What is going on guys welcome back to the channel critical overlord here So recent reports came out or suggest recent reports that came out are suggesting that Tommy Doyle the Child that Lori showed babies babysat in the original film from 1978 Who was played by Brian Andrews at the time and later on in Halloween 6 played by? Paul Rudd Recent reports are suggesting that Tommy Doyle is going to be back present in the franchise in the upcoming Halloween kills They the reports also suggest that Paul Rudd was The was in talks with the people involved with the film, but he turned down the offer Or turned down participating in the project due to his obligations to a project already I think it was ghostbusters me personally. I I'm hoping I'm glad Paul Rudd is not coming back Nothing against the actor himself, but I just didn't feel like he as Tommy Doyle the way they had Tommy Dueling Halloween 6. I don't think that's how Tommy Doyle would have ended up as In regards to what happened in the original film. I don't think Tommy Duel would have ended up like that I feel like they if if possible They should try to get back Brian Andrews But if I'm recalling correctly, I believe the report mentioned that someone else was already in line to step into the role Regardless, I hope that the characterization of Tommy Doyle is severely different from how he was presented in Halloween 6 In Halloween 6. He's he's like obsessed with Michael Myers. He doesn't seem to have fully recovered It never was the same after those attacks that night He kind of was a little bit He just it didn't seem like the proper the proper stuff that would it didn't seem like something that would naturally happen And if maybe that can be after Attribute to how Paul Rudd was portraying the character. Maybe Paul Rudd wasn't For train Tommy Doyle in such a great light. I mean Paul Rudd as an actor He's not one of the best in my opinion. He's decent of His performance in Halloween 6 nothing really impressed me there But it also wasn't anything that like that. I would say was all in all bad I really would like to see Brian Andrews back in this role But the reports are suggesting that Tommy Doyle is going to be in Halloween kills now what that means I'm kind of thinking that this will play out. I have some ideas on how it would play out one idea I would like to see play out would be Jamie Lee Curtis's character Laurie strolled recognizing one of the people at the hospital. I'm assuming they're going to Recognizing one of the staff members as Tommy Doyle Tommy Doyle recognizes Laurie they reconnect talk about everything that's occurred over the past 40 years of how shocked they are that one of the other is still in town It was just I just feel like that would be kind of the natural progressive thing to do in regards to Bringing Tommy Doyle back and have if you're gonna bring him back There needs to be that reconnection with Laurie strolled They need to talk about the missing years and that's happened in between since they were initially attacked by Michael Myers At Tommy's house or the Doyle house. I believe it was that I believe it was Tommy's house at Tommy's house in the original film of Tommy could be a ally for them. Obviously His longevity with this. I don't think Tommy Doyle should make it out of the film alive per se If he does I would like to see him have like a minor some type of minor involvement I don't think Tommy Doyle should be like a full-blown character in Halloween kills if they do that That's that's fine as well. I just don't think that Tommy Doyle should be a full-blown character in Like a full-blown Participant in regards to what's going on with this the strolled trio of women I don't think he should be a factor in that in like a major way I think it would be nice to have just a small appearance from him and Maybe he assists somehow and then that's it. He's he's done, but if he's back in an ally role per se with the Stroll women. I wouldn't be against that either I'm just I'm just more inclined and would like to see just a minor appearance from the character. That's just me personally I'm really looking forward to seeing what happens with this news and what comes out of this I want to see who they have lined up to portray this character now again This doesn't mean the reports are official or that anything that I'm saying is actually gonna come to fruition But reports are suggesting that Tommy Doyle will be returning in Halloween kills the character of Tommy Doyle will be back in Haddonfield I do not know if it's actually correct Blumhouse is yet to make announcement, but once we start hearing things coming out about the film I'm assuming we'll actually have a concrete answer where the guard. This is true or not But I'm hoping it is because if Tommy Doyle is back I would like to see I'm good I would like to see that character return and probably get portrayed in a different way than how he was in Halloween 6 Those are my thoughts on the news Let me know what you guys think about down in the comment section below Who else would you like to see come back in Halloween kills because a lot of people would like to see Lindsey Wallace back as well Tommy Tommy Doyle's childhood friend or his his little partner in crime on the night that Michael Myers initially attacked in 1978 But let me know what you guys think about this down in the comment section below If you haven't already make sure you turn on post notifications. We never miss a video Subscribe and in the description. I'll have links on my social media accounts I'm a Facebook Twitter and Instagram you can message me there to let me know if there's any movies news or reviews You would like me to cover in the future with all that in mind guys. I will see you in the next video


Let me just quickly bring you through an overview of it. So, okay, let me... Oh, I have a laser. So first of all, this is a part-time programming bootcamp, so you don't have to quit your job for it. So it's really good for a woman who wants to try out, but you have family to fit, so you can't really quit everything and jump into it. So it's designed for a woman. We accept women for all kinds of nationality, all kinds of background. So we have people who are teachers, we have people who are fashion entrepreneurs, people from the biochem industry. So it's just people from our finance industry as well. So a broad range of backgrounds and also nationality. But what we want to do is we really want to help women who have been trying programming, but just need like a structured program to get themselves into the industry. So you will learn this is a hands-on thing, so it's not like someone lecturer will talk to you and then you're trying to internalize them and become an engineer that way. So it's a very hands-on approach. You learn by creating a product for a non-profit. So do not let them down because they are relying on you to really deliver a product that they will be using for themselves. And so far, as I mentioned earlier, about 30% of our graduates for bootcamp one and bootcamp two have found tech internship or software junior software roles. Some of them might also end up as a technical sales or as a product manager. So it's still in the tech industry where their technical skills have already helped them with their current career. So for the bootcamp batch three, so this time round we are still going to focus on the Ruby programming language.  So do know that this is a very, very personalized program for you because the ratio is almost one to one since that we are only taking six participants this time round. So on top of giving you, of course, a structured program, a structured hands-on program, there will also be a lot of marketing effort done behind you. So if you have been looking through at our website, we do have a blog where we try and get, of course, we interview you to let people know who you are as a person of marketing, personal branding. We'll also try to get you where to speak at a conference, speak at one of our events, or even be interviewed by some other platform. So this is a very sort of a well-rounded kind of experience that we're trying to give you to really propel you into the industry. So these are the days that we'll be running. It will be turning late July to October. And you're expected to put in 15 hours per week. That is inclusive of our in-person session every Saturday. So this is chargeable. We did not do tech ladies to make money because none of us are paid for our time. But we do need money to continue running tech ladies. As you can see, when we throw an event, if we can't find sponsorship for food, we'll actually take money from that little kitty that we have. Having said that, a full scholarship will be provided for people with financial difficulties. Super easy to apply for. Just let us know that you have financial difficulty. Explain what it is. Then you get it if you're selected for the program. Okay, so these are the wonderful coaches. Let's give them a round of applause. They're super awesome. So they will be your Sherpa for the tech industry, guiding you through what are some of the things that are important. Not just on a technical side, but also how do you work as a team and also how should you collaborate within the team and also how do you tackle an app? How do you build it? How do you plan to build it? Okay, so for these five coaches, they will help two non-profits this time round. So these are the two, I think you have already met Hush Tea Bar. They are very kind to let us have some sample of the tea. I hope you have already interacted with them and also drink some of the yummy tea. So let's hear from them what we're going to do now is to have the NGOs come and talk about their organization, what kind of problems they're facing, and then we'll move on to the head coach who will then share more about what are the solutions that you can expect to build for the Tech Ladies Bootcamp. So let's put our hands together to welcome Athea from Hush.


