanisms and in this case we were not able to do this around 3% of the attempts were detected which means that if these detections are handled in a smart way you might break a few devices before you are actually able to unlock one however when you see the difference between 1 and 3% it means that you might just kill 3 out of 100 but 1 in 100 will be successful so if you just buy 10 you'll be fine and now my colleague will explain some of the consequences of what Okay, so we proved that using glitches in this ACLD automotive SOCs, microcontrollers we can change the flow of this program and with this technique we were able to unlock the gyta so what are the consequences of this so the most obvious one is that we can unlock the gyta we can steal the IP in the ECU in the microcontroller let's imagine for example there is a lot of companies which is putting a lot of money in researching autopilot for cars a competitor can take this ECU that do the autopilot break the gyta and extract the IP which will help them to develop their own autopilot for the car so this is an example of what can happen but if you dump the software then you can also try to reverse this software, this binary and use it to find vulnerabilities these vulnerabilities can be remote so if you dump, I don't know the telemetrics the telematic module or the module in the car that connects to web services dump the firmware, reverse and then try to find a buffer flow or something that you can exploit remotely you can also try to find keys so many of these these ECUs have some keys for example for the remote the remote to open the doors or for the OTAs for updating the firmware of the car remotely so there is some keys so you can try to reverse them so for example we are interested in the UDS keys these are the ones that are used to to update the firmware using the ODB2 port on the fly on the air update keys the remote and the mobilizer of course so to prevent the car to be stolen there are some keys maybe you remember this last year Flavio did a demonstration in Eusnix he was able to dump the firmware from a remote sorry not a remote it's from an ECU the ECU in the Volkswagen car that controls the remote he was able to dump the firmware he reversed the firmware and he found that in some cases the keys share and all the cars use the same key in other cases the keys derive it in a very simple way he was able to unlock almost all the Volkswagen cars so this is an example of what can happen with this if you can unlock the JTAH and extract the firmware you can use it to find more exploits or more vulnerabilities and maybe less obvious something that you can do also you open the JTAH is to modify the firmware this can be useful for tuning there is a lot of people that has been doing this for many years to add more power to the cars or to other things in the cars but this can also be used for sabotage let's imagine that somebody wants to kill a person in the past you cut the brake fluid cable now you can just break the JTAH update a new firmware and then make the car to collide or to crash when it's 120 kilometers per hour so this is a possible scenario and nobody will find any sabotage evidence because it's in the firmware so what can we do there are some things we can do the first and most obvious is to add countermeasures there is things you can do at hardware level and software level so even in the system that are already deployed using the current chips you can use software to minimize the risk or to mitigate a little bit the risk but the most important thing is maybe that you don't have to reinvent the wheel so there is already a lot of solutions out there smart cars manufacturers have been dealing with this problem for many years so if you go to internet and you search you google you will find a lot of papers a lot of papers talking about different countermeasures against phone injection so you don't need to do nothing fancy you can just only see what is people doing already there and a specific recommendation is that we found that many times we were trying to inject a glitch and the glitch was successful meaning that we were able to bypass the security mechanics we were trying to bypass but the chip detected that something was wrong so there is some register that indicates if the chip detects some kind of glitch or something that is wrong so it's very tempting it has a programmer to just ignore this so there is the chip says that there is something wrong and you don't process this interruption to I don't know to stop the chip it's very tempting to do that but if you do that maybe somebody is trying to do phone injection and disabling one of the safety mechanism yeah now we are doing more research continuing this this line of this topic we are trying to find of all the safety mechanics in these chips which ones are better to prevent glitches and we are trying to apply this attacks on real ECUs and real cars because all this we were doing in a development board for these chips so we were not really attacking a real ECU we were just buying these development boards and then trying because it was easy for us so now we are trying with real ECUs and finally we have a specific obsession let's call it with UDS which is a protocol in the car we are trying to break this protocol using phone injection thanks God there is now some standards they are being defined right now the 3061 J3061 and 3101 these standards will address this problem actually the 3061 the first part of this standard is already there and they talk about side channel and they talk about phone injection but they talk about this in a very superficial way in theory or I expect when they elaborate the next parts of this standard the part 2, part 3 they will talk with more detail about what do you have to protect against phone injection side channel A-C-S-I-E L like the ACL levels but for cyber security and this 30101 will also address this problem but this one is still working in so we don't know what is in there so maybe in the future there will be some standards and some protecting against this phone injection techniques oh no sorry this one if you want to know more details about this research we will publish a full paper in the VTC 2017 this is next month in September you will be able to download the paper with more details I know that this phone injection side channel is very confusing very abstract so you are interested in knowing more details tomorrow our colleagues will talk about how to use against phone injection to bypass secure boot and I think it's a phone I don't know tomorrow and we have in our billets we have some demos and workshops about phone injection side channel so you can come and visit us at 5 we will have a demo on side channel how to use open software tools for doing side channel if you are interested in that sorry it's in our tent it's called RISQ FEFE and it's next to the Spanish Spanish hacker space it's in the hopper field that's you can try to find us in the weekend so any question sorry I forgot something actually I forgot something I guess I forgot something sorry yeah you forgot something so I demonstrated this this fault injection on this small Arduino which was part of a capture the flag challenge we were running last year which is called the RISQ HACME and we are now in our third edition which goes lives on Monday so if you are interested in doing more hardware oriented capture the flag style challenges you should definitely register and we also added some automotive components and we are working with the company Argus cybersecurity to make automotive specific capture the flag challenges as well so if you are interested in hardware security for an injection side channel and automotive hacking then you should sign up for this we will send you a board if you qualify by passing some challenges we will send you a board with some challenges you have to hack and that's it any question thank you very much very interesting talk about something that I need to try out the next weekend so we now have about 12 minutes left for Q&A session please line up on the microphones in the middle and I see there is one question already hey there thanks for this great introduction to the topic and the demos I have a question about the ASL standard why did you choose the colors I wondered that you gave for the best class the red color I would give the green one but why give it a red one I don't know do you have an excuse I'm sorry the development board is red thank you hi how likely do you think it is that the development board doesn't have any protection against stopping this kind of injections because in the end it's only that whereas when they actually deploy it they will detect intrusions and say okay after three intrusions yeah we tested the safety mechanism or the security mechanism in the chip, within the chip because it's in the chip, this development board yeah have those of course manufacturers can put more detection mechanism in the entire system in the PCB they can put more but the thing is that you can always remove from the board and test it in your development board so you remove any of these mechanisms in our experience we normally have to modify a little bit these PCB boards because the capacitors in the VCC line in the power line filter the glitches so we always have to do small modifications in the boards so we will have to do the same for this real