If this video does not fire you up, then absolutely nothing will. If you need a shot in the arm, if you need a shot of adrenaline right now, this is going to be the video that you want to watch because I just literally just go off on this group of agents in New York about the state of the market, about what you need to be thinking about moving forward for the rest of the year. This is your time to shine. I'm not going to waste any time right here. I'm going to dive right into it, enjoy. But man, like visualize where this thing is going. You could be making a million dollars a year in the next like three years if you go all in right now instead of sitting around saying, well, nobody's doing anything. So what's the point? Go find a property. Go talk to sellers to find your buyer of property. You're doing half the job. You're just finding 50% of the deal. I cared about one thing, connecting buyers and sellers. That's it. It worked for some people, but for me personally, it's garbage. I'm trying to get to know somebody and see what it is they want to do for the rest of their life and help them do it. After our learning all that, it still took me six years of 15 hours a day to get to 100 deals a year. You're not going to get to a million bucks a year if you don't have an assistant handling everything on the back end. Putting stuff in MLS, setting up all the showing for agents, wanting to show your listings, setting up showings when you want to show property, getting pictures done, transaction coordination. All that stuff needs to be delegated 100%. I've invited a business partner from Orange Beach, Alabama, Ricky Karuth. And this is a special treat for everybody because normally Ricky and I would say, hey, go listen to his videos on YouTube. But I wanted Ricky to come in and give you a shot in the arm of inspiration today. And if you have any Q&As for Ricky, here he is. Hi Ricky, good morning. Hey, good morning guys. Morning dude. Y'all look hungry. Morning, morning. Morning Ricky. Good morning Ricky. Y'all look hungry and focused. Thanks. That's right. Looking serious. Ah, nah, nah, absolutely man. Good to see you Joe. Yeah, let me just tell you what I think and then take some questions and that'll be good. So like guys on number one, I don't know. I don't know quite exactly what you all do or what you think or what's going on. But it's not, this isn't really, this isn't rocket science. You talk to people, you help them buy and sell real estate, right? That's just the basics. It's kind of like poker. You can learn the game in a couple of minutes, but it takes a lifetime to master.  That's just the name of this game. That's why most people quit. But right now we're in this really interesting place where the market has retracted a whole lot in terms of transactions, but prices have held solid and we're going into the winter. We're already in the fall and things have already slowed down even more. I was talking about this months ago, like, like you, you better be going all in right now to squeeze that summer market for everything it's got because it's going to get slower in the fall. You're struggling now in the summer.  Now the, the message is go all in because what you do between now and January 31st is really going to dictate your 2024. You see every year you stair step your income based on what you do in the off season.  You can't really prospect all year long. You know, I'm a realist. I'm very realistic and I, and I know that when I was, when I was just beginning my business, I could prospect all year long, but once I picked up some steam, I didn't, I couldn't prospect and sell like I was busy closing deals. You get busy and then you feel bad because you didn't make the calls and you're not building your business.   Maximize through the yearly cycles and then you maximize through that's tenure cycles. We're in this tenure cycle and what I did with the last tenure cycle, which was that 2008 situation got me to where I was selling 100 properties a year, but it was like six years later, but it was from what I did during that time right now, the work you're putting in is going to put you in position to do a hundred deals a year or whatever, you know, in three, four, five years, but you can't see that because you're just thinking about 2023, 2024. It's like great. Have a great 2022, 2024, but man, like visualize where this thing is going. You could be making a million dollars a year in the next like three years. If you go all in right now instead of sitting around saying, well, nobody's doing anything. So what's the point?  I hate to say that. I mean, what, what do we get into this business to do? You know, we got in this business to crush it. I hope you got in this business to just crush it. So just go crush it. What does crush it mean? It means talk to people all day long, whether it's through video and social media or cold calling or door. I don't care what you do. Just go do something. Talk to people. Don't chalk it up every day to I'm getting my systems in place or I'm making videos or I'm, you know, making my business cards, getting my website, just write all that stuff that don't make you a dime that doesn't matter. Do when I started, I didn't have a website or business cards. I was calling, sending mail and doing emails with no website, no nothing. I didn't have anything, but I knew one thing. I needed to talk to people to help them buy and sell real estate. That's our job. And the funny thing I see nowadays is agents do and half the job. They're coming in and they have a buyer and then they're waiting on another agent to list a property their buyer might want. Go find a property. Go talk to sellers to find your buyer or property. You're doing half the job. You're just finding 50% of the deal. You know, our job is to connect buyers and sellers.   Go sell it. Go find a buyer for the property. Do your job. So that's kind of like where I'm at right now is why aren't we going out and doing our job?  