These gentlemen have come all the way from China to talk to you guys about breaking Google Home and exploiting it with SQLite. Let's give them a gigantic round of applause. Have a great time. Smile, I'm going to take pictures. Have fun. Thank you. Hello everyone. Thank you for coming. We are very excited to share our search at DevCon 27. The title of our talk today is Breaking Google Home. Explore it with SQLite measure and vulnerability. First, let me introduce my teammates and myself. We are senior security research at the Tencent Play Team and this is my teammate, Chen Wenxiang. Now he is focusing on brother security and IoT security and this is Nie Yuxiang. He is focusing on mobile security and IoT security and my name is Wu Huiyu. I'm a bug hunter and a gigapart runner and also speaker of DevCon, Harry and Pussy. Next, I will introduce the Tencent Play Team. Our team was founded by Tencent Security Platform Department at 2017 and now we are focusing on the security research in areas such as AI, IoT devices, mobile devices, cloud and blockchain. In the past years, we have reported more than 200 security vulnerabilities to many companies such as Google, Apple, Amazon, Microsoft and so on. Last year, we shared how to break Amazon Echo at the DevCon 26, so we can again this year. And you can connect us at blade.tencent.com. Next, let's take a brief look at the outline. First, we will introduce the attack surface of Google Home Smart Speaker. Then, we will share the details on how to find and explore SQLite and the curve. Finally, we will summarize our research. Okay, let's start with the first part. Smart Speaker are the most popular smart home devices of the past three years. Amazon, Google and some Chinese companies are the main player in this field. In the fourth quarter of 2018, Amazon and Google's market share has been very similar. After we shared how to break Amazon Echo and Xiaomi AI speaker in DevCon 26, we began to study the security of Google Home Smart Speaker. The Google Home family include four devices, all of which have similar hardware. We choose the best-selling Google Home Mini as the main test devices. The first part is about hardware analysis. We find that the Google Home Mini used the wireless CPU and the Toseba's flash chip, but we did not find any debugging and flashing interface. So, we can only choose to extract firmware directly from the flash chip. Similar to the Amazon Echo, we first use a heat gun to solder the chip from the board. By analyzing the dead shape of the chip, we find a test circuit of BGA67 chip. And the difference is that the pins of BGA67 chip are very thin. So, we have not found a adapter that can connect the test circuit to the programmer. So, we designed a new adapter. It's main function is to explore the pins of the test circuit to a large pitch. The pins so that we can easily connect the chip to the programmer. And this is the finished product that we finally produced. We connect it to the RT908H programmer, which is a universal programmer that supports reading and writing most of flash chips. Finally, we got the RAM image data in Google Home's flash chip. We also need to pass the OOB data and the ECC trig base according to the specification in the data sheet. And extract the complaint system firmware. By analyzing the system first, you can know that Google Home is using a net Chromium or it's... The main function are implemented by the Chromium or it's by the Chromium browser. And the update speed will be a meter slower than the Chromium browser. Okay, my part ends here. And my teammate, Niu Yuxiang, we will continue to share the next part. Thanks, Huayu Wu's introductions. Next, let's introduce the security of our views of Google Home. Firstly, let's look at the security of our views of Google Home. On the OTI mechanisms, the firmware's related results of Google Home is open to public. These results include the loader kernels and related binary programs and some even has symbols. Google Home used the HTTP request to download the firmware. We can also simulate the request for device updates. The latest OTI package can be obtained by the curse command in the pictures below. So we can easily to get the firmware and then try to analyze the firmware. Through the analysis of firmware's and related results, we believe that the security mechanism adopted by Google Home is worth learning. About lens, enabling security boot on IoT devices is a good example. The boot loader, boot image, system images is protected by the security mechanism throughout the boot process. The details as follows. The boot loader and boot image use the same structures methods and are insulated with SHA's and ISA's natures. The boot loader's seen that there is no logic to provide unlocking. In addition, Google Home's also pro-pro-former integrates variations on system image. Let's look at the main programs in the firmware's. The firmware's has memory directly as shown in these pictures. That's contain the main program called Cartagel. The program just like Chrome. So it's program is protected by sandbox. On Chrome OS, the sandbox mechanism's mainly included set URD, UNNN space and sitcom BF. In addition, the system also enable ASLRs and Cartagel's also add UNNX and stack generalists. Next, we will introduce the attack surface on Google Home's combined with existing security research and our taxings. Google Home's attack surface include the following four aspects. Google Home has multiple parts, a port opens. One of the port is the A0A0A is the UNNX TTP servers. We can control some basic operations of Google Home's through this port in the land. There is also a port of A0A0A9. The port is the target of our attacks using the Cart protocol. We will describe in the following sections. And the wireless protocol is also an attack surface. Google Home use the mobile chip, some idea about mobile Wi-Fi and BLE firmware's attack can be tried. It's also possible to try to find the vulnerabilities of the bootloaders and let it load malicious firmware. Finally, we can try to find another other hardware interface. In these sections, we will show you how to extend the attack surface of Google Home. First, let's introduce the basic knowledge about the Cart protocol. Google's allow developers to develop Cart APVs and public it to AP store. In general, the Cart APV includes senders and receivers. Sender devices may be mobile devices or PC running from. Receiver is Google's IoT devices such as Google Home. The entire architecture is as follows. The user assess the sender application URL and the sender application use the Cart protocol to find the receivers in the land. When the receiver is discarded, the sender application will communicate directly with the URLs, with the reader's applications on the receivers with the Cart protocol. In detail, the Google Homes will prove the URLs of each receiver application according to the Cart APV ID and accept the receiver application for the Chrome readers. After our attempt, we found that Cart protocol will have the following security risk including the Cart APV can be any web page. The Cart APV is the AP store may be malicious. And senders can directly trigger Cart protocol which may even require no user interaction. Based on this security risk, we can govern an attack on a Chrome or Google Home into an attack on a browser. Let's take a look at some special states. The attackers is registered as the Cart developers. Cart application can be developed and distributed. When you publish an application, you need to specify a cart receiver URL. However, Google does not audio link or cart APVs. Lands v can specify it as a web page in any context. Remote trigger the Google Home to set any web page. If the attackers and Google Homes are in the land, the attackers can also send a Cart protocol such as the launch APVs request. This request view directly triggers Google Home to set to the Cart receiver URL. To make matters worse, if the routers in the victim's home turn on the UPMP port, following the attacker can also complete the remote sign attacks on the Internet. The attackers modify the Cart receiver URL web page to a malicious page. Lands Google Homes may assist in vendors after visiting the page. So now we only need to Chrome assist to exploit the Google Homes. Now we will introduce other vulnerabilities. Okay, thank you for the introduction. Now I will continue with part three. Fuzzing and manual auditing, SQLite and lab curve. First, why do I audit these two libraries? Because third-party libraries are always sweet, they have less code and focused functions and almost every device has them installed. And the most important thing is Google Home or Google Chrome are using them too. Before introducing the code audit part, I would like to mention some previous researches. First, my close-ups case, Fuzzing has significantly improved the SQLite quality. And then there's a talk on Black Hat in 2017, which also explains the idea of exploiting SQLite. After that, there doesn't seem to be a lot of news about the vulnerabilities of SQLite, but we have found some. In the next part, we will introduce the code auditing and the exploiting of Magellan, which is a set of vulnerabilities in SQLite, and Diaz, which is a set of vulnerabilities in lab curve. The Chromium project come with a father for SQLite. We have made some simple changes to it, such as adding some syntax-based files. When we look back, we found that there was a lot of crash files generated. However, these test cases can only trigger empty pointer dereferencing. One of these test crashes is caused by duplicate primary keys. And when I was bugging, I typed the first three created table statements to see what was going on in memory. However, I was surprised to find that the dot table's command shows six tables. The question is, what those content CdR segments stand for? SQLite manual shows that the tables are called shadow tables. The five types of shadow tables, content CdR segments are for FTS 3 or 4, and state and doc size are FTS 4 only. However, because of those tables are treated like standard tables, you can create corresponding state and doc size table even you are operating on an FTS 3 table. You can create state and doc size by simple created table statement, because SQLite itself is doing this too. And FTS 3 and 4 is sharing some code, which means state and doc size might change the code flow in some conditions. For example, one of our exploits are simulating an FTS 4 table on FTS 3 environment. This is useful because some software like Chromium use only FTS 3 and explicitly disabled FTS 4. This would extend the attack surface by entering some code branch that should never be entered. The shadow table is used as a container to store the content of the full text search metadata. What is shown on this slide is the definition and meaning of each shadow table. We can see that almost every shadow table has a field of type blob. That's because to support full text queries, FTS maintains an inverted index that maps from each unique term or word that appears in the data state to the locations in which it appears within the table contents. It is complicated, but all we know is that compared to other fields, those blobs may have some important influence on FTS queries. In SQLite, the raw binary data is typically represented in the form of X single quotation mark and hexadecimal numbers. However, the blobs here are binary data to represent the entire B3. Since it represents such a complex structure, is it possible to create a memory corruption vulnerability by destroying the data of the structure? Let's read about the documents of the serialized data structure first. You can check the SQLite manual to easily get the definition. I will show you a simplified version so you can understand what I'm modifying when I'm trying to exploit them. Basically, I'm modifying the bytes with the different functional sections to mislead the code flow. The first segment B3 leaf nodes. The first term stored on each node, which is term one in the figure above, is stored verbatim. Each subsequent term is prefixed compressed with respect to its predecessor. Interior nodes, non-leaf nodes, have different structure. And then the dock list format. A dock list consists of an array of 64-bit signed integers. Serialized using the FTS var int format. Each dock list entry is made up of a series of two or more integers as follows. One the dock ID value until the zero or more term offset list. In general, those blobs are just serialized B3 data. When the SQLite wants to perform operations on those tables, it will simply deserialize or pass those blobs and get a complete B3. Then I have found some problems. The problems are mainly treated to merge and match because they are deeply related to the B3. Two of them merge the node of the tree and other is to traverse the nodes of the tree to try to find and match the content. Also, the last one is the crash I mentioned before. It was that brought these series of problems into my attention. And software must enable FTS3 support and support external SQL query to trigger these problems. Okay, the first one, and 20346, which is also the main vulnerability we use later to exploit Google home. It requires a lot of complex preconditions. That is, we have to carefully construct a lot of tables and content. But once the preconditions are met, vulnerability explosion will be very simple and stable. The vulnerability is located in the function FTS3 append to node. It can be triggered with a spatial semantic, the merge equals one two, which means the level to be merged. As you can see, this function will try to append a node to another. The node is stored in the blob, so this function and up function will first pass in the B3 and then get the start position and the length of binary data of the node that will be processed. And last, perform the memory