ECUs but I don't expect any kind of safety mechanism in the ECU hardware that we cannot bypass by just removing the chip and putting in a different development board any more questions please line up yeah one more did you kill some of your devices while testing I think one died because of the EM but that's it and we put one in the acid to see the how it was inside that definitely didn't work anymore thanks yes please how much of a problem is it actually to access the memory via JTAG because usually I think in my experience in larger boards the memory is usually externally so what can you actually do with a JTAG that you can just do by desoldering the flash whatever this is a microcontroller so normally when you have a microprocessor the memory is outside the microcontroller normally the memory is inside so of course if this is a microprocessor you can just tap directly the lines that go out of the tip and then you don't need to do all this you don't need to open the JTAG to get the firmware but in this case in microcontroller the firmware is inside the chip you need to open the JTAG in order to read it I believe that normally when they have external memory they encrypt it and they only decrypted once it's back into the controller yeah that's true some security features are quite common in some microcontrollers or microprocessors sorry those that implement secure boot normally they have encrypted flash sometimes encrypted DDR that's absolutely true and then in that case you can also use the JTAG to open it and then get the decrypted firmware one more question ok this way a lot of microcontrollers now come with encryption engines to make things possible quite quickly on the chip have you tried to focus attacks on that area of the dye using EM or maybe laser or other techniques to see if you could do something with that of course this is actually part of our work there is a specific technique called differential fall analysis where you use a glitz to affect the stages of the crypto engine and then by injecting different errors you get different outputs with the same key and then you can by comparing them you can extract the key without knowing which one is the key so if you are interested in that maybe the guy in front of me can give you a lot of explanation about this thank you very much if there are no more questions if there are more please line up I have one question so lots of microcontrollers almost all of them come with multiple supply pins have you tried how much different it makes if you just glitch one or a few of these supply pins to affect special areas of the chip sometimes these different pins are power and different internal power planes so one is for the analog electronics the other is for the maybe the CPU a different one is for the cantron sear so the first thing we have to figure out is which one is the one the CPU is running from and then we only inject the glitch in that but many times in the documentation you don't know because the documentation only say BCC so then we don't care we just try all so it will be less specialized or less specific glitch because might affect many things that we are not interested but at some point this is a game of of a statistic let's say we try one medium time for full injection attacks and then maybe one will work because you have one single one single glitch will be enough to unlock the JTAG and extract the pure war so cool so I see one more question when you do such an injection how long does one injection take is it milliseconds one second no it depends from target to target so normally it's often it's related with the speed of the CPU so if the speed is very fast and you do one microsecond you are affecting many clock cycles and then yeah probably you will kill the chip or crush the chip so normally it's related with the CPU speed but it's more in the range of nanoseconds like 60 nanoseconds to I think the longest I have seen is one microsecond I have okay I actually wonder how long you need to do the experiment glitching it many times in a row before you actually have a success are we talking half a minute or a day so the experiments that I showed you these percentages they are obtained after running a few days typically you turn it on before you go home you leave it running over the night you come back, you see your results and then based on your results you change your parameters and you iterate this process like three or four times and then you are successful so you need five days to find the real parameters so how much time you need to glitch where and what is the voltage and then when you repeat these parameters you have a high successful rate so then you can glitch it maybe in less than one minute so you have to try less than 100 times and then you will have a glitch so less than one minute or two minutes do I understand correctly that you reset the system between these attempts yes useful because sometimes the glitch affects some modules that you are not aware of so do you think that the CPU is working properly after glitch but some hardware model has been affected and then it's better to have a full glitch sorry a full reset before continuing glitching but it depends sometimes we do sometimes not but it is useful for example in this demo it takes about three seconds to completely boot the device so then I only reset when I stop getting responses or I was successful and every attempt if nothing seems to happen I just keep shooting and not resetting but next time the next boot everything might change quite a bit right in timing or different things happen it's still not you have to find a trigger point which is close to where you actually want to do your footage action you can't just start counting from boot time so yeah before you said there was only one glitch and not two in those two processors the lockstep how can you be sure of that or how can you count how many glitches there were we inject a glitch with our tools we say to our tools inject a glitch and we were expecting because there is two CPUs we were expecting to have to inject two glitches separated by two clock cycles but we found out that one single glitch is enough I don't know if this answered your question ok ok one more could it be that you actually glitched the comparator which that actually give you the result it could be but I don't think so the reason is because the comparation is combinational logic so you can affect it but immediately we'll get the previous value it could be but I think it's not very likely but it could be we don't know because we don't have the internal I don't know we don't know how it works internally if there are no more questions now you have the village you have the talk tomorrow yes maybe I can mention that if you want to see the demo more closely you can also come down to the village and it will be running there ok and then please give one more thanks to this awesome talk and to our speakers


Gold, Gold contract caught a bid up 15 bucks straight in the 1724, you get Silver market silver up by 23 cents, 1790, light sweet crude flat, $86.92 a barrel, notes and bonds. A 10-year note, up 21 ticks, trading 116, 20, the 30-year up a full point plus one tick at 135.05 in Kingdala. Kingdala is down 166, trading 109, 521, that's still at all-time highs, not all-time highs, but it broke its high and it's hanging up there. The euro is trading at about 99 to 1, the yen is out here at 140 and the British pound is trading at a price point of $1.15 to one US dollar. We get over and we take a look at the S&P first, you get a market bottom line, gave it up on price again, so the S&P yesterday when we were getting off the air had just missed the ABC structure on the way down, volume-wise, okay? That being said, guess what? The composite as well as the NBX100, they confirmed the ABC structures on the way down. So you take a look at the composite first, bottom line, volume came in the composite, this market's going right to the bottom, next stop is down here at these June lows. You go look at the NBX100, the 3Qs, you're going to see the 3Qs, 3Qs broke the B-point, broke it with volume, we did 57 million yesterday, we're breaking 51, that has a price projection, we're at 296 right now, that's 281. So if we take a look at that, you're going to see 281 is getting close to the bottom, that being said, that might take as we're going to this bottom, we'll see winds up happening on this deal. You've got to remember something, that ABC structures folks are straight line moves. The A to B is a straight line move, the C to D normally, okay, goes all over the place. What happens in a weak market, bottom line, it goes 2 or 3 days, and then goes south once again, that's the type of market that we have out here. Gold, we take a look at the gold market out here, what do we have with gold? You know, bottom line, I can't really say that it caught a bid, it's up 15 bucks, but better than being down, you know, what it did do is this, you know, the low, this is going to be a high or low, believe it or not, because the low is 1696, and yesterday we hit 1699. What has happened, that being said, though, and some of the gold equities, we have a couple tri-star dojis, which are very hard to do. Angle of gold is one of them. A tri-star doji is three dojis in a row with a gap down plus a gap up. That is a very powerful sign, folks. Stay right there, folks, come right back.