You know, like where did all the hard workers go?  You know, I hate to say it, but it's just like laziness is this new like epidemic in the world now. And I'm not going to live like that.  I want to crush it. I want to do all this stuff, but they're not willing to just go do their job and talk to people and help them buy and sell real estate. It's nuts. You need to start categorizing your prospects right now. Okay. With these high interest rates, the only people buying and selling are people that have to and what you're doing is you're trying to turn every prospect into a deal when they're telling you they, you know, they might do this if they want to or they, if they could do this, they would if they could find a place they would if interest rates weren't high, they would, but those people don't have to. They're just saying they would if they could quit trying to turn those into deals today, save those people for a rainy day when the market rebound. See those people that don't want to do stuff right now or act like they would if they could. They're just telling you what they want, what you want to hear and then you're spending time on them when you should be spending time on people that need to buy and sell or looking for people that need to buy and sell. That's your only clients right now. People that need to buy and sell and investors, right? Investors buying no matter what the market's doing up down sideways, investors are buying and selling. I'm buying properties every month. I'm an investor. So people that need to buy and sell and investors, right? The people that, that what if they could? Those are going to be the people that triple your business in three years. Okay. If you can create those relationships, put them on your weekly email, whatever you do to stay in touch with people and let that snowball build and let that database grow. That's where your business is going to explode over the next couple of years, but we're just so focused on A, closing that prospect that's not ready to do anything and then B, not really putting anything in place to stay in touch with anybody we ever talk to. This again, this, this is just so simple to just for me to tell you, like just the basics here. Talk to people, make friends with them, stay in touch forever, right? I mean, we all know this, right? But why aren't we doing it? You know, do a weekly email.  You know, if your thing is social media, use it as a platform to get to people to start conversations.  If you do or not, do or not till your knuckles bleed. I mean, that's what it takes. And right now is a little slower than normal because we're in this down year, plus it's the fall. Perfect opportunity. Guys, every time the market retracts, that means there's fixing to be an explosion. This little four million transaction year we're having as a country tells me we're fixing to have an explosion. When's it going to happen? I don't know, but I'm going to prepare. What does that mean? I'm a squirrel. I'm going to be gathering nuts like I'm like I'm storing for the winter so that when, when this thing explodes, I got plenty of clients calling me. You prospect so much that eventually your prospects start cold calling you and that's what happens, but nobody wants to put the work in. It's like anything, everything between you and a million bucks a year is a thousand thousands of one-on-one conversations. That's it. So how quick are you going to go through that thousand, those thousands of conversations, right? You're going to do it over the course of a couple of years or you're going to do it over the course of a couple of decades. It's your choice. You can just trickle little conversations here and there, you know, and just drag this thing out forever or we can get this done right now and get to that million so that we can move on to bigger and better things like buying rental properties. You know, that's what you need to be doing.   They knew they were dying. They were, they were in there. They, they died from old age. They knew they were dying when they got the word they were dying. Guess what? They were still in the office making calls every day and we're like, what the hell is going on? Well, like they didn't do anything to like put their life together where they, so they were making calls to, to, to, to try to make as much as they could to leave their family as much as they could before they died, made calls up to the point they couldn't even get out of bed, died three days later. That's not how I'm going to live. I'm not going to live calling for sell by owners till I'm, till I'm, you know, till I die. It's not going to happen, but you got to get on it now. You got to, you got to have all those conversations now.  So that's what it is. You guys need to focus on the four most important activities, right? They're both the highest priorities are not making calls by the way, right? It's showing property, going to list appointments, writing and negotiating offers. Phone calls actually lands right up under those four things. If you're doing these four things eight hours a day, you're the most successful agent in the, in the world, in the history of the world. If you do those four things eight hours a day, nobody's doing those four things eight hours a day because you got to do the things that get to those activities, right? And then you got to process. You got to do all this and that, da, da, da. You know, but phone calls is the highest priority. If none of that's going on, if that's going on, then that's the priority. And then phone calls, right? And then your marketing, your videos and all that stuff. It's not a tough game.   