copy operation to copy them into a new blob that represents a new tree. Okay, let's go to its caller function, turnkey node. It will get the binary offset and learns from the blob data that will describe the node being processed. Then the node information is returned in a reader object passed to the vulnerable FTS3 append to node. To control the memory copy in append to node, we need to control a dock list and end dock list which is returned from node reader next. The end dock list is the source of the char pointer to the blob data and end dock list is node size, which are second and third parameter of memory copy respectively. To control them is not a difficult thing. Let's read the code then you will know why I'm saying that it's easy. To save the space of storing an integer, SQLite is a variant integer algorithm. You can just consider FSGetVirus32 as a function to convert a bunch of bytes into an integer. It will store the result in N suffix. Then it will move the current cursor by adding the content of bytes and it will to eye off. The data for a node is stored as a lens following by corresponding data with exactly size of a lens. Normally they should appear in pairs, but we can modify the blob to make the end of the blob boundary. It has only the lens field but no data field. Okay, let's go to the append to node. Since in the last step, a dock list and end dock list is controlled, we can now offload the buffer of P node A in line 3 1 0. Or we can copy some raw memory data to it as long as it does not exceed the aligned value. Then we can query the new table to get the leaked raw memory. By setting up adjacent tables, we can offload the function pointers of the table very accurately to exploit a code execution. And here's another one, 506 in functions scan into real node and the precondiction of this one is rather simpler. All you need to do is modify the shadow table, set a node in sec dr to non-root node. You can change the blob data to change the code flow. Query the modified table by keyword match. Then the code will scan every node inside the B3. Then the code will trigger memory corruption because it has many constrained conditions. It was considered to be very hard to exploit. But this one is exploitable anyway. You can check the wonderful write up by Korean researcher named Anki Chen. And last, 20505. This one is very like to a combination of the previous two. The vulnerable function is set greater next. You can modify the shadow table and mislead the code flow. All these three vulnerabilities can be modified to leak raw memories. So we can also use this to leak address of, for example, functions, structures, global variables, constant variables to bypass the ASLR. And here's another one, lab core. Our target is a remote code execution, but lab core has already been used by a lot of users and their code entries very quickly too. To find a vulnerable function, here are some guidelines for finding problems by reading the code quickly. The first find a big functions. Those functions with a lot of lines is not recommended in software engineering and functions that are too long should be refactored into shorter function fragments. Usually such a large function is difficult to test and there will be a lot of attack surface. And most of the functions enabled in lab core is related to remote interactions and communicate with a remote server more than once. After carefully sifting through the protocols, we confirm that NTRM over HTTP was what we wanted to test. And here are those problems we have found in lab core. We named them as DS, a name of another famous navigator. The first one, 890 is a vulnerability in NTRM type 2 message. It can leak at most 16 4 kilobytes client memory per request to attacker. The result is very likely to be hard to believe, but it's the client version. And the second one, 822 is a vulnerability in type 3 message. It will result in a stuck buffer of flow. Lab core also wrote this in his blog and saw this very bad security issue. Okay, let me show you how this happened. The first one, the vulnerable function is in decode type 2 target. It reads a 32 bit integer from the type 2 message header. Then we know we can set target info offset with a larger value and target info length to a crafted value, which if you add them together, an integer overflow will happen. The overflow result is very small and will pass the check in line 1805. And next memory copy will copy data out of bounds. For example, if we use the value above, it will actually copy data from the front of variable buffer in 32 bit environment. And then the data will be sent to the attacker in type 3 message leaking maximum 64 kilobytes data per request to the attacker. And let's go to 3, 822. This vulnerability is located in a big function named core also created NTLM type 3 message. In the beginning, this function declares a lot of variable on stack memory. The NTLM buffer is a big buffer which has around 4 kilobytes memory. Then the function tries to read NT response length from the type 2 response which is sent from the server. Attack could return a value bigger than the buffer size to client. And next in line 779, this check should check if the size of the data is bigger than NTLM buffer's remaining size. But the inexplicit unsigned cast prevents the check from operating correctly. This check compares two unsigned variable and a macro NTLM buffer size which simply defines a number 1,024. But this value is a signed integer in the view of compiler. When unsigned and unsigned are compared in the same place, some of them must be casted in order to compare correctly. And this is a problem. The compiler prefers to convert signed to unsigned numbers. So if we have NT response length greater than the NTLM buffer size, the result will be a large unsigned number. And it is of course bigger than the remaining size will pass the check. In line 781, because NT response length is bigger than the remaining size of NTLM buff, hence here will be a stack buffer overflow. When the code triggers the stack buffer overflow, the overflow variant is in the middle of a lot of stack variables. Although the program may have stack cookies, an attacker could choose not to overflow that mesh bytes. But instead override stack variants and control the flow of the code. I marked the position where it triggers the buffer overflow. You can see in this big function, there are almost 18 lines after it. And many of them are operating heap or stack memory. And the operating is based on the value of those stack variables. That's the reason why I say big function is never a good coding practice. Okay, my part is done. And Lee Yu-shan will go ahead to introduce how to exploit it. Thank you for my partner's introduction. Now let's review the following vulnerabilities. The key to the vulnerability trigger is how to use the insert state to control the variables used by our memory, memory copy function include PN, P node A, P node N, and A doggalix and doggalix. The insert data is as follow. First, the entire data is stored in the buffer of P node A. We can control the size of the P node A buffers by modifying the length of the insert state. In heap function, we are able to allow P node A to the appreciate areas to cover the target memory. In this state, the ordinary colors indicate that the size of P node N and P N doggalist, which is, we are in type. And doggalist is used to control the length to be overflow. P node N, which is the offset of the right, our right turn memory areas. The green part is the A doggalist status, which can be used for our read or overwrite. The next sessions, we will introduce the ideas of using these vulnerabilities. We expect to find a function pointer that can be used on a heap. When creating our FTS3 tables, the tokenizer is created by default. And the tokenizer default is simple tokenizers. As shown in the following pictures, simple tokenizer is a structure on the heap, whereas it's a member's base points to the SQL tree's tokenizer structures. The member's P models or the SQL tree's tokenizer structure points to the tokenizer models. The tokenizer's models contain some interesting function, codec functions, such as the X create X opens. On our lens, when inserting the FTS3 tables, the X open codec functions will be triggered. If a function address of X opens can be modified to the attribute address, the PCs can be hijacked. And how to use the available functions pointers for PC hijacking? Here's two conditions need to be met. The first, after his overflow is necessary to be able to operate the FTS3 table. In addictions, when hijacking needs to be complete before the memory is released, otherwise the crash will be interrupted. By analyzing the logical memory copy to freeze, we found an interesting function, which performs a SQL update operation before releasing the memory, as shown in the blue tag code. Finally, we used SQL triggers to perform the FTS3 table insert operation before the SQL update operations and free memories. Since, triggering the X open codec functions so that the PCs can be hijacked. The next day is to make a memory layout. The SQL logical of the cartel shell, just team a lot. A feasible memory layout idea as follows. The first, by creating multiple FTS3 tables, we will create multiple simple tokenizer structures. Drop the previous created FTS3 tables at the appreciate times. The simple tokenizer structures will be free. The residing payloads of the same side as simple tokenizer, it has the high probability that payloads will be allowed to the previous release simple tokenizer structures. So our payloads has a greater chance of writing the simple tokenizer structures of existing FTS3 tables. With the SQL triggers that perform the operations of FTS3 tables before the free, there is a chance that the tokenizer model codec functions will be triggered to hijack the PC. When we have the ability to hijack the PCs and control the R0 registers, we only need to be able to list information and by part ASLRs. The previous sections are also introduced, we can try to adjust the PNOTE A and list memory after heap. We need to disclose the following two types of draft. Leaking the draft of cartel shells based on this draft and Opsets calculate the required RP gadgets. Leading the draft of the last heap, according to this address and Opsets, the probabilities of calculating the address of the heap spray. The latest heap sprays and RPs, after these three steps, we can ask this in Google Home Surrenders. Cartel Shell is like a binary program that can tell many of the available RP gadgets. So the RP gadgets used Cartel Shell is more stable and convenient. In the pictures on the right, the realized marks, the red light marks the heap spray units which face tokenizer models and RP gadgets. The X create X open address in the face tokenizer model structures will be assigned the state pyverse address. The blue light marks our face simple structure of tokenizer structures. When the FTH3 tables operate can be triggered. SQLize will get a malicious X open through the structures of simple tokenizers and then I see. Above is the screen source of our asset in Cartel Shells. The red blocks on the left show that the register we can control that they are R0, R11. The function of JET is read from R11 and finally it's go to BLX. Then as a result, we have been able to hijack the PC. The magic on the right show the results of our shell codes. We execute a JavaScript code for fetch URLs and navigator's app name in the EXP.html code. Normally, navigator's app name is read only and is next skip but our shell codes change the app name to AI. Let's look at some actual attack sense. There are three types of attack vectors that attack Google Homes remotely. First, the attacker is located in the LAN. The attacker send the launch ABP ID 1 command through Cartel Protocol and Google Homes will prove the leak .html on the application stop, AB stops according to the ABP ID and load it. At this times the leak days can be obtained by the attackers. The second, the attacker send the launch ABP ID 2 command Google Homes load .html. So that's the AC happen. The entire process does not require user interaction. In the other two sense, you don't need to be on the same on the same LANs to start the attacks. The attacker index the victims to assess the URLs of the same application and we can scan the networks on the routers that if the routers have the UPMP forwardings, we can try to launch remote attacks on the internet. Conclusion. Here is the timeline of the McLean. We have report length in November and it's quickly fixed by SQLite and Chrome users. In the December, Google's decide to get a total 10,000 reverse for the batch of vulnerabilities. And they have a LAN have a enhancement, there is the defense in deep flag. This allowing modifying shadow tables from untrusted source. For backwards compatibility is default off in SQLite. So if you are using SQLite with FTS, you may want to enable this one to prevent the attacker from the modifying your shadow table. But the good news is, it's default on in Chrome from commit in the last November. Here is the timeline of DR these quickly fixed and released by lab crews in two weeks. Also, we have noticed the sensor to urge vendors to disable the vulnerable FTA trees before the patch come out. If they don't use these features. And we have notified the security teams of app house, internet, Facebook and Microsoft about how to fix the program and how to mitigate the phrase in the son of their products. The other is the security advice. Once enhance your system with the new list available defense in different mechanism in a time. The tools keep your, the third pass libraries up to date. Please improve the quality of security auditing and testing of the third pass libraries for, for introduce security specifications into the developments and testing. Thank you.