and welcome all to another excellent edition of the power trading hour as we start off the show about flat on the S&P cash. We were talking in the den earlier this morning and I think it probably for those people that weren't up at that time or haven't been in the markets that long. Margin calls are something that once or twice a year you'll probably run into. Most season traders don't spend a lot of time with margin although you have some especially when markets have been just going up and up and up and we saw a little bit of that when the market did break off the highs earlier in the year. But the reality is most people end up losing a lot of money on it and they quit using margin and they go to options or futures or something where the risk is a little bit better to find if there's a surprise probably not as much in futures as options. But we certainly kind of see those issues anyway. Margin calls are one of those things where we actually have a little bit of wiggle room and that wiggle room is more of a guideline than a rule. The code is more of what you call guidelines the actual rules. Yeah that's it on margin calls. Ideally if the market's moving down and against you if it's moving down what say medium speed or slower speed your broker will call you and say you can wire transfer money to us now or we'll sell whatever we need to to get you back into the amount of cash you need in your account. And it depends on how much it is. If you've got a big account they'll call you if not they may email you.  Assuming that at least they won't be a big loser and that you will bankrupt on them. Of course we saw that with Robin Hood earlier this year many many people that had fairly extensive margins got wiped out and Robin Hood was on the hook for it. I haven't heard a lot whether or not they've gone after the individual investors for that. I suspect with as many legal cases as they have bending they may not want to poke the bear too much on that. But anyway let's go to probably the most active margin provider in the market that's interactive brokers. You may see their ads where they actually offer margin rates at a third or have been adding margin rates at about a third of what most of the other like Ameritrade knows folks have. That is because they do go to a clientele that tends to be either higher portfolio value dollar value and or boutique hedge funds and these are the guys that probably double and triple down on being wrong and then the market moves against them even more. Anyway the idea is that they give you that time. Well you don't always have that time and of course the brokers on the hook for it. So what he wants to do is if he's at all thinking that you may have some problems he'll just sell your position. He doesn't have to give you a call. Doesn't have to do anything. If you check out the work or the documents you signed any kind of margin can be pulled at any time for any reason. If they just don't like the cut of your jib they can sell you out and in a heartbeat. Normally they will wait till 10 30 or 2 30 especially if they have bigger customers that are like hedge funds and may have millions and millions of dollars.  They will sell you out in a New York second. The reason I bring this up is we're getting to the times that you see the market's got to pull back and flat as we are. I suspect the reason why as many people know that there is at least some if not more volume coming in from some of this for selling. And you tend to see well let me put it this way the orders have to be pretty much taken care of by 2 30. Does it mean that you're going to get sold. But generally you're going to get I'm going to say 2 30 to 45 maybe 250. That's kind of the first round. Then secondarily a lot of the people that get warned are on the wrong side of the tracks on the trade will start having to have brokers call them like IBD and say hey you need to clean this up or we're going to clean it up for you. And what they'll do is they'll put in some market on closed orders yesterday. It's one of the first days in a long time. I ever saw any announcements of an imbalance. Now someone brought up 200 million dollars which is not much of an imbalance at all. You know it billions and billions is kind of what you end up with. So I'm not exactly sure if that 200 million was right. That someone brought it up and started talking about it. But again that's another thing you need to look for is on these fast moving markets is any announcement of imbalances. Because if there's a lot more to sell then there is to buy markets going lower. And there isn't a damn thing you can do about it. I always remember the story about Larry Pezzavento and his boss and some technical analysis guru that they'd hired to come in. Larry tells us about this a bit but it's in the... I'll think about it in a second. Anyway the story goes that this guy comes in and he says yes beans will exactly stop at whatever it was 10 cents or 15 cents or something a bushel. And he says that absolutely will not go any lower than that. So it get down to 15 cents and the head of the corporation picks up his phone he says sell 100,000 bushels and it goes from 15 cents to 13 cents or something. And he says he drops the phone and he goes if I can do that anybody can do that. And the moral of the story is that it doesn't matter what we know or what we think we know. In this case I think it was point and figure for the story. And I'll put it in the den here if I can dig it up but I think I've got it saved somewhere. Anyway it's a great story to let you know that no matter what you think of as a technical analyst you need to know that all it takes is somebody else that's got some weight behind them that wants to sell at a low or wants to buy at a high. And we need to know that we don't need we can't really be really that truly knowledgeable. We think that 15 cents may hold on a bushel of something but we don't know. No one knows. Prices are made in the minds of men not in the fields in the middle of the country. We'll be back in a minute. Blooming inflation we are purchasing powers eroded there's no better place to protect your hard earned money than in gold. This the golds flagship asset is the Monk Todd Gold Project in the Northern Territory of Australia. This is Australia's largest unveloped gold project. We are talking a world class gold project in a tier one mining district. This is a large scale low cost project with significant existing infrastructure in a politically safe and friendly mining jurisdiction. This the gold just completed the Mount Todd feasibility study which resulted in a 7 million ounce gold reserve in a 16 year mine life. All of this combined with the approvals of all major operational as well as environmental permits. This distinguishes Mount Todd as an attractive, dearest pot ready development stage gold project. This the gold trades on the New York Stock Exchange and the symbol VGZ. Are you grinding in the market but seeing little to no return or are you a successful trader simply looking to make your job a little easier? Learn to take the path of least resistance with David White's powerful trading newsletter. David White is an accomplished trader whose deep understanding of technology and the markets allows him to consistently find and share winning trades. Support and resistance define the ranges in which stocks trade. By understanding these trading ranges David White is able to find the path of least resistance. David White's trading newsletter The Path of Least Resistance is delivered daily before the markets open to make every trading day an easy win. Visit TFNN.com today and subscribe to David White's ultimate trading newsletter for $119 a month and try all of our newsletters risk-free with our 30-day money back guarantee. Take the path of least resistance at TFNN educating investors. Are you looking for a way to consistently add winning trades to your portfolio? Tom O'Brien is here to help. Tom O'Brien has been successfully trading markets for over 30 years. A frequent contributor to TD Ameritrade Network and CNBC Tom O'Brien founded TFNN over 20 years ago to help educate investors just like you. Tom's Daily Market Newsletter, Market Insights is published every morning when the markets open to give you the competitive informational edge you need to succeed. These newsletters are packed full of Tom's advanced technical analysis and are geared to deliver comprehensive strategies for a successful portfolio. Get Tom O'Brien's newsletter, Market Insights today and try all of our products and newsletters 30 days risk-free with our money back guarantee at TFNN.com. TFNN Educating Investors.