You know, the real like future top producers, they, they understand this game as stages, you know, and we're all in a stage and the really good ones, they just bust right through those stages. Oh, phone calls. Oh, I'm scared of calls. Okay. Boom. Let me make them. Okay. Now I'm not scared. Okay. Now what do I say? How do I say it? How do I read people on the phone? They just bust right through that versus a lot of people just get stuck in the first one. I'm scared. I'm not going to do it. So they get stuck right there in that stage, bust through the stages all the way through to the very top and then, and then turn around a little back and say, okay, that wasn't so bad. What's next? Cause when you make a meal a year and then January 1st hits, your, your, your income from the year goes from a meal to zero. And now you say, oh shit, I got to climb this million dollar mountain again. It's daunting. Ladies and gentlemen. So right now is, is really that, that key moment. You're going to look back and say, I wish I would have went all in. I wish I just would have went all in and just make calls eight hours a day, you know, made videos, whatever you do, but, but like conversations. So I hope you guys hear that and maybe it you can apply that to your business and maybe give you a different perspective and, you know, outlook and direction of visualize because this thing is going to blow up like there's too many sellers. Listen to this. There's too many sellers who hate their home right now. They're locked in with a low interest rate and they hate their home and hates a strong word. You know, they don't like it. They need an extra bedroom. They, you know, want to be on the other side of town. They want to be on the water. They, whatever, they don't want to be where they are, but they can't move because of interest rates. Do you know what that means? That, that, that's the definition of pent up demand sellers want to sell badly. They just can't whoever creates the most relationships with those sellers who, who can't sell, but want to that's who's going to triple their business quadruple 10 X their business over the next two to three to four to five years.  So what's the point? What's the point in calling them? Then you're not going to be the one that 10 X is your business and, you know, hits a mill in the next three years. Cool. Let's do some Q and A. See what's up with y'all. Thank you, Ricky. I have a question. So thank you for putting into perspective the fact that, you know, there is a future in this and that there is stages in it because, you know, I'm, I'm someone that has personally been stuck in the past and, you know, understanding that there's stages to this and understanding that you, like you said, have to knock it down. You have to make the calls.  Don't listen to anything number one. When I was coming up, I didn't have a social media account. I didn't know what the interest rates were. No idea. I didn't even know the stock market crashed in 2008 and I'm talking about all the way to 2017. When I started coaching and creating content, I didn't have social media. I didn't know what interest rates were. I had no idea what what the 30 year fixed was at any given time. This is when I'm selling 100 properties a year. I started selling the first year I did 100 deals was 2014. I had no idea what interest rates were. Didn't care. Could care less. I cared about one thing connecting buyers and sellers. That's it. I was focused on one thing connecting buyers and sellers and I'm not saying don't be on social media or create content because I think you should. I'm just making a point of the depth of the focus. Right. I was only focused on one thing helping up people buying some real estate to make a million bucks. That's it. I didn't care about anything else until I conquered that nothing else matter. I would have money to invest. I didn't have time to research markets and whatever little research I did was what I did to look up properties for people. Whatever I was seen in the field as I was showing property and whatever I looked up to put into my weekly email. That was it. I don't know anything about national numbers or none of this stuff. So I think it takes a real high level of focus. You know even thinking about what you're going to do after is actually a distraction. I'm going to make a million bucks and then I'm going to do this. I'm going to invest in properties and stuff. That's even a distraction even though that's what you should be thinking in the back of your head. You know invest invest invest buy passive income. But that can even be a distraction. You know but at the end of the day at the beginning I was just trying to sell properties. And I lost everything doing that. It was just backwards and until I realized that it's not about the property. It's about using the property as an excuse to get into a conversation with someone to see if you connect for the rest of your life to try to make lifelong friends with your clients. Then until I got that then I my business was just dead because when you make lifelong friends with your prospects and clients your business is just snowballs and it just gets bigger and bigger and bigger because they do repeat business with you. They refer people to you but then the referrals do repeat business with you. They send you referrals now you're getting referrals of referrals of referrals and all this repeat business. So it's like a spider web and it just it's a snowball when you build it like that. But if you're just in sales where you're just trying to sell the property instead of using the properties and excuse to talk to someone to see if you connect with them short and long term when you're just trying to sell the property then you don't really make that connection. Then they're the prospects like they could take your leave you you know and they'll go use another agent.  It means asking questions and being genuinely curious about their situation. You know why why why why understanding why they want to do what they want to do and they want to do how they want everything and then continuing to ask it's like OK.  