The Daylight Lounge is the library's popular reading and watching collection. Essentially, it's filled with the things you want to read and watch, not the things you have to. Books and movies are recommended by Western students, faculty, and staff. You can make a recommendation anytime using a simple form on the Daylight Lounge website. Most materials are pretty new, no more than one and a half years old, unless something old came back into style, like a book that was recently made into a movie. The space also has new, comfy furniture and big windows that let in the rare Pacific Northwest Daylight, hence the name. This makes it a great place to study. One of the best things about the Daylight Lounge is that new items are added every quarter, so check back often to find a great new book or a newly released movie.


I don't actually have a very formal presentation prepared. What I'm going to try to do is to sketch a picture of what I see as some of the important developments in the energy, a global energy scene in the last several years and how that might develop into the future and how that might affect all of us and then open it up for a discussion. I find that I'd always learn more from the audience than probably the audience learns from me. So that's what I'm going to try to do. I work in a think tank in Washington, which is a non-partisan think tank. Although the American Embassy helped get me here to Ireland by no means do I speak for the US government on any of the subjects that we're about to venture into. So I think from the standpoint of someone who's worked in this area for almost 40 years, the first thing I would say is that to remind us that we are going through the highest oil prices the world has ever experienced and I hope it's a little hard to look at the slide. But this is the price of oil through the 153-year history of the modern petroleum industry in both nominal and real terms, the slides from BP. And the last two years in 2011 and 2012 are the highest oil prices the world average prices the world had ever experienced. We forget that sometimes because we saw an even highest spike in 2008, but that just lasted momentarily and then we had a collapse as a result of the worldwide economic recession preceded by the financial problems. And this year we are starting 2013 at an even higher level than we did in 2011 and 2012. So we could have a third year of the highest oil price the world has ever experienced. One of the things about the energy industry is that it sometimes feels like it doesn't respond to price. That is because it's a long-term energy capital intensive business. There's a lag in response. Most of us don't go out and buy a different car the next day after the price of petrol goes up. But we remember what happened to price the next time we buy a car. Same thing for housing, same thing for capital stock. There is a lag in demand response. There's even longer lag in supply response because it takes 5, 10 years to find new resource, explore, discover, produce, develop new resources. So sometimes it feels like the energy industry doesn't respond to price very well. And that's because there is a lag time involved. What has happened as a result of very high oil prices is that the industrialized world energy demand has declined in relationship as the share of the total world energy demand. So we see the difference, the increases in energy consumption around the world are from the emerging economies. And of course, we all know about China. But this gives you a picture of what it looks like in 1975, more than half of the global energy demand was from the industrialized world from OECD countries. That ratio has now flipped. And increasingly, we're looking at China, but not only China, India, Middle East, and then the rest of the world emerging economies. By the way, these are Fatih Burrell's slides from the World Energy Outlook that the International Energy Agency came out with back in November, I guess. And I understand he was here a couple of months ago. He may or may not agree with my narrative using his slides. But they are his slides, so I should credit him with that. So there's been a demand response to higher oil prices and seeing the shifting of energy demand centers from the industrialized world to the emerging economies. Keep that in mind. We're going to talk a little bit, I hope, about what the geopolitical implications of that are. The other thing that you would expect is a supply response to higher prices. And what has really surprised us in the last five years is that that supply response was most prominent. You would never have guessed, well, most of us were not smart enough to guess, that it would come into the United States. Because after all, the United States is where the modern petroleum industry started 153 years ago in Western Pennsylvania. Western Pennsylvania should be all played out by now. But yet that's where the boom came was in the United States. And this is the direction of conventional oil production in the United States historically, but also the IEA's forecast. And here's the boom of unconventional oil that the IEA reckon is going to be coming. Here's the picture on gas. For four years in a row, this will be the fifth year, the United States produced more gas than Russia. Now, if you told me that 10 years ago, I would think that you're nuts. Not no way that can happen. Because most of the American gas should have been produced already. Russia has the big resources on the books. It's not possible for the United States to out-produce Russia. And because of the unconventional or shale gas or fracking revolution in the United States, that's the picture that has emerged instead. Now, it's interesting to contemplate why that is. Why did it happen in the United States and not elsewhere? Why didn't it happen in the North Sea, for example? Why didn't it happen in Mexico? Why did it happen in the United States in the Q&A session? If you're interested, we can get into the details of it. And then the other question is, is that experience or the expertise technology developed in the United States how transferable it is to the rest of the world?  Because the first thing that happened with the United States is no longer importing the liquefied natural gas that we were expected to import even seven, eight years ago. And all that LNG that's produced in countries like gutter are now available for the North Atlantic market available for Europe to import. So even before the question arises as to how transferable that technology is into countries like Poland in Europe, for example, you've already seen an impact in the availability of more supply sources than the traditional suppliers in Russia, Norway, and Algeria to European markets. And that has had, whether you realize it or not, an impact on European gas pricing. So one of the things that happens is the question of European gas prices being linked to oil prices, that's eroding, that relationship is eroding as a result of spot gas availability in the North Atlantic market. And this is before the United States starts exporting gas. You've already had this impact. And we'll talk about exports in a minute. What does that mean for Middle Eastern oil, where is it going, where will it be going into the future? This is the picture from 12, 13 years ago. The picture more or less today in 2011. And this is what the IEA says is going to happen in the future. United States was never a big importer of Middle Eastern oil. This is something that's not well understood, including in the United States. I mean, the fact of the matter is, we're geographically situated to import, even though we're the largest oil importer in the world still, we're geographically situated to import it from the Western Hemisphere. So from Mexico, from Venezuela, from Canada as the largest exporter to the American market of oil. But this is, according to the IEA, what it is going to look like in the future. What are the geopolitical implications of that? With a Europe that still relies on Middle Eastern oil, Japan and Korea at a very high level, United States with negligible imports from the Persian Gulf, and the new incremental consumer of Middle Eastern oil would be in countries like China and India. Contemplate that for a moment. Contemplate that for a moment in the time of budget austerity around the world, including on defense budgets. If you were a military planner in the United States, what are the implications of this long term? How do you plan for that future? Should it affect you or not? There will be two schools of thought about it. One is, well, if the Europeans and the Japanese and the Chinese need that oil, let them be concerned about security out of the Strait of Hormuz, not us. Why should we be concerned about it? That could be one extreme school of thought on it. Another school of thought might be, we live in an integrated world that's economically linked up in a world where people wake up and are concerned about what Spanish bond rates are going to be, that we're not going to be removed in the United States from the rest of the world. We are for the foreseeable future a superpower that has global responsibility. And if our closest trading partners, our allies, are going to be affected, we're going to be affected anyway, so that responsibility doesn't change very much as a result of this. But we're talking about real life challenges that governments have to address. We're reducing the sixth fleet in the Mediterranean. We have been. What does that mean for the fifth fleet in the long run? Who patrols the Indian Ocean, the South China Sea? That's the sort of challenge that we need to necessarily share rather than dominate with countries like India and China as they look at their geopolitical priorities into the long-term future. It's the sort of thing that we don't have the answer to that, any of it, but it's kind of questions that come up in Washington quite a bit recently and all because of energy. What happened to the map? That's a very abstract slide, isn't it? Try this again. What happened to the map? Something happened. Fatih called on his copyrights. And said, you can have all the arrows, but we're not going to tell you where they go. But imagine a traditional map of the world, Mercado Projection, Western Hemisphere on the left side, Europe. This is global gas trade flows right now. The big fat blue line, for example, is Russia going into Europe. And the point, and I won't dwell on this since you can't see it, is that it's going to look a lot more complicated in the future with multiple trade flows. Most of that gas going into Asia but not just from the traditional areas like Russia or North Africa into Europe, but also Australia, which is down here. It's going to be a major supplier. There'll be supplies coming out of West Africa, South America. And that light blue line is US exports, the potential of US gas exports. And where is it going to go? Is it going to go to Japan, which right now have even higher gas prices than Europe does, or will it come to Europe? I think this is a very interesting picture of different countries, or