<PHONE_NUMBER> internationally at<PHONE_NUMBER> As we come back about three points. As I said, everybody's kind of waiting and holding their breath over the next probably 30-45 minutes to see if we get anything and then of course keep an eye probably about 320-315. You normally get imbalanced notices and we could still see those. As we talked a little bit yesterday about it, Rail Strike maybe on Friday. This would be incredibly significant especially for energy prices. As a great deal of our gasoline is moved by rail now because they made it illegal to build any new pipelines. That adds about $2 maybe 250 a barrel on every barrel of crude here in the United States. There's some other stuff going on. I wrote about it this morning in the newsletter. We'll see how good I am on that prognostication. The other thing I think many people are looking at and of course they were absolutely savaged yesterday. I say savaged. That was the mortgages we found out today. Mortgage applications are down one-third over a calendar year ago. My guess is probably another two months. We're probably going to be down to 50 percent. Probably not too far. One of the things always, we never know how a market's going to go. I'm not predicting the end of the world anytime soon. But I will say that the biggest losses ever in Wall Street going back to the 1929 losses on the street in the massive crash, 80 percent of the money lost permanently lost in the market was lost in Reitz in 1929. Pretty much duplicated in the 80s and once again duplicated again in 2007-2008. As a measure of wealth, it's always a big deal. You want to keep your eye on it. And the question is, how fast can we get inflation down? Probably didn't do any good to have Rose Garden celebrations of inflation on one of the worst days in the market whatsoever. But hey, who am I to tell somebody how to live their life?<PHONE_NUMBER>,<PHONE_NUMBER>. Okay, let's see. What else do I want to go to? Oh, I wanted to do a little history. Let's do that. On this day in 1959, the Soviet space probe, Luna 2, crashes into the surface of the moon, becoming the first man-made object to reach the moon, as well as the first man-made object to reach any celestial body. Of course, this was the space race. Little did anybody know until about maybe 10, 15 years ago when documents were unsealed. But we had a president at the time, Dwight D. Eisenhower. And he wanted very much to have the Russians launch a satellite and put it over the United States. So they couldn't balk because we had a giant plan to put telescopes in those and aim them down at the Ruskies and see what they were doing. So he was well interested in letting them get kind of the early lead. Also, it would shock us into getting off the can, which we probably could be used the same kind of shock once again to get us moving here in the U.S. But I thought that was very interesting that they kept it very close to the vest. One of the gentlemen that actually had built a satellite had been driving around for months at a time with the satellite literally in the trunk of his car. It was ready to go at any time. He could drive it to the launch pad down at Kennedy. They'd stick it on there and we'd have our first Sputnik.  But our first satellite lasted about two months in the trunk of a car because we were more interested in making sure that we had the ability to take a peek at what the Ruskies were doing and didn't kind of let them have their day in the sun, only for us to have so many satellites that someone can hardly come out the front door where we can't see them in Russia. And now you know the rest of the story. Now you know the rest of the story on this day in 1959. Okay. So first of all, let's go ahead and take a look at some of these housing stocks. They were just savaged yesterday on big gaps down. As I said to many people and I got a bunch of emails about it, my three day rule on huge gaps down. And that is if you do not get an instant reversal the next day, I tend to look for more of the same. Now with all the volume yesterday, I still suspect that Toll Brothers is going to retest the $40.20 low that goes back into what is that? June 17th. It had 3.66 million dollars. And it's kind of hard to come up with a scenario where that doesn't happen. Sometimes though, you have to say that if everybody believes it, then it's problematic. It's very hard. What's the other one out there in the housing sector? Let's go ahead and do this because I do have a list of them here. Let's go back in here. Homebuilders or my homebuilders? My homeboys. Let's see how they're doing today. Mohawk carpets, one of Warren Buffett's big to-dos. He's owned this for a long time. Has broken and gone through the lows. Of course, they're the carpet and floor manufacturer for new houses. Not surprisingly, this thing had a nice 10-year run higher. Now, probably not so much. You've got a fairly big break today of a downtrend line. We'll see how the volume comes in, but it looks like it's going to be fairly significant. Others in this same sector are Armstrong worldwide in the flooring part.  You're going to retest the low in this one, 8191, which is on September 6th. Now the volume is about the same as that low. On the positive side, Hovenian, HOV, actually timely up a little bit today. I don't know if that's selling or saying a lot after it got pledged into the close yesterday, but just hanging on by a thread on HOV. We'll be back in a minute. If you want to take advantage of this sector, now is the time to subscribe to my Gold Report. The Gold Report is a comprehensive look at the metal sector as well as the markets that move gold, which is the currency and bond markets. New subscribers get a 30-day money-back guarantee, so you have nothing to lose. Every Monday morning, I publish the Gold Report with coverage of gold, silver, bonds, the XAU, HUI, GDX, as well as more than 30 different mining equities. To seep yourself, the types of profitable trades that are recommended within the Gold Report, sign up now by visiting tfnn.com. Don't miss out on the next great gold trade. Sign up today. From 8.30 a.m. to 4.00 p.m. Eastern. For free, each host is an experienced trader and gives their take on the market while taking calls and questions live from around the world. From the moment the market opens until the closing bell sounds, Tiger TV has eight different shows with expert hosts to help you make the right moves with your money. Watch online at tfnn.com or on TFNN's YouTube channel and become the investor you were born to be, TFNN. Educating investors. TFNN is excited about our new software charting program, The Art of Timing the Trade Charts. In collaboration with Tom O'Brien and using his best-selling book, The Art of Timing the Trade, Your Ultimate Trading Mastery System, David White has programmed an outstanding piece of software that will complement any trader's methodology. Using this first-of-its-kind program, The Art of Timing the Trade Charts allows you to scan thousands of stocks for Fibonacci formation setups, including guardleafs, ABCs, butterflies, and much more. The Art of Timing the Trade Charts is designed to help you when scouring the markets for stocks just beginning to form the trading patterns that many investors spend days, weeks, or even months searching to find. And right now, we're offering licenses available at only $79 a month. We are so confident that you're going to love this new charting software that will even give you a 30-day unconditional money back guarantee. Don't miss out on this incredible new piece of software. Get your copy of The Art of Timing the Trade Charts today by visiting TFNN.com. This segment is brought to you by Think or Swim. For more information, just click the Think or Swim banner on the front page of TFNN.com. We are at the start of what should be any kind of notifications to folks on and execution of margin polls. It'll be very interesting to see how much we had. We had some yesterday. And then, of course, the market on close. So we'll look