That's what that's where like people realize wow this person really cares they're asking me all these questions. So I think you know a super high level of focus and then understanding you know when you call a circle prospecting Geo lead you're not calling about that property you're using that properties excuse when you call an expired you're not trying to list that expired you're trying to use that properties and excuse most of the expires are represented a representative as buyers. You know because I just get into a conversation in that figuring out what it is they want to do come find out they don't want to sell that property want to buy this property over here or they're looking for this or looking for that and I'll sell them something not list their property but represent them as a buyer because I'm open when I'm trying to just listen. I'm using the properties excuse to get into a conversation to listen about what they want to do. I'm not focused on trying to set the appointment sell that property. Here's why you you know all that stuff to me. It works for some people but for me personally it's garbage. I'm trying to get to know somebody and see what it is they want to do for the rest of their life and help them do it. So focus and a high level of genuine curiosity around you know when you're calling a Zilla lead I'm not trying to sell the house that they're inquiring about I'm trying to use that situation to get into a conversation. So hey I see you were looking at this house online tell me what's going on. You know I expired I see you were trying to sell this house at one point whatever happened with that I'm trying to just spark something that creates a real conversation not just a scripted you know trap you know or whatever the case may be. So I think focus you know deep conversation deeper conversations not just surface level and then have systems in place to where no one you ever talked to ever forget who you are you know and that's where the weekly email just simplifies the whole process. Gotcha. I have a question so you know it sounds to me obviously over time you're developing your social skills sorry and building a rapport with these people and I'm just wondering you know if you were reading specific books or for example if you ever like we're utilizing an LP or any of that kind of material or if you're just doing it all natural just by you know practice. Just practice. I don't know what an LP is I've heard about it and I'm sure it's I think I understand kind of what it is but I've never really looked into it. I serve tables for a while at a restaurant.  And so that taught me like the hours you're supposed to work right and a lot of people don't even understand that and then the serving the tables really improved my like my social communication skills you know with people I didn't know and I used that as exercise you know like I was really in that fixing to become an agent when I was serving tables and when I lost everything I went back to roofing and serving tables and it was fun for me because I was like you know I was really you know getting into it with the with the serving there were a couple of books that I read that were really generic books about like you know how to talk to people how to make friends stuff like that I don't remember any of them it was a long time ago I read about a hundred books back when I lost everything 10 x roll slide edge compound effect you know all the classics and then a bunch of just generic ones that I found but I think you should read you should be reading your ass off and just developing whatever skills you can you can you know develop you know books are just like the key man like you it's it's incredible what you can what you can take out of books and apply it to your life and everything but um but but I'll be honest like most of it was just practicing you know and like I didn't do any role playing I never have anybody role play with I was literally by myself wherever I was I was in office by myself everywhere I didn't have like a group or like agents never happened um I I would practice on prospects you know I mean I realized pretty early on that I can never call every single property owner which means business is unlimited forever because even if I did call every property owner in my market I'd have to turn around they change their mind every five minutes so you can't call you know everybody every five minutes it's just unlimited it's unlimited abyss so I knew that and I never even called anybody twice that's another like fact is I never I saved all these phone numbers of all these subdivisions and condo complexes that I was like I'll save these for a rainy day I might call these back one time one day never happened never got around to it in today's world and of course I would like I was it was literally notebooks like notebook paper like it's actually you see this door right here like there's a box in this door with every number ever called on real paper but um today you've got the dialers you've got all the stuff like digital and stuff you can like click a few buttons and like auto dial like I didn't have any of that so you can call people back and go through subdivisions like in a matter of minutes a lot easier nowadays I'll probably do that nowadays but yeah like these scripts and stuff that I've have on my website I developed that those were just unique to me and it's just and I didn't read any of that out of a book it's just trial and error you know so like I said it's the stages okay and like you may be in the stage where you're trying to figure out how what your tone needs to be you know and like the speed of voice and like how to make people feel comfortable with you and stuff that might be where it sounds like where you are and there's no like magic pill that's going to make you all of a sudden great at that tomorrow it's just it's going to take time and practice it takes a long time then it I got in a note to a loss I saw my last condo in 05 didn't sell anything between 05 and 08 08 I get back in and that at that point I had pretty much learn a good