in the case of Europe, regions. Oil and gas import dependency. Japan is always easy to pick out. They're the most extreme example on the right upper corner, because they import almost 100% of both their oil and gas. And this is the direction that things are going for most of those regions if you believe in the IEA's forecast that European Union will become more oil and gas import dependent, moving closer to Japan's position, but not just the European Union, but also China and India. And the United States is going just the opposite direction. So not only will our imports of oil be reduced, we're not the largest oil importer in the world by all conventional projections in about another 10 years or so. China, which have already exceeded Japan as the second largest oil importer in the world, will become the largest oil importer in the world. The United States will be importing less, and will be a net exporter of gas. And what are the geopolitical implications of that, if you will? What are the implications of that for practical policy? If the West, US, and Europe no longer play a large function in oil trade as it does today, what does that mean? On practical things like, let me pick one, Iran trade sanctions. If we're no longer the incremental importer, if the exports go mostly to China, India, and other emerging economies, will we have the same leverage on imposing trade sanctions on producing countries and consuming countries? Right now, we're in a different position, because we're a large importer. The West also controls financial flows through the Bank of International Settlements, or insurance schemes through Lloyds, and so on. Will the new consuming countries be satisfied with allowing the West to continue to dominate that, are they not smart enough to figure out their own schemes on insurance? Once again, things that we don't think about, I submit, enough in places like Washington. We tend to talk to the EU, maybe, maybe sometimes, sometimes not, about how to coordinate our policies, and then we roll out to the world and we tell China, Turkey, India to get on board. That's the MO up until now. How effective is that going to be in the future 10, 15 years down the road? We're going to have to think about that. If we want these countries to follow, or at least coordinate the policies with us, maybe we need to consult them first, and not after the fact. So there are really important foreign policy implications of this. And because I work in the foreign policy institutions, those are the kind of questions that I ask. I would say in Washington, the work of a think tank is not necessarily to have all the right answers, but at least we ought to raise the right questions so that policymakers are aware of the challenges and try to address them. Here, this is the IEA's picture where the new sources of energy sources for power generation is going to come from. And you see, again, the US and Europe and Japan really not growing very much because we are already well-developed societies and all the growth coming from India and China. And in spite of the fact that the Indians and Chinese are working very hard, and we don't get them credit, for investing as much as they actually do on renewables, for example, because they have growing energy demand, investing in nuclear, as well as changing their primary energy portfolio to go beyond oil and coal to gas, there's still going to be a significant amount of coal-fired power plant that will be built in both China and India. Renewable energies, favorite subject around here. I gather, in Ireland. But we know that it comes at some cost. This is the IEA's projection of what the energy subsidies to continue to grow renewable portfolio is going to cause over the forecast period based on existing projects as well as people's announced targets. That's for electricity. And that's the picture they painted for biofuels. At a time of economic slowdown or the big recession, as we call it in the United States, economic competitiveness, which one doesn't think about as much in the time of prosperity and abundance, is becoming increasingly important for governments to consider. This is the picture that the IEA projects into the future. I go to Japan regularly. They're very proud of having the most energy efficient economy in the world. That's because they have very high electricity prices. And that comes at some cost to your economic competitiveness, something they're thinking about much more. You will see in the next several months a Japanese political discourse on whether and how fast, how much of their nuclear power plants they're going to reactivate. I think after the Japanese upper house elections in June, there will be an attempt by this government to restart nuclear, maybe not all the way back, but at least some of the way back. Otherwise, they're going to be stuck with high electricity prices for the foreseeable future. But Europe is clearly similarly situated in terms of high electricity prices. The United States were a little bit better off than large part because of the available gas supply, supplementing renewables. And China may have electricity prices that are too low for their environment to withstand, because that's the environmental picture in China. This is Tiananmen Square last month. And I always think of that little girl in the corner, because my mental image of why the Chinese are going to do something about the energy challenges that that little girl has four grandparents. The four grandparents only has one grandchild. And every time that little kid coughs, there are a lot of grownups worried about her future. And why isn't the government, which is the forbidden city behind that you can't see, why isn't the government doing something about it? For many years, I've told Western climate negotiators that they should stop talking to China about climate. Because greenhouse gases is a problem the West created. After all, it's cumulative emissions that count. It's the 250, 300 years of industrialization in the West that led us to where we are now. If the Chinese are going to do something about their emissions, it will be for their own reasons, not for global reasons. It will be because they worry about water pollution, land use, particulates in the air. It's not great when you can see the air. You're about to breathe. Self-dioxide, nitrogen oxide, the sort of thing that we were concerned about in the 60s and 70s. And if they do something about that, if we talk to them about our lessons learned to remedy those traditional environmental problems that we tackled decades ago, the effect of those new policy would be a reduction in greenhouse gas emissions anyway. But if you talk to them about greenhouse gas emissions, it becomes an international bargaining process. You want us to do something where you're going to give us in return, right? It's a negotiation. Give us technology for free. We don't care if it belongs to GE or some company. It's not the US governments to give. But if you want something from us, then you've got to give us something. But you're going to help us improve our environment that may be a different kind of conversation altogether. So just some suggestion on that score. Efficiency, at the end of the day, efficiency improvement is the best thing that we can all do. And we all must do. This is the IEA's projection of what global energy demand is going to look like out into the future under their base case. And this is what it would look like if we were to, the world is to adopt a kind of efficiency policy improvement that they suggest. This is the reduction in co-use, oil use, gas, and so on. So we never forget that even as we are able to produce more oil and gas because of the technological improvement that I mentioned, that there are still a tremendous amount of efficiency improvement available. The IEA tends to make its forecast because it's not supposed to be a political organization, tends to make its forecast based on GDP projection and then fill in all the energy necessary to drive that GDP. As someone who works on energy security and geopolitics of energy, I also worry about the ability to physically move more and more oil and gas and coal around the world. The choke points, the vulnerability in the system, even if we can geologically produce it, setting climate concerns aside for a moment, can we physically move more and more oil and gas around the world? Are there not limits to that? We're moving 80 million barrels per day, more or less, of oil around the world today. These projections will suggest that we'll be moving more than 100 million barrels per day. And can we actually do that? And every day, we are reminded of the vulnerabilities, whether it is Algeria a few weeks ago, what's happening in Syria, what's happening in Nigeria just this week. And so efficiency improvement is still the cheapest barrel that you can have is the barrel that you don't burn. So even though I'm a traditional oil and gas guy, that's something that I try not to forget in my work. And given what I've learned about the environmental consciousness of Irish people during my short trip here, I'm sure that's something that is utmost in your mind as well. So with that, Amy and Johnny, I'll close and try to respond to your questions in a conversation. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you.


Welcome back to Tennis Talk, my name's Cam Williams and Frenchman Joe Woldfritzonga has said that he is going to retire after the French Open this year and he's just been cruelled with injury lately. Let's have a read of his statement over on Twitter. So this is what he had to say over on Twitter in a statement. He writes, It is with great emotion that I announced today my decision to end my professional career at the next tournament of Roll on Garros. So many incredible moments of joy shared with an audience that has given me so much. Still hoping for one last thrill with you. More to come at my press conference this weekend during the Monte Carlo tournament. So there you have it. That's what Joe Woldfritzonga had to say over on Twitter. So we'll find out more next week. I'm sure people will be asking him a lot of questions and it's a shame because he's one of those exciting players, kind of like a Kyrios or a Monfice. He's showed a lot of a lot of flair on the court, a lot of excitement. And of course, one of his best results is trying to open back in 2008. Had a great run there, beat Raffer on the way. I remember watching that one as a kid over at the Australian Open. So it's a shame to see him go. You know, one of the characters of the sport. But let me know down in the comments below what has been your favorite Joe Woldfritzonga moment. Maybe it's a trick shot that he did. Maybe it's a match that he played. Maybe it's a result that he had. Let me know down in the comments below. For me personally, like I said, the Australian Open 2008, when he broke through. Man, that was an exciting time to watch him rise. But unfortunately with the injuries, he just has been cruel lately. But let me know down in the comments below. What's your favorite Joe Woldfritzonga moment?