at that. I had a question about Beezer on the last one. I think we're debating between three quarters and a 1 percent next Wednesday. My belief is that we're probably going to lean on the 1 percent. And I think you could see by next Wednesday, Beezer back down to 10 bucks and 9 cents. That low, or at least into the candle of that low on June 17th. It's very hard to see, you know, does it take a couple of days up and down? Does it just smack down on the news next Wednesday? I'd say the chances of getting into that candle are probably 80 percent. So pretty high. Now on the positive side, we've seen a lot of the strongest stocks yesterday that were in the solar side of the business. I think energy itself is getting ready, maybe in the next 60 days, to take a massive leap higher. I wrote about it in the tech insider this morning and a possible play. Don't have a lot of volume today in the follow-through, but even yesterday in the worst day of the market in a year, it held pretty firm. So you've got good relative strength in some of these solars. SPWR, let's take a look at that one. SPWR. Again, a little lower yesterday, a little higher today, not a whole lot. Certainly, these aren't ones that are blowing apart. And if you just looked at these absent of knowing what the market did yesterday, you wouldn't probably think a great deal. TAN, the Invesco Solar ETF, has just been going sideways for seven days. So not much going on in that. This one, EMRK is the weakest one in this bunch, but that's not saying a lot. It's RK, KR. All right, there it is. We'll bring that up. Yeah, it's just coming down and testing, but it's $2 stocks. I don't know if I'd make a great deal about that. First Solar FSLR, if you can type on this one, take a quick look. Now, this one, I would probably be ringing the register on this.  Back since June 15th, $60.96 to 140 bucks. And even yesterday, really wasn't deterred much, but you know what? You're probably going to get a fairly decent retrace on this one. And just a minimal retrace would take you back to 109.37. So that's pretty much in there. Maybe 112-ish. There's some fairly good support, and that wouldn't just be an ABC on the way higher. But we can look at that. Okay, we'll look at some other sectors and how they fared yesterday. Now, here's some stocks that really make their money on crack spreads. An old one there, an MPC was taking it for that one. And there we go. Yeah, I don't see much happening in here. You had a little bit of a gap down yesterday, volume did pick up. I'm not going to say that if you saw that on any other day, other than the day when the Nasdaq lost five or six points a percent, I need to say much about it. A little weaker. But I think these things are getting close to the point where they're going to take off. VLO is another one. I want to take a look at that. It's kind of the same pattern in this one. But it's just retesting the September 7th low. You've got four and a half million shares there. You've got about 2.9. So you want to see how the volume comes into that tomorrow. What else do we want to look at the S of Hs? All right. So let me get my list here of the semis. And I got a sneeze back from sneezing. Did I not have that list up here? I don't know. I don't know why. I should have it. Let's go ahead and just do it from memory. Take a look at applied materials. Again, these stocks already had some weakness in them, kind of priced in from not being able to sell into the Chinese market. You have a big gap down yesterday on volume. These things were probably going to retest previous lows anyway. So for the most part, kind of sold out a bit. But I still suspect we're going to see previous lows. In this case, the July 5th low at $82.67 is probably going to get retested. You have $89.03 is the last low. We're kind of hanging around those right now. I don't know if you can make a big deal about that. The usual suspects in the semis for the producers, for AMD. Just a little doji out here. Maybe the halfway move. So that's $85.76. So $8 more. You can get down to $68, if that's correct. Energy is about the same on the way up, same on the way down. But you're close enough to the July 5th low now at $71.60. You're probably going to get that retested before you find some kind of meaningful low at least in VDA. You had a lot of volume yesterday. Just really kind of got into the previous low. You had more volume. You wanted to come in with $65 million shares in Nvidia. You got $71.50. Not the end of the world volume today is about $44 million shares so far. But the energy off this top is fairly significant on Nvidia. On the SMH, the volume isn't incredibly horrible on the way back down. But certainly July 5th low on this one is $189.94. I think you got a probably 80% chance you're going to retest that candle. That was the 5th of July. We're starting to get a theme out here today. I don't know if there's going to be that much difference. I've got a couple of questions so we'll look at these here today. And by these, I mean LNG shippers. Frontline discontinues to go higher. I wouldn't chase it but certainly another good day. Volume is going to be more than it was on yesterday. TNK, there's always a bull market somewhere. Same kind of thing. TK, now you want to probably wait for the retrace in this case. I would look for the retrace to come back to around 25 bucks on this move and you could still get it. So I wouldn't get too much. David White has made his living staying on the cutting edge of technology. His weekly newsletter will give you specific recommendations for value tech stocks, as well as entry prices, target prices, and stops to set for each trade. Dave delivers his weekly newsletters every Friday with updates throughout the week. You can get the technology insider at tfnn.com for only $37.50. Sign up for David's newsletter, the technology insider, and get an inside look at everything the technology sector has to offer. Try it risk-free today with our 30-day money-back guarantee. TFNN, educating investors. Are China A shares hot or not? If you trade China A shares, now may be time to take a closer look. Trade CHAU or CHAD, Directions Daily CSI 300 China A share bull and bear ETFs. China A shares in either direction. Visit directioninvestments.com today. An investor should consider the investment objectives, risks, charges, and expenses of the direction shares carefully before investing. The prospectus and summary prospectus contain this and other information about direction shares. To obtain a prospectus or summary prospectus, please contact direction shares at<PHONE_NUMBER>. The prospectus or summary prospectus should be read carefully before investing. An investment in the funds is subject to risk including the possible loss of principal. The funds are designed to be utilized only by sophisticated investors such as traders and active investors. Distributor, Four Side Fund Services, LLC. Institutionally owned. There's only 5% of all the shares in the Dow that you can actually buy. That's down 35 today, so I don't put a lot into that. Russell 2000 I think is a lot more important. Hey, you got 2000 stocks in that, much harder to manipulate. Got a quick question on goal. We'll look at Golar LNG, first of all, just in a triangle pattern here, so I'm going to wait for it to break out one way or the other. If it broke down, then either that day or a couple of days after that, I'd probably be looking at picking it up, i.e. busting out of a triangle pattern here since the high on August 25th, not really looking too bad. So a bunch of those stocks in LNG that probably wouldn't look too bad. We do have Tim Ord on tomorrow, so get your questions into me for him tomorrow. We'll make sure he gets them in time. He tends to spend about 15 or 20 minutes on every stock, so it's not like giving him one gives him enough time to do what he does. Very long-term outlook on stuff and you can't just look at it like I do and give kind of a two-week, two-month, one-week kind of idea of where these are going. So anyway, tomorrow with Tim Ord.