bit of what I teach nowadays okay that like it took you know making it losing it and then realizing what I did wrong and how to really build the business right after our learning all that it still took me six years of 15 hours a day to get to 100 deals a year six years you know it's just like I made it lost it came back and then six years later after all that I had to have my first year of 100 deals and it took me 15 years total from the point that I started real estate till the year I made a million bucks in a year 15 years and like people are like I saw it's about you know three months in I haven't sold anything it's like shut your ass up you know or I'm two years in and I and I'm only making a hundred thousand years like oh my god you're crushing it you know it's like fuck right because what is it ninety percent quit in the first year anyway yeah and that's a whole another conversation you know that whole that whole deal yeah I mean that's why I was partially just curious but as you said you you're you're not really like reading those kinds of books but I was just curious I did read some books I did read I know I just been about NLP specifically I don't know what it is honestly I've heard about it and I think I have an idea but I yeah I mean I'm just naturally built a skill through whatever reading I did and talking to people I'm an introvert I've no interest in being in crowds or talking you know making videos not my thing but I you know develop these skills you know as if I'm a tradesman you know what I mean like this is my trade learning how to talk to people making people feel comfortable with me working hard making sure that you know they're taking care of so that's the way I look at it yeah I know it's good so thank you yeah ma'am yeah so I'm gonna follow up with a question Ricky so you said you're introvert so how did you develop that to be more of an extrovert to be social just making the calls every day being disciplined and consistent and you just well I'm not well I'm not I'm not sociable I'm not whatever you just said I'm not right I don't look at the calls as being extroverted right I look at that as that's my job okay my job is like I said I look at this as a trade as a skill my job is to talk to as many people as I can to make them feel comfortable with me and then help them truly help them that's my job right and that's the way I look at it like I said 99% of my call sessions were in a dark we're in a dark room by myself right I don't want anybody hearing me make calls you know I'm saying you know so you know when I'm making videos and stuff dude I mean honestly if you ask me my videos suck you know like you seem lively you started off with a nice pitch and you know talk about the rates at all like you have a lot of energy in your videos where you seem like you know you would think because you captured me in the first few seconds talk about different rates and what's going on I told you I told you but again but again that's my job yeah my job is to get your attention and to bring you some value right and I'm doing that by myself looking at my phone I'm not in front of a crowd now I mean I go speak and I'll go tell jokes and I'll make the audience laugh and cry and everything else but again that's the skill that I developed you know I wasn't natural and so I say all this to give you guys inspiration and hope that doesn't matter if you aren't great at calls or don't like it or don't want to publicly speak or aren't good at videos or whatever the case may be right I'm in Alabama I grew up in a trailer roof and houses if I can do this I promise you anyone can do this that this is not you know this isn't the success in this realm whether it be real estate or even just social media in general is not reserved for the few okay it's not it's not like there's only the people at the top and you know no it's reserved for the people that are willing to work for it and work to get better every day no one at the top very few people at the top are just natural you know at whatever it is you see them doing you know Ryan Sirhan like he wasn't a natural at what he's doing now Mr. Beast not a natural like if you watch all these all these guys journey from day one like you'll realize like if you go back to the early early days you'd be like oh my god you know it's it's bad so you know everybody wants to compare their self in their bad days to people that are at in their great days it's like no they started out right where you were right where you are anybody else have a question for Ricky Ricky I have a question about your investments do you do single family homes or multi family homes both okay where do you find sorry single family duplexes for plexus apartment complexes commercial I like small commercial buildings I've got several commercial buildings like thousand to three thousand square feet I just bought five new construction homes that are brand new I just bought a little nineteen sixty two bedroom that we remodeled I just bought another little tiny thousand square foot office building I've got three acres under contract that I can build about 30 or 40 apartment units on that I'm probably going to build so I'm doing a little bit of everything but it's all local it's all right here in my backyard the three acres is literally two miles from my house those five new constructions are literally like two miles from my house so that's kind of what I like I don't I've got a partner here and there on some of all most of them I own myself what's that you have property managers no I just I do it all of them yeah it's pretty easy because nowadays there's apps that the renters actually apply on and pay their rent on and so it's super easy you know they pay the rent that app act you know makes them pay a late fee you know if they're late you know I can go on the app and see who hasn't paid it's it's like before the app yeah I was like okay let me think about getting a property manager and