Hey guys, it's Nate, aka The Foot Accountant, and welcome back to the channel. Usually we get leaks and information ahead of time about what SBCs and upcoming content we're gonna get in FIFA 23, but this time, EA have put it in plain sight, at least one of the SBCs coming today as a part of Footy's content as Footy's continues on. We're gonna talk about that today and of course, one part of the market that I want you guys to be very careful with heading into the start of a brand new week. So if you're excited for Upgrade Pack Monday, drop a thumbs up on the video and of course, subscribe if you are new. First of all, we'll go back to yesterday and look at the content that was dropped on Sunday, which, to be honest, we had another great Footy's player, SBC guys. It's Jeremiah St. Juice, a overpowered beginning game FIFA card that everybody remembers the name of. I think was it FIFA 21 or FIFA 22 where he really kind of came up as a really overpowered starter card, three star skills, five star weak foot, center back and right back, medium high work rates. Guys, the interesting thing about this is he is very, very pacey. He has 97 sprint speed, he's got really good defending stats and I'm just a fan of the price. Six foot one, of course the links aren't that good but he's a premium, right? So he gets those three chemistry points regardless of the squad that you put him in, 60,000 coins for this SBC. This is good Footy's content, right? This is what we're used to when it comes to Footy's content, right? Cheap player SBCs, good value, craft ability and since they're premium items you can just plug and play them basically into any team. It doesn't help out with a lot of links unless you're using League of Portugal players in your squad or maybe some Netherlands links but really nice SBC here, right? Again, it's cheap, we love it. It's good enough. It's actually great stats. You wanna see something crazy. This 93 St. Juice day, technically if you wanna go down to the statistical level it has more total stats and more in-game stats than Raphael Veran's 97 rated card.  Yes, absolutely, the differences are in the shooting, the passing and the dribbling from St. Juice Day to Veran but still five million coins plus 25 games for this card and 60,000 coins for this one. That's why this is good content because you get a really, really nice level card even if they're not a one-to-one comparison it's just kind of fun to see that, right? I know that there's already people in the comments who are like, Nate, you can't compare those. I hear you out. They're completely different. Veran is just him in-game but a card like that for 60K with those stats, hey, I'm not gonna complain at all. So we love that EA, keep that up. That's what the content that we wanna see throughout the rest of this entire week. We absolutely love that. Now yesterday we also had the promised upgrade packs return. Now for me guys, I'm not gonna do these. Obviously I'm gonna do it once, right? I think we all have to do the premium mixed leagues upgrade one time in the mixed league upgrade one time to get XP from it. And I don't even know if this really changed that much from the SBCs that expired yesterday that these were refreshed with. I think it maybe even has the exact same requirements inside of it or at least very similar. But the ultimate bronze and ultimate silver upgrades if you want to do this bronze and silver into gold menu grind right now, this is really, really fantastic guys. This is a really, really good grind. They're unlimited repeatable, especially if you're needing gold commons. You can get them out of the ultimate silver upgrade pack, turn in 11 silvers and you get, I think is it eight gold commons back. That's a really, really solid pack there. And especially it's gonna help us out with today's content that is upcoming as well. So we'll look into that in a second. But also yesterday we had the 93 plus tots or shapeshifters player pick SBC that was re-released. Of course, not a surprise there that was expected. Other than that, not that crazy of a day. No new cards added into packs. I don't even know if there was any new packs added to the store. If there were, it wasn't that crazy because we already had the big 250 players packs and the 500K pack was already in the store. So kind of a quieter ish day, I guess you could say on a Sunday. Now hopefully today it picks up with content specifically in the upgrade pack department. Now we already know the upgrade pack that we're gonna be getting today guys. It's not a surprise. The same place that we looked to get our XP from those SBCs that were dropped yesterday, we're looking and noticing again that we are getting the 80 plus player pick SBC today. And at first glance you're like, yay, why an 80 plus? We've had an 81 plus a couple times. Now we've even had an 82 plus player pick recently. I think it was during shapeshifters. Why are we going backwards in July? Now the only thought that I have to this is maybe they're only gonna require like five golds or maybe they're gonna make it like instead of a one of three player pick, maybe it's gonna be an 80 plus and one of five. I don't know, maybe give us more options. Nonetheless, you guys know what to do. It's a Monday. What are we gonna be doing? Stocking the club with some gold commons. Gold commons right now are basically discard. 300 coins a piece, 350 a piece. They're already starting to get bought up actually at 350 a piece. So I would get on some bids, get on some snipe, stock your club. If you have any aspirations of doing upgrade packs or player picks for this footies promo. Now you're like, Nate, is it really worth doing footies upgrade player picks while, you know, Ronaldo and Alvarez, Di Maria Gomez and these guys that are in packs are super crazy hard to pack. Honestly, it probably is worth stacking a few player picks this week guys just with the best stuff that is in packs. You never know, a Vander Star, a Hullet, a Diño or some of these other really high rated cards that are just good fodder at the very least. As a part of footies best of batch one, you could hit one of those out of a player pick and that could mean better SPC fodder for you in crafting. This week is really gonna be a week about crafting all the Centurions cards we're gonna get from SPCs. It's really EA is gonna get us to do. I'm gonna find myself in this exact same position. If you're doing any sort of upgrade packs this week, EA is just kind of gonna rope us in to doing SPCs. And that's why I'm hoping that they continue to release good player SPCs so that we have a reason to use our duplicate fodder that we get from player picks and other packs from objectives and stuff and rewards to actually get some decent SPCs done. Of course, we have a good amount of them here. Vardy, Josaloo, Carvalho. Another transfer SPC is definitely needed this week, St. Giustate, but keep the players coming from footies EA. That would be very, very nice. It's gonna be a good crafting week, honestly, if you wanna grind at the game. Now we should have another upgrade pack as well. Was it last week that we had the 85 times seven? I think it was, but then the week before that we had the 83 times 25. Guys, I would expect 100% that we're gonna get some other sort of upgrade pack today and a lot of people might be already thinking this, as I'm saying this, is it 85 times 10 season? And to that, I think we're a little too early. I really think we're a little too early. Maybe that we would get an 85 times 10 today, but it would be just repeatable once or maybe once per day, that sort of thing. That's the type of other upgrade pack that I'm expecting to see today, whether it's an 85 times 10, an 83 25, or an 85 seven. Again, something along those lines I would imagine is gonna come today. And a lot of people are gonna be interested in doing it with the cards that you have in packs for best of. I mean, packs just kind of look, for lack of a better word, pretty at the moment, right? When you have all these other different special cards and promo cards in them, even though these cards are like literally discard value as a lot of the Centurions are in packs right now. And I think winter wild cards is another one that people are probably sick and tired of packing already. And yeah, we're gonna be packing these guys for 10 days because that's how much longer this batch of players is in packs. But that's gonna be a draw for people, right? That extra fodder that you can get, the extra higher ratings, so that upgrade pack, hopefully is dropping today. I'd love an 85 times 10. I'm not saying that I don't want it, guys. I'm saying it's probably a little bit unrealistic, but it could happen, we'll just have to see. So another thing that could happen today, we mentioned it yesterday, the Pablo Maldini Foot Birthday Icon SBC has been leaked. That's the only leaked SBC as of right now. As we saw yesterday, Foot Sheriff I think leaked. The SBC for St. Jude's Day, like a couple hours before content, literally 45 minutes before content. So yeah, maybe watch out for another leak today of a player SBC that could be coming out so far. They're three for three on player SBCs every single day on this game. So maybe we'll make it four for four today. Now, with the content that we saw yesterday, let's also talk about fodder, right? We're talking about, you know, the craft ability we're talking about good fodder in player picks and in packs, what's the best of, and fodder prices yesterday didn't really move that much because the 93 plus, although I thought that was a really popular SBC, it didn't really move the market that much. Now, some of these cards did have some movements and it's actually really interesting how a lot of these gold cards, guys, have better versions in packs. Take a look at some of the cheapest 85s. You go from 5,000 coins for a few of these guys and then boom, you're straight up to 6k for Jared Moreno, who's out of packs, you're now Aspas out of packs, shick out of packs. It's very interesting to see that some of the 85s that are in packs are down and some of the other ones that are out of packs are in fact up, right? That makes sense, but some of these 85s are club stockable again, right? The investment that we were talking about yesterday didn't necessarily mean, we didn't necessarily mean it was all gonna go up yesterday on Sunday. I would say maybe stock a few more 85s if you want to because I think, especially if we get an upgrade pack today that has a lower rated squad requirement, also we're still waiting on the 90 plus icon player pick to come back at some point during the week this week, which it hopefully will. So the same ratings we talked about yesterday. If they are low, I would say not a bad time to stock up on a couple of those. I think maybe some of your 91s had a bit of a spike yesterday. Lewandowski is 32k. What did he do yesterday at content? Yeah, they had a little bit of a spike, but then they went down a little bit. 28,000 coins for him and now he's back to 32k. So Fodder had a bit of a spike yesterday at content but really other than that, it's not moving a whole lot. I think it's gonna continue to move up throughout the week this week. And again, guys, I would say this, if you're looking for a last minute move, get on 83s on bid. Now, 83s are probably gonna be a bit more accessible today via player picks, but with the 40s batch one player pick that is out, the potential that you can get Dino, you can get Hullad or just another good team of your icon card out of that, I think people are gonna be crafting these all week long, especially like when you get a duplicate Aspas, Centurians or a duplicate card, it's easy to throw it into this. Get yourself a team of the week somehow. That's probably the biggest barrier to get this SBC done is the team of the week player. But it's very easy to craft if you have a team of the week and a higher rated card as a duplicate, throw into that player pick and at least get a chance of getting something fun. So again, I think that's gonna be the mantra for this week. There's gonna be a lot of people crafting and doing SBCs which is why I'm interested in the fodder side of the market. Now, speaking of the market as well, I know there's not a lot going on. Prices are really just kind of stagnant, right? You know how you have some things moving up and down. Finally, we had some price drops on some of these footy cards that are in packs, specifically Joe Gomez. I'm sure St. Jude, they had a little bit to do with this yesterday just because that was a really cracked card. Gomez is down to about 770, he was still 900K yesterday. I think Julian Alvarez is down a little bit. He was still 2 million coins and we looked at him on yesterday's video and now he's like 1.9 or 1.8 million coins somewhere in there. So these guys are definitely down a little bit. The cards that I'm more worried about though are the level ups. This is the time I believe last week that some of the level up cards from team one started to take some even bigger drops. Guys, this Veran card, I know we compared him already kind of to the St. Jude's Day, but this Veran's 5.2, 5.3 million coins. Remember how much KDB and Renato dropped off last week, especially towards the end of the week? But I'm trying to get you guys on the front foot. We're trying to talk about this ahead of time. If you're doing Veran, if you're doing Goretzka, if you're doing Gabrielle Martinelli, Chau Mani, any of these guys that maintain some value in level up team two, get the cards completed, get your games done ASAP because once we get towards the middle of the end of this week, these cards are gonna drop and get panicked once again as the objectives are about to go away. And you might be like, Nate, are we gonna look to invest in these at the end of the week? Yes, we are. When KDB goes from a million coins to 1.8, right? We're definitely gonna be interested. But remember how much KDB dropped down in that week last week, right? From 7.3 mil all the way to a million coins on Friday, literally his minimum price. And then going back up to now 1.8, which is absolutely crazy. That card is that much on the market. The rarity there is kicking in big time. But for these level up team two cards, the objectives go away soon. So just be careful with those.  