<PHONE_NUMBER>. We have some more emails here. We'll take a look at. Anyway, on gold, you gapped down yesterday. You got about the same on no volume today. So, yeah. I mean, yesterday volume was not all that exciting, so that's actually a positive. Really, the retest of 158.03, that was the July 20th low. You got into it 7.4 million shares. Yesterday, you got in with 6.5 million shares. Now, it's not going anywhere. And with raising interest rates, it's probably not going anywhere. But when this thing does turn around, probably fairly interesting. I mean, you had a monster move in gold in the 80s and that came out of raising interest rates in the late 70s and the first couple of years of the 80s. So, well, you have to wait a little while. You might. But is it doom and gloom out here? Well, certainly you don't have a lot of volume in these. But let's look at the GDX. We'll quick and see what we have here. Gold is rather legendary for wiping everybody out right before the turn. So, on a big move down, I'd be much more interested in it than I am here. Although, like I said, on a chart basis, doesn't look all that bad, but wouldn't get me involved in it. Certainly, the GDX, you're back to the support line 24.38. That goes back to July 25th. You broke through it with more volume, which indicates that, generally, you're going to at least come back and retest that low. That's $22.97. That's the September first low volume increased by about 10%. So, you're probably at least going to come back in the low 24s to test it. You may even get into this gap down, which was kind of a little bit of an island or abandoned baby or island reversal on September 1st. But again, you want that volume to be light and then pop back into the trading range. All you had was a handful of days where all the shorts got ran. Now, you want it to come back on light volume. Today's not a bad day. 13 million shares. Again, on a lot of these, I want them to come back down, blow the 3x3, have all the volume come out of it, and then the next move back above the 3x3 would probably be an indication where you'd want to look and see if you wanted to buy. Then, that's not a forecast, but a scenario. Okay, let's go to the emails. Okay, look at the EDZ. EDZ, which is the third world bear market. Kind of hanging up at these highs. It's hard to figure that if the dollar does something that is rather amazing that you can't get. Do I have it? Oh, I do have it here. Where's it at? There it is. That's the wrong one. Okay. And that's the wrong one. What am I looking for here on the dollar? 4x109 317. Been kind of working back in these things, but what a move. Back off the lows. It's hard to really get too excited about what that is happening in that at the moment. Let's take a look for Jim on the TLT. I'm kind of the off day. You have a little bit of counter trend rally here. Very light volume today. More volume yesterday. I still suspect this thing's in a trend. And there's dollar and bonds tend to be some of the best trending stuff over time. We've had the dollar a lot more manipulated than the bonds. But certainly, I continue to think when we look at this, that we're headed back down to where's those lows? I think it's 101 something, isn't it? In the TLT? Maybe it's much larger, longer than that. It was in there. It's 101 for the low. I'd have to fish it out there. I don't think that, I mean, you do have a little lighter volume than the previous lows. So maybe some consolidation energy is stronger down here. We get a 1% move next Wednesday.  And probably like a bullet on the TLT. Question on UNG. As I said, I'm thinking that this is just the opening salvo and what's going to be a huge move in energy for this fall. Variety of reasons I wrote about in the news letter this morning. There's some fairly nice one. Not today. Are you up? Yeah. Is it on a like volume? Certainly is. Probably going to consolidate out here for a while until the weather starts getting colder. But next real big move is a break above probably 33 or 34. And once you get that started, you could start thinking about some really rather large ABCs that continue on. When we come back, we'll do that ABC in the UNG on the QT. Vista Gold owns and operates the largest undeveloped gold project in Australia, the Mount Todd Gold Project. Vista Gold just completed their feasibility study, resulting in a 7 million ounce gold reserve. Vista Gold has all major permits approved and has retained CIBC capital market assistance in evaluating alternatives and in completing an accreted transaction. Vista Gold trades on the NYSE American and TSX under the ticker symbol VGZ. Vista Gold executing a strategy to create shareholder value. You might think that if you want to be successful at trading in the stock market, you're going to need a crystal ball. After all, it's impossible to predict the future, right? Like any endeavor in life, before you decide it's impossible, get some advice from the experts. You might find that it's not so impossible after all. For daily market overviews that give you direction on the key indices, selective stocks, and commodities, subscribe to the opening call newsletter at tfnn.com. The opening call newsletter is written by Basil Chapman, creator of the trading methodology known as the Chapman Wave. The Chapman Wave up-down sequence gives you an edge in identifying price turns. Finding the peaks and valleys in stock prices.  First-time subscribers also get a 30-day money back guarantee. If you're not satisfied, let us know and you'll get a full refund within 30 days of signing up. tfnn.com. Educating investors. Everything in the universe is governed by the Fibonacci sequence. This mathematical principle is responsible for everything from the most aesthetically pleasing artwork to patterns in the stock market. To stay on top of stock patterns you can take advantage of, sign up for the Fibonacci 24-7 newsletter at tfnn.com. When you subscribe you'll get a weekly report from veteran day trader Larry Pezzavento on stocks you need to pay attention to and you can trust Larry's analysis. After all, he's got 45 years experience as a day trader. Larry will also provide daily charts, videos, and data on the key markets that he's tracking. Expect notifications from Larry on market movement you need to act on at any time. First-time subscribers also get a 30-day money back guarantee. If you're not satisfied, let us know and you'll get a full refund within 30 days of signing up. Subscribe to the Fibonacci 24-7 newsletter today. tfnn.com. Educating investors. for just $1 for the year. There's no catch or added costs when you join our community of traders. Sign up today and become a part of this educational community of traders. Just visit the front page of tfnn.com. Catch Tom O'Brien, professional trader and educator, founder of TFNN. Also a special guest on CNBC. Tom will bisect and dissect the markets. The Tom O'Brien show next on TFNN. We go into a close. Just some things to think about. See if we get any more market on close orders, as we saw yesterday. Kind of drove the market in. I'm a big fan of waiting at least three days. Of course, this is quad-witching on Friday. And normally on options exploration, you expect the unexpected. But I think we could probably say we probably want to expect the unbelievable this week, because you can get it. There are a lot of cross currents. You might find a lot of people off sides, both up and down. It's a tough one to use options to figure out because they are so heavily hedged on these quad-witching days. But beyond that, we get a pretty good read into the rest of the fall after this Friday. So I'm looking forward to that. Again, we've got market on close orders. We've got probably a good idea that we want to watch and see what happens. Could you get a bounce on a strike being settled on Friday? Maybe. If you're not staying close to the machines, I think you're probably getting into Friday and through the next week. You'll have to because it's going to be a headline-driven market with maybe a minute or two minutes for you to make decisions either way for the kind of moves we had on Tuesday. So I'm looking for alternative stuff. As I said, I put it one in the newsletter this morning that won't be quite as affected by either interest rates and or some of the other stuff that's being bandied about and actually could do well and probably won't do badly if I don't get my projected move in what I think is going to happen. So just be very careful.  Sell when you can so you don't have days like we had yesterday. And we'll see you here tomorrow. Same bat channel, same bat time.