get too many properties here but with the app it makes things so easy I just scroll through and see who hasn't paid you know reach out to them see what's up they call me if something's wrong and I get a contract plenty of contractors you know to to handle all that it's it's not a it's nothing crazy right it goes back to hard work being this lost art like guys like you realize like I edit some of my YouTube videos and I post everything I answer every DM myself every comment is me what it like when I was selling a hundred properties a year I showed every property like I didn't have a buyer agent right you just I could go on and on and on here like I do all this stuff you know it's not a thing for me it's you know I think I think we're in this war where everybody's trying to get out of doing stuff how do I delegate this how do I delegate that and that's awesome you know leverage and delegate all that stuff great go do your thing everybody operates differently you know maybe that's your thing is delegating stuff great awesome I delegate plenty of stuff but I know the things that I want to do you know the things I'm willing to do and I make it easy like the property management so easy I could have a hundred two hundred properties managing I got about 30 something right now like it's nothing you know they call me a call a contractor they'll text me or whatever like it's not a big deal so I think people just make big deals out of nothing and then act like it's something oh god I got to get out of here there are things you need to delegate right you're not going to get to a million bucks a year if you don't have an assistant handling everything on the back end putting stuff in MLS setting up all the showing for agents wanting to show your listings setting up showing us when you want to show property you know getting pictures done transaction coordination like all that stuff needs to be delegated hundred percent so I'm not saying don't delegate I'm just making a point that I'm willing to do stuff whatever I told who was it of a Joshua Smith or somebody the other day I was like if I lost everything today like I'm ready right this second to go hop on a roof and start laying shingles right now zero issues ready to go ready to get on a ladder go on a roof and start nailing shingles ready no problems you know a lot of people are like I won't even I won't go work at you know McDonald's I'm too good it's like I see people lose their job and then they don't even work for like a year and a half I'm trying to do this and that like dude I would have been sweeping floor like I would have been cutting like it's insane right it's insane thank you what else you guys got I got time for one more hi good morning so so these investment properties that you're currently managing how do you source and and find or try to I guess differentiate one property from the next second like a zero formula is there a sheet that you use to see what's the cap rate for each house where you just like what's the formula for trying to source to each property to the next they just fall in my lap and I decided if it's a good deal or not a look at what the monthly payment is a look at the cash I'm gonna have to put into it you know like the new constructions for example I have to put about 80,000 down and my payments about 1650 and I can rent them out for 2400 so what's that it's about 750 a month cash flow so I'm putting 80,000 down cash and I'm making about nine a little less than nine so about 8500 or so a year or something off that no maintenance because these are brand new homes no maintenance for you know 510 years whatever so that's 8500 on an $80,000 investment so that's more than 10% a year back on my cash then on top of that it's paying a self off on top of that it's appreciating these homes have already they've already raised the price like 6000 since I put these under I just closed on them like and like you know I'm closing on two and two weeks and then I closed on three already but anyway like that's just one example a cool thing about those is they're new so the insurance is low workers are built to better standards and I went through the builder on the loan so the mortgage rates 5.9 on an investment property and they're paying 5000 my closing costs no maintenance for five years it's like for me it's a no-brainer I'm let me I was like let me buy five of them that's a good those are great investments and the thing is about it is that anything that cash flows in this high interest rate environment now is a true winner because although rents may be coming down a tad or leveling out or re you know finding a new floor they're not going to go to zero okay I mean the on these deals even if rent went down 20% I'm good but rents I don't believe rents going to go down 20% like in the hardest hit cities like Phoenix rents down like 6% year over year that's the heart that's some of the hardest hit cities it's going to level out somewhere my point is is that rents will continue to rise once they find that leveling out all the dust clears they're going to continue to go up to 3% a year alright if rates go down over the next say five years okay and we refinance at a point cheaper now where our cash flows even more so if your gap between your your expenses and your your rent is X as time goes on your monthly expenses are going to go down if you refinance and your rents going to go up so that gaps going to get bigger over time so if it cash flows now it's it's a it's a winner right um that little two bedroom I flip properties of two other guys and this one was one that fits my portfolio so I'm a third partner on the flip so we bought it fixed it up and then I was like I'll buy it so already have automatic equity because I'm a third partner on the flip and I just bought me and the other guy me and one of the other partners we bought the other guy out so it's like I don't go like out looking for deals I just kind of like things just fall