I would not hold on to those cards for very long because I mean, they're just, I just think they're very overpriced. And whenever promo cards like this are very, very overpriced, it just scares me a little bit to hold on to them and to keep them in the team. Unless you don't care about losing coins at all at the stage of the game because, man, the rarity, I mean, these guys are definitely overpriced. For where we are right now in the end game, this being 2.4 million coins, we're no although going on day four, today's fourth day of the Footies Promo. This guy is still extinct on the market, nowhere to be found with his max price of 15 million coins. It's just, again, this is the part that we, again, like I said in yesterday's video, I've never cared less about promo cards in packs personally. Yes, there are some nice ones, but I mean, with the state of this Footies Promo, the way that it is in those cards, being in packs in the first place is just a little bit underwhelming. So to capitol off, just keep an eye on some of your shape shifters and there will probably be some decent price movements upwards today on the market. I mean, I picked up a Zaha at like, I think I bid 200K flat because he was like 220 during the day yesterday. There's still some primarily hype. I was looking at the Gomez, I was looking at the Delict because Delict is a card that fluctuates a lot. I would tell you guys, if you're trying to make coins right now in this game, just literally go to Footbin, search through the most recent promo teams, shapeshifters, Tots cards and level ups and look at the graphs. Seriously, just click into these cards, look at the graphs, whether it's a cheap budget that you're on or maybe a middle to higher tier budget, like this is the Luis Figo Striker card, 302,000 coins. What's he been in the last day? Where's he been? He's been between 330 and like 290, right? So like this Figo, if I saw a 295 undercut, that would be a price that I would want to buy or looking through a couple of these other teams I had my eye on, who was it? I was just looking at a shapeshifter card. Anthony Martial, 795, right? Really for this, I want like 760 or 770 because every single day he goes to about 840 and I know he's getting supplied and weak in the rewards, but even 895 on Saturday, there's not a lot of supply for a guy like Martial. The young would be a one to watch, petite. So I would still be trading. If you want to grind the market, if you need coins at this stage of the year to keep moving and keep being able to participate with content, absolutely get on the market and grind because you can just get on bids, get on fluctuations and the trades are gonna be there 100%. Is this a fresh Martial right here? This one that just popped up. First owner tradable. Imagine finishing week in league and getting that. That is pretty crazy. So again, not to belabor the point guys, I know the content right now is just not all that we want and all that we expect, but it is at least very grindable. I'm gonna start playing the cup today, probably gonna get that same juice day done and try him out in the cup. At least play my five games to get the XP if we're able to win 10 during the week that would be fantastic. Get ourselves an 85 times 10 and all the fodder packs that go along with it. So hopefully EA continue to drop good SBC content because that is what Footies is all about. But if you guys enjoyed this video today, drop a thumbs up on it, comment that below if you have any questions and of course, subscribe if you are new. I will see you guys in a video today. Sorry, tomorrow and a stream today. All right guys, I'll see you there. It's been Dave Foot account. I'll catch you guys later. Peace out.


Thanks for checking out this movie review video. This is for the 2020 shutter Exclusive the pale door that is coming to shutter on Thursday December 17th And because it's not on shutter yet when I'm dropping this review and because it's a new film going to shutter No spoilers for this review. I will give it a little small little synopsis And then we'll talk a little bit more. So first of all directed by Aaron be be Coons who did Camera obscura as well as scare package, which by the way, I really like scare package It is available on shutter at the moment if you have not seen it You should definitely see it because it is a quite a good horror comedy in my opinion I like that so much that I actually did a pre-order of the blu-ray So it's back there in my blu-ray slash DVD collection somewhere. So good stuff Written by Coons Cameron Burns and Keith Lansdale Yes, Keith Lansdale the son of Joe R. Lansdale the author who's done some really great stories one of one of my favorite performances of Bruce Campbell Joe our Lansdale's the adaptation of Joe our Lansdale's book for Bubba Hotep Love that love that anyway Lansdale's written scripts for Christmas with the dead and he did the short the companion for Creepshow series which I quite like that one that one was really good Coons called the this film a mix of three ten to Yuma and the descent but with psychological horror thrown into it I think he actually said like doused in psychological horror or something like that and then like Little blades or something it was something very you know over the top But okay, so quick synopsis because I don't want to give a lot away if you want to check this out so basically Western it's a horror Western Mix which I do have to give a lot of credit for attempting something like this because I Really do like horror and Western mixes actually one book I read kind of recent ish that I really loved by Josh Mallerman called unburied Carol is a horror Western mix. It's really good read that book So I have to give them credit on that so it's a horror Western where it's kind of a gang of Gunslingers basically who aren't so great They're kind of on the lamb to a degree and things aren't going well And they run into this little town and there's something going on with the town that is not of this world Really, it's a super natural not normal type thing Good concept. I will say Unfortunately, I cannot recommend this film I did not enjoy it and I'll give you all the reasons why I didn't enjoy it now Another thing is I feel bad saying this but I'm always honest with my reviews And I'm I say I feel bad saying that I didn't like the film and I'm going to say a lot of things I don't like about it because I do think there's a possibility that Aaron be coon be coons will see this review and In the case that he does I loved scare package Like I said, I pre-ordered the Blu-ray and I have watched it twice since it came out and I'll continue to watch it But anyway, I'm not going to lie about reviews like some people I know do So anyway, I'll lay it out here There are a few good things that I did enjoy about the film, but overall I did not enjoy this film I thought there are a lot of problems. I thought it was kind of underdeveloped the story itself Like I said big points for attempting this But there's a lot of stuff lacking and I think a lot of those things lacking come down to the script I think the story needed to be developed a lot more the characters needed to be developed a lot lot more and For the most part the acting is not the best and this is one of those scripts And it's you know kind of slow to a point at times where you need the actors to really sell those characters And for the most part that does not happen, unfortunately So but I'll talk a little bit more It starts with an Edgar Allen Poe quote Which I thought was an awesome start because I love some Edgar Allen Poe I don't live all too far from Baltimore. So I'm a Poe fan down with it We've moved past opening credits though. I do need to say I know some some newer films every now and then We'll still do these opening credits But as a industry film has kind of moved away from that for the most part and I think that's a good thing I really don't think we should be doing Credits in the beginnings of films anymore because it makes people impatient. They don't really like that It's a minor gripe in my opinion, you know, just do the credits at the end. So yeah I do like the opening music though. The opening music was very good. I wrote down that I believed it was simplistic and modern Modernly dark but with a Western kind of tinge to it and in general, this is one of the most amazing things about the film There's something Outstanding about this film and that is Alex Cuervo's score for this film is awesome He did such a good job so much so that I feel like I might want to own the soundtrack for this And I didn't barely ever say that the music is great Like I said, it's this it's this interesting mix that I've not really heard before of like this kind of modern Dark sound with you know, Western mixed into it and it's really really really well done And some of the moments in the film where I was kind of feeling a little bit of something and really engaging a lot Was mainly because of the music driving that the music is excellent So Alex Cuervo big shout out to you excellent job with that So It jumps into action pretty fast with this film. I do like that. That is great It's always good to do that kind of grab the audience quick. The problem is it kind of lets go a little bit after that and then it gets to Another thing that is a little bit attention grabbing But then it gets back to kind of dragging its feet a bunch and going very slow things start to feel very Repetitive especially a lot of the dialogue a lot of the character Interactions are kind of the same throughout the entire film and the same stuff just gets talked at talked about ad nauseam And it's sometimes it's the same characters sometimes It's different characters but talking about the same thing that other characters talked about and there's really nothing new Added to it. So there's a lot of wasted time in this film in my opinion and it really should have been cut down It's like with all the credits and everything. It's like an hour and 36 runtime It definitely needed to be cut down a bunch because it really does drag There are parts of it that don't drag that I found particularly interesting and I'll talk a little bit more about that without spoilers, but yeah, so The acting is rough as I said, it's kind of rough But it does improve a little bit as the film progresses I did notice that so that is good, but still it's just overall lacking and like I said a Script like this you really really needed the actors to be able to sell those characters to pull people in to suck them in the other problem like I was saying is that You don't really understand the characters all that much or have a whole lot of backstory or they don't really develop a whole lot There's one character in particular who's like the main character who you know like you see his journey you see his backstory and everything but everyone else just kind of seems to be there and It just it doesn't create a whole lot of interest one another minor thing that that came up is For films like this you want to kind of try and go for realism With it if you're gonna set it in a setting like Western The people were abnormally clean for a being in a Western in every single scene unless they had you know gotten bloody Which is very unrealistic for this and that's not something that you needed to spend a lot of money on Literally, you could just have people roll around in the dirt after they put their costumes on which by the way the Costuming was pretty well done in my opinion people looked at the part They definitely did and I appreciate that about it, but once again, they're all very clean It looked like they were showering daily Maybe even two times a day that is how clean they looked and for like I said for a film like this a lot of those kind of small Details it matters, so they needed to be dirty I know it's kind of a dumb small thing the other thing is a lot of the there's no Consistency of accents with anyone it was kind of like it seemed like it was like a Do an accent if you feel like it don't do one if you don't feel like it and pick your own accent and That that's another one of those kind of like attention to detail things where you're kind of Breaking people out of the Illusion of it being in that time period and being a Western in that area Just like you are with you know people just being abnormally clean for that time So another one of those small things that kind of irked me about it The camera work in this is very unstable A lot a lot of movement going on not intentional It's you know kind of shaky not intentional It does get more stable as the film goes on and I really did appreciate that and I felt like as the film went on The camera work in general seemed to get like I said more stable But also there were more inspired shots that started to pop up It's kind of like the cameraman was a little bit nervous not really sure of themselves early on and then as the film Goes on they started to kind of settle into things and it's kind of started to come up with some cool visual ideas So towards the you know later middle and the end of the film there are some really cool camera Movements that come in some camera shots that come in the other thing especially early on that they do do a better job Of getting away from later is Very close-up shots like really hugging people in the frame That is very uncomfortable. It's hard. It's it's like back up, dude Like give this some space like it's good to kind of give space to the characters give a space so that the audience can really look at the setting because Where they were shooting, you know their locations looked good They looked appropriate for what they were going for so you know just bring it back a bunch But like I said that did get better as the film went on No Consistency accent I already talked about that There's more dialogue in this than there really needs to be and I think that kind of goes hand-in-hand with my comment about Cutting it down for runtime because it drags a lot a lot a lot a lot of dragging in this There's a lot of reputation in what gets our I'm sorry repetition Have not a correct repetition in what gets talked about like I was saying and When that happens you really get bored as an audience member when you just keep hearing the same thing talked about again and again And again, and it's not really progressing the story. It's not going anywhere The other thing is when you finally do talk about that thing again or have the characters talk about that thing again And there is something new added the audience may have kind of checked out already on that so You need to be more selective with the dialogue that you're that you're using Just saying There is a nice creepy visual surprise In this and I'll tell you I'll give you an idea of when it is in the film So you'll know when it happens that this is what I was referring to but it doesn't spoil anything There's a camera shot where it pans upward inside of a building to look at the ceiling So now you'll know what I'm talking about very good shot looked really creepy Really nice really enjoyed that There's some there's quite some solid fun that gets injected into the film around the 50-minute mark so I Wasn't having that much fun until about the 50-minute mark It does get much better after that in my opinion because that's when kind of the Western ends and the horror begins so It's much better but still You know the camera works settled down like I said and there were actually some really good visuals at that point a lot of them Driven by practical effects the practical effects were handled pretty well in this I will say that that aspect of it was pretty good. I was impressed with that Like I said again, I do have Reiterate I do have to give credit for attempting this but unfortunately, I just have to call them an attempt I don't think it was very successful The story is not very compelling past the overall idea of the film That's one of those issues I was talking about with the script. It just needed more time It needed more depth to it the characters as well Good idea good concept It just wasn't really developed a whole lot unfortunately In order to really sell it like I said You needed the cast to really really sell it with their performances and that didn't really happen either a few of the characters actually I felt were Miscast as well Not gonna you know name names or anything like that because there were a few actors and actresses who did handle their roles pretty well And I was like, oh, that's a that's a solid performance, but overall Yeah, to not so good The runtime again the runtime the runtime the runtime for what it was and how much it it dragged and Another thing that I definitely definitely want to say again, even though I already said it Alex Cuervo that soundtrack is Amazing so good. I loved it. I loved it. It's my favorite thing about this movie. I Could probably just put the movie on again and only listen to the music The last thing I want to I want to stop with here is I have a Feeling that one of the influences for this film was from dust held on by Quentin Tarantino I'm it's just a just a hunch. I have based off a feeling I got from watching the film But anyway, obviously, I wasn't a big fan of this one But I have said this many many many times in my reviews. This is my personal opinion. This is how I personally feel about these films So I still encourage people to go ahead and watch the movies to make up your own mind There have been plenty of times that I have had good reviews of a film and people come back and comment on that review and say You know, I hated that or I didn't really dig on it Or I've had bad reviews on films like this one and people have watched it come back and said, you know what? I love that actually and that's good That's great because this is just my personal opinion and no matter what film I'm reviewing They're gonna be people who hate it people who love it and people in the middle and that's what's important So the other thing I always say is every film is worth watching at least once Just to make up your own mind. So do that. I would say but for me personally, I don't really recommend this film I didn't like it Which was sad because I really wanted to so out of five stars with half stars in play I am giving it one and a half stars Sorry Aaron if you see this like I said, I bought scare package, man I bought it might even watch it again soon just because I feel bad about this But anyway, I'm gonna be honest about these things. So anyway when people do see the film if people do watch the film We can talk down spoilers in the comments. We can do that Let's talk it out. Did you really like it? Did you not like it like me? We're in the middle Let's talk. Anyway, do me a quick favor and hit that subscribe button If you can for me if you like any review I've ever done any video I've ever done that's your best way to repay me for doing that because I don't make money or anything I'm just doing this for the horror community to well I mean build a horror community with this channel So I would appreciate that also hit that notification bell if you're gonna do that Because that way you'll know whenever I'm putting up new reviews or unboxing videos or doing live streams or any of that stuff But regardless, I do appreciate you taking your time to watch this and until next time keep it brutal


Hello everyone, this is financial author Amit Dan of amitdan.com On this channel you'll find financial travel and more videos just like the one you're watching right now If you like what you see, just give me the thumbs up and consider subscribing Marriott and SPG new hotel loyalty program 3 things you must know Hello everyone, this is amitdan of amitdan.com Marriott just provided some insights on their new hotel viewers program on April 16, 2018 And today I'll talk about 3 things you must know now about these changes The first thing you need to know, what will happen to SPG and Marriott viewers points The new program, which doesn't have a name yet, will combine Marriott, SPG and Red Couton into one single program If you are holding SPG points or if you are a SPG member, then you need to mark your SPG account with Marriott account And for each SPG point, you will receive new Marriott points at 1 to 3 ratio For example, if you have 100 SPG points, you will receive new program points which will be 300 points If you have Marriott and Red Couton accounts, then you do not need to mark your accounts and the number of your points will not change For example, if you have 100 Marriott points or 100 Red Couton points, you will be still receiving the 100 points under the new program Starting 2018, you will be able to earn and receive new points at 29 global hotel chains Our global hotel brands covering 6,500 hotels in 127 countries And all these hotels are under the same New Works program Second thing you need to know, what is going to be the new earn rate under the new program So under the new program, for dollars spent, you will be receiving 10 points per dollar Except these 3 brands where you will be receiving 5 points per dollar And these 3 brands are residence in town place and element Where you will be earning 5 points per dollar Elite members will earn more programs and more points and it can be as high as 75% bonus points If you are Canadian SPG American Express trade card or it's how American Express star would prefer this trade card Then we will be receiving 1 points per dollar spent However, this card will go through some changes which we do not know yet But there are more benefits and changes coming to this card Third thing you need to know, how many points you will require to have it free night Currently you will require 3000 SPG points and 7500 Mario points for Category 1 hotel free night Under the new program, you will be requiring 75,000 points for Category 1 and 85,000 points for Category 8 free night Starting 2019, there will be a free night chart Points required for free nights will vary based on various factors such as peak time, off peak time or standard time and so on If you are booking a free night on off peak time, you will require 20% less points And if you are booking free nights on peak time, then you will require 20% more points So there are more changes coming to these programs which we do not know yet However, for Canadians at this point that SPG American Express star would prefer this card Looks like it's going to stay and there will be more benefits will be added However, I do not know if there will be any other cards which is not American Express Will be coming to Canada or not So we will have to just wait and see what happens But so far everything looks good and most of these changes are positive So we will see and wait to have more information on this Thank you for watching If you like what you see, just give it a thumbs up and consider subscribing Because there will be more videos coming up So I will see you shortly


We're at our third Community Economic Development Forum in Campbell River, end of January and what a great time to do this. People have come together today, a significant crowd, local First Nations as well as local community representatives, the mayor, the previous mayor, people from different community development, economic development organizations, a wide variety of community leaders here. I've always been optimistic about the future of Campbell River. I've lived here for 30 years. I love processes like this because I love brainstorming, I love exchanging ideas. I think that nothing but good can come out of it. And this will help to coalesce some of those opportunities around some actual function that we'll know we'll be able to align with government for resources and for in-kind help and that's really going to help us move along. Campbell River is a great place. It's going to do well and the timing is right, the potential energy is right so it's going to take off. We just got to make sure we're heading off in the right direction. I like a lot of the ideas here because a lot of them involve training for young people. We are central to the Vancouver Island North and so the First Nations and non-average communities north of Campbell River utilize the services, the programs and the expertise of Campbell River to enhance their own economy as well. Works like this are going to put us on the map, help our community get profile beyond what we would normally be looking at and there's so much going on, there's been so many conversations that there's now this kind of undercurrent of excitement about the future so we're looking forward to everything that this community has to offer to the world.