That was a funny comment. He's been working and doing Dell since he was, what, 1920? You were trying to figure that out earlier. You were right. We should have placed a bet. So what are you guys hearing from the people here? So far it's been really good. We had the Island up this morning. They were talking about how they're working with Dell, with the Ecologic, and compelling to drive different workloads in their cloud infrastructure. I liked Michael's comments around, we were on a greater good theme yesterday. And I like to hear what Dell is doing, Dell is going through some of their partners to advance things for the greater good. Island is doing some work with some pharmaceuticals to improve drug research and things like that. It's always fun to see where your product ends up. You build a storage device, right? But the hospitals and research firms and nonprofits, I was telling one customer story about the Royal Horticultural Society in London. So it's neat to see what you're doing. I was at Heineken last week, where they make beer, where our storage helps make beer. You were having beer last night too. I was having a new tagline, our storage helps make beer. Well, we always say we have fluid data, they're the ultimate fluid customer. Who's better than Heineken? But horticulture is important in pharmaceuticals as well, right? We find a lot of new compounds in different plants, things like that, get applied different ways. And the nice thing is it's all data intensive. It sounded like Michael was very interested in that medical field and using Dell products to move forward in that area and kind of push the limits in terms of how everything's organized and gathered. So that's interesting to me. I'm passionate about the medical industry from a technical perspective. Well, unfortunately, we're all going to need it too. Yeah, definitely. It has a personal importance for a lot of people. Absolutely. Walter, it's going to transform technology, actually, because it's so big in the data, you're talking about genomic research, and it's the next industry, I think. It's going to be really, really big. Just like the computer is going to change it, that's going to change things, and genomics is going to be a big piece of it. Definitely. Very data intensive. So one of the other things that you were talking about is innovation. You were saying the benefit of being small is that innovation comes easier, right? But the benefit of having a larger company and being big is the clout that comes along with it. Can you expand a little bit on that? Yeah, you know, it's like, take your young startup company, whatever. You can innovate in a single area really, really well, better than anyone. That's why I talked yesterday about all the innovations come from non-legacy vendors in the last decade. And so because you can focus on one problem and really change how you do it there.   So the nice thing is when you got something like Dell as the largest reseller, almost everybody's equipment, they work with you right away. So you're going to get access to their innovations sooner than others, and then you can innovate on top of that. So it's a different kind of innovation, you know, once you're established versus when you're starting up. But the only thing you got to do at the same time is don't lose that little small feeling in subgroups.  Right, and you talked about that. It's one of the reasons I think that you're running compelling, you're doing integration. You talked about having the integration team show up on a weekend, right? Two guys with the integration team. Very quickly. Very quickly. But you're also, it's Dell-compellent right now. And so you're using that to sort of help maintain the culture, and as you ease it in, what's the story there? I think they describe, Darren described really well, you want to integrate into the Bigger Dell, but don't lose the individual cultures and stuff. So they really let us do our own thing, and we have our own town hall meetings up there. The one thing I've noticed throughout the conference is that everybody talks about the culture and how great the culture is and all aspects of it. So I think that's just fantastic that you guys have been able to do that and it continues. Yeah, cultures are really hard to build. We actually have a name for ours. We call it Positive Aggressive. Positive Aggressive? Yeah, I've seen that quote before, and I meant to ask you yesterday to explain what Positive Aggressive is. That would be great. Yeah, the ultimate way to describe Positive Aggressive is ask anybody if they've ever worked at a negative aggressive company. And they know right away what it is. Okay, so it's basically not that. But the way to describe it is that we want to be as aggressive as any other competitor or person out there. So fight hard to win deals and get the best prices from vendors and make things happen sooner or later. So very aggressive. But doing it in a positive manner is kind of how you do it. It's just a different style.  If a rep wins a deal, others aren't jealous. They're actually excited because they got another reference they can work with. You don't have to take credit for everything. You want to credit others when things go right. It's a corny name, but it's actually, I've had employees... A little bit of touchy-feely there too. That's what I'm talking about. I've actually had employees tell me that they've tried to take Positive Aggressive into their personal life. How interesting. Which means it ended up being more than a slogan for them. They have to repeat the corporate slogan. That's one thing, but if they really try to personalize it, that's a good sign. That's very nice. And Dell's got a similar culture. They just don't have the word Positive Aggressive. And there's just a lot more of them. Maybe you can license it to them. That'd be a good idea. I should trade my time in it. Or trade secrets. That would be cool. Shouldn't have talked about it to them. I think that opportunity's passed. I think they bought that with a package. Is there anything that, when you guys were asking Michael any questions, is there anything that you found interesting or that you didn't know or that stuck out to you? I had heard most of it. It was fun to see him talk about Copilot. He got a lot of people telling him about our Copilot last night and how important it is and how differentiated it is. He already knew it. He's already heard it. It was very supportive of it. He actually does his homework. He does his homework. He's a very engaged CEO. Very engaged in both with customers and employees. He knows what's going on there. No, I think it was kind of what I expected, frankly. I'm a little curious. How did the deal happen? Can you give us a city call on that? A little negotiating. Negotiations are negotiations. It's been nasty. It's kind of funny. It actually started. One of the last times we did this, you guys, is at VMworld. We did a joint press conference with Heineken at VMworld. Actually, on the way to VMworld, somebody got the first call. They said, hey, we need to talk and learn more about you guys. So they reached out. And you didn't talk about that on air on theCUBE? I didn't. I know. theCUBE would... I was waiting for Oprah. I don't know. Oh, outs! That wasn't good. County is the next hope. You know that, right? I know it. I know it. So then you got to understand what we have and some joint meetings there with a lot of smart people and due diligence and it was kind of a fun story. We met in a hotel room and you got to kind of be incognito. Yeah. So you can't put, you know, this room reserved for Dell and Compellant, right? Right. It's probably not good for Wall Street rumors. Yeah. So my assistant's name is Lynette Wolfe. Yeah. And I said, well, just say it's Wolfe Enterprises meeting in that room. So I gave her a necklace, you know, with the chairman of the board of Wolfe Enterprises. But the Dell guys, I thought that that's what we, our connotation was, they're a big wolf that was going to eat us. So I just might know that's Lynette's last name. Good, good. That's funny.  