on my lap and I'm like okay you know this is a good one that three acres I got under contract to build 30 units that's my buddy he listed it and I was like man if you find something to build build some apartments I want to build some apartments like I got this thing over here I was like damn so you know it's a good deal and so just depends I think after you do it for a while you kind of realize what a good deal is and stuff you know Grant Cardone likes that 1% rule like 1% of what you pay for it is the monthly payment I've seen that on some things like we did a commercial deal and we paid 450 and we run it out for 4000 we could have got 4500 we'll be it will definitely be able to when the lease is up probably be able to get 5000 but that was a good little 1% rule deal and that the numbers work when you get something for 1% it rents for 1% of the purchase price that is a winner right there this two bedroom we're buying for 195 we'll run it out for like 1500 so it's not quite a 1% these deal Horton homes we bought them for like 3350 we're running them out for like 2400 or so that's not a 1% you know but the numbers still work really great so I wouldn't just hang my hat on that you have to look at the whole deal cash up front you know return on it on that investment plus your depreciation depreciation and debt by down I mean I'll tell you my my plan real quick and then I got a role I got to go catch a flight I'm my goals to buy a property a month for five years that 60 properties I've already got about 40 so that'll be 100 if they average 500 a piece that's 50 million if I take another 20 years to pay it all off and it more than doubles in that 20 years which is pretty conservative it'll be a hundred million bucks worth of paid off real estate probably bringing in like two 300,000 a month that's just a little thing on the side I can do so like all the brand building to create these different revenue you know avenues that's just to get enough money to buy a property a month right and try to build this you know hundred 200 300 million dollar real estate portfolio kind of just on the side while I'm trying to build these other businesses got it cool cool anything else I can do for you guys today. So I am sorry. What are so in in Alabama how like one of the addiction laws like how it's really good I can get somebody out in about 45 days. Awesome. Thank you. Yeah. It's a little bit of a process but I can get them out about 45 days I can I 45 days for me filing the first thing I can have the cops there in about 45 days to remove them from the property. So it's pretty good. Ricky, I have a question about prospecting and you taught me this. I want you to tell everybody else about the rejection part. You know, when it's just a while. Well, rejection is just again them telling you what they want to do. What you call rejection get somebody give me an example of like a rejection or or an objection. You know, you're having trouble with. I'm not looking at. What's that? I'm not looking at by or so. Okay, great. Do you have an agent that you would work with when you do? Yeah. Okay, so great. Who is it? Oh, John, though. Cool. John does a great agent. You're in good hands. Listen, I still love the opportunity to stay in touch with you. Is that all right? That's fine. Cool. What's a good email? See you. They're telling you they don't want to do anything right now. Awesome. Go ahead, Renee. What was yours? I had a woman who said she didn't want to sell until her daughter graduates from high school. So three awesome. When's your daughter graduating? Where'd she go to high school at? Cool. I mean, I graduated in 89. How you do? Like is Miss is Miss Stuart still there? Yeah, she is. You know what I'm saying? Yeah. Like, okay, you that's awesome. You want to sell when your daughter graduates. Amazing. You know, like that's exactly, Renee, what we're looking for is people that are telling us that kind of stuff. Then we go deeper and deeper and deeper. Right. Do you have an agent you're going to work with whenever your daughter graduates and you guys move on? Do you have somebody in mind and agent that you're going to work with on that? Because I'd love the opportunity to interview for the job, work with you however you want to. However you want to word it. Right. But I would love to work with you. You know, it is how I worded it. I have a son that's the same age. So we got a good conversation about it. Yeah. And then just identifying if they have an agent and then, you know, identifying yourself as their agent, right? And then putting together a plan, you know, it's like, okay, when she graduates, you guys going to hang out on the house and kind of enjoy it for another couple of months before you get serious about moving. Do you want to move immediately? Right. I mean, there's more to the story. And unless you know all these details, you can't help them. You know, do you want to hang out there another year after? I mean, they might want to hang out in their house and enjoy it for a year after they graduate and then move. We don't know until we ask. They want to move them. They might want to move immediately. They might want to already have a house done ready to literally like move day. She moves out. They've already closed on their house and they just move over and then put that house in the market because they can buy before they sell. Some people have to sell before they buy. But we don't know if they do because we haven't asked. We don't know what their real plan is until you understand what their plan is, what they're wanting to do, why they're wanting to do it, how they're wanting to do it. You can't help them. And that's called, ladies and gentlemen, being a professional. Cool. I got a role, guys. Enjoyed it. Ricky, thank you so much. Thanks, Ricky, guys.