So then, but in fact, it's about open recs and let's get going. Cool story. All right. So even just since we announced the deal, we've got almost 200 people. How many are you now? We're a little, about over 700. Okay. And we'll keep growing this year. And it's, you know, it's, lots of different functional functional areas, but a lot in engineering, support and sales. So that's exciting. That's pretty cool. You talked about how it was, you were hiring as the deal was going on and how it was super easy and probably the most efficient acquisition yet, right? Don't get me right. It's hard work. Well, of course. Of course. And the Dell people have a few more people to work on it than we did too, right? But that time between when we announced the deal until we closed it, we worked a lot on integration planning, which that planning can save you a lot of pain after it really happens. So that paid off. It really did. And hiring in anticipation of the growth and avoids, you know, having support problems or things like that later on. If you were to do it again, would you change anything in that process? On the integration part? Yeah. The negotiation part. The negotiation, you always do something different. Yes, exactly. But no, it's the hard parts that's going to be hard. You can redo it, but I think it'll be disassured in other ways. Okay. You've started two companies, right? I'm getting that right. Any advice for startups? Yeah, the one advice I tell them is that if you feel like you want to do it, do it. I have a lot of people tell me that they're worried about the risk and all that stuff there. And one thing I tell them is that when you do a startup, there's actually less stress. And the reason being is you control it. So it's stressful, don't get it wrong, but it's one that's a controllable stress where if you want to change it tomorrow, you change it tomorrow, right? It's you. So you don't have to worry about something else getting in your way. So if you got that bug, we need more going on in this economy. Where do you see the big areas, opportunities for innovation? Storage has been a lot of innovation and you brought a lot of it to market through your two companies. But where do you see the big unmet need today? Well, I think in addition to storage, I think security is going to be huge. And it's going to get more and more important to it, not that it's not important now, but I think issues are going to happen and it's going to get really key for us to handle those types of things. This whole integration of things is making it automated, integrated, that type of thing. There's been a lot of innovation in that front there too. We've got a lot of pieces and parts out there now, right? We need to kind of make it a little bit more of a seamless effort in that front there. So you founded both companies with the same two guys, right? What are they doing now? One example, my partner John is really into actually genomics research. He's really into that. At a scientist level, not just kind of He was your CTO, right? He was the COO, but just a brilliant guy there. And Larry, my wife was just at the son's graduation party, so he's getting kids graduated from high school right now. Oh, he's going to have some free time now. Yeah, he's getting one of the kids out of the house there, so. Okay. All right. But no new startups yet for them? No, nothing to talk about. I'm just focusing on growing just a billion dollars. No, I don't mean, Oh, not for you. I meant for your former partners. We wouldn't approve. No. We want you to focus. That's good. Watch your back in the cube. That's good. So. Well, um... Yes? I just wanted to make sure that we don't keep him longer than we have to. Yeah. But we're good. Cool. We get to keep him for longer. Okay, okay. Darren's there if you need Darren up here too. Yeah, yeah. We can get Darren on in a bit. Okay. Right? So, you know, I guess just going back to the keynote. Do you still get nervous going up on stage? Or are you... Oh, that's just a question. See, I keep going there with him, right? Yeah. I don't know. Do I look nervous? No, you don't.  I just wonder, you look very relaxed.   We're young friends, not old friends. You wouldn't dare when we're going at it.  Right. You've got to kind of have a little bit of that nervous feeling there. But it's not like I fred over it. Right. I've done a few. I'm an old school teacher. I guess that comes in handy again. Oh, that's right. Yeah. We were talking a little yesterday about that. Nothing tougher than being up in front of teenagers, right? Yeah, that's right. It's just hard up there.   I wasn't sure if they got them because you can't hear the laughter as well on the stage, right? No, they were laughing hard. We were all laughing hard. So you see friends out there and that kind of makes you relax and try to make it be normal. Absolutely. What's the toughest questions you've been asked at the show? Oh, you know, the channel partners have asked things about, you know, direct versus channel. You know, those have been ones we've got to address there. You know, how quick can you get some products out that people are waiting for? Yeah. They're excited about a roadmap and those are all you want today, not tomorrow. Right. But we're a real short term on a lot of those things. Expand them. Good answers there. You talked a little bit about that timing up on stage too. Can you expand a little bit on that in terms of the pressures that you have and the things that you're trying to fix before you go to market, obviously? Right. Well, one thing that's really nice too when we got together with our engineering teams and kind of combined the roadmaps, you know, all the things we're working on are right at the top of the roadmap. Yeah. So we're already working on it. And some things we're in the process of doing, Dell had already started some efforts in those areas, you know, de-duplication and, you know, the scalable file system. Right. We call it the fluid file system. So the nice thing is we're going to be able to leverage some of those initiatives and kind of accelerate our endeavors there. So it's gotten really, really integration has gotten really well. And the timing is there's just a lot more people to get going and deliver on that timing. And that takes a while for people to get productive. All right. You have anything else? I think we're good.  I appreciate it. Always good to see you. Okay.


No one is smart enough to be a hundred percent wrong, right? So what that means is that everybody is holding some piece of a truth and they're also partial, so everything is true but partial. So when we begin to look at the world with a hermeneutic of generosity, we interpret the world with a generous spirit. We begin to say, oh, well, there must be some truth in that. Even if there's a lot of it that might be partial, there's something true there. We begin to look at the world with this generous spirit. We see, oh, everything actually has something to offer, something to contribute, and that to me is the gift of an integral theory, is that we begin to see a much more robust and rich and pluralistic experience of reality that also is a unfolding throughout time in a really incredible way that can benefit all of us and the planet and beyond. To me, that's super exciting. So North-South-East-West, this is the global wisdom tradition that's unfolding as an integration of all these streams into one great human tradition.


It wasn't an easy road and it took a four overtime section championship game against Brainerd Little Falls to get there, but the Roseau Girls hockey team is headed to state. This will be the Rams first trip in three years, but they're ready to make some noise. After two straight years losing in the section eight to a championship game, the Roseau Girls hockey team was finally able to break through to state with a three to four overtime victory over Brainerd Little Falls last week. Finally like making it in four over times it made it really that much much more special. It still just doesn't feel like real like it it's just overwhelming and it's so exciting. For me and the other coaches I think we just leaned back against the glass in the box and it was just a huge relief. Now the Rams are headed to their fifth state tournament in the past 10 years, but unlike their previous three appearances, this will be the first time at state for every player on the roster. Our girls aren't going to be afraid of anything. It's a big stage in the XL Energy Center, but they're excited to be there. They're not going to be scared going in there for sure. I'll tell you that they're and so they're going to play with confidence and I think we'll be on top of our game. They come into the tournament unseated and will face second seated Blaine in the first round and while the rest of the state may not be high on them, the Rams views are the exact opposite. We're playing the number two seed, but that doesn't mean we can't win or anything. We're going to compete with them and we should be able to get it done. Everybody's zero on zero and we just really feel like if we just seriously go out there and play the way we do, which is an aggressive style of play and just go after the other team, we have a chance no matter who it is. The Rams have won 13 of their last 15 games and they believe they're playing their best hockey right now and they're ready to put the state on notice. There's a lot of pride obviously in this community, in this school where the Rozo Rams, the girls know that and they want to give it a really good showing. That's why I know our girls aren't going to be afraid of anything when they go down there and they're going to play really well. If you've enjoyed this segment of Lakeland News, please consider making a tax deductible contribution to Lakeland Public Television.