Right, so this is redeploying the same vulnerabilities. This is a talk about EV security work that we've been doing for a little while together, and some of how we're seeing the same vulnerabilities that have existed for a long time coming back in modern standards. So this is Sebastian, and I'm Richard. We both work at Oxford University. We've been doing vehicle security stuff, among other stuff, for about five years now, really focusing on EVs and charging security, the security when you plug it into charge. And that's all we're going to be talking about today, and then some thoughts about where that field is going. Right, so we've probably all seen something like this, like a charging park, as shown on this slide. Actually, back in December 2022, this was supposed to be the largest charging park in Europe, with, I believe, 56 charging outlets, DC fast charging outlets, but this keeps changing. So every week, we hear about the new largest charging park. But EV charging is not just for cars. We can now see electric trucks, like this one here. Buses, so public transport, is currently electrified. This shows a bus depot in Hamburg, and I don't know if you can see, but there are wires actually hanging down from the ceiling, and these are charging cables. So all these buses you can see here are fully electric. Another example is this, sorry. Another example is this ferry. I'm gonna switch to this, yeah, this ferry. You can see it charges also with, it's electric, and it has 28 charging cables, so they charge simultaneously with 28 charging cables. But there's also now a move in the mining industry, so making mining greener, so electrifying mining equipment, and yeah, why did I tell you all this? Well, all of these examples use actually the same charging standard, which is known as the combined charging system, or short CCS. So I don't know, most of the people are probably familiar with the left one, which is the combined charging system, plug type one, which is used in the US, and on the right is the one that is used in Europe. It's exactly the same technology, underlying technology, it's just a different plug type. So of course there are much more charging standards, as we can see on this overview here, but in this talk we are gonna focus on DC charging using the combined charging system. So why is CCS so interesting for us? Well, CCS is actually using a power line communication, so the car and the charger are communicating during a charging session all the time. So the car is telling the charger, hey, this is how much electricity I need, this is the maximum current, the maximum voltage, this is my state of charge, and the charger actually confirms these messages and also, yeah, exchanges information about the charging session. There is more communication actually going on. For example, with plug and charge, you can actually plug in your car and leave without tapping a card or using an app. It will automatically send your credentials to the charger, and the charging session will be authenticated. So yeah, it's quite a detailed charging standard. There's a range of open standards that underpin it, and this is why it was quite interesting to us. It was also getting deployed very, very widely, even when we first started working on this. And that's a lot of infrastructure that's being built, gonna be expensive, gonna be hard to change, so keen to get in early. And even then, and ever since, we've been finding insecurities in a lot of charging infrastructure, and that made us concerned about the kind of things we were deploying. So particularly for CCS, we were interested in this power line communication because it comes from a system called Home Plug, which was originally these little plug-in adapters you'd use at home for Wi-Fi extension, and there were some issues known about these in the past, and particularly, they were built for a different threat model. In home, shared keys, not a kind of open public access network. Also, they were known decades ago, frankly, to leak their signal radiatively out of cables, and this wasn't necessarily too much of a problem at home, but it's interesting when you see this deployed in a different setting. And of course, it's part of the deploying CCS, and the new world of connected charging was that there are lots more services. There's not just talking car to charger, but also out to behind systems behind the scenes, providing additional services, automated billing, reactive charging, load balancing, all of these things that depend on having a nice secure link. And so it was kind of quite interesting to us. So we'll talk about a couple of bits of work here. We started with just a purely passive threat model. So what is it that someone just eavesdropping might want to do? Well, as ever, lift some fingerprints and have some privately identifiable information, of course, and then also we thought maybe there'd be some opportunity for billing fraud here. So there is a system called Auto Charge, which a couple of networks implement, which just uses identifiers that are pretty much public. If someone could lift these, then they could use them to start to pretend to be people. And threat model is fairly simple. It's a kind of motivated hobbyist, not a lot of information or not a deep technical knowledge to fully build systems from scratch, but someone that can run some code and has access to off the shelf hardware. Not much more than that. So for a particular attack, like one example, we had a look at signal level attenuation characterization, Slack. It's a Slack attack. And this is a system that, in my opinion, probably shouldn't have existed in the first place. This is part of the initialization routine of a charging session, where the car and the charger need to make sure that even though they're connected with a big cable, they're actually talking to the right charger because there's so much potential for crosstalk conducted or radiative that you could just be talking to the charger next door, like two, three meters away. That seems a little bit a bad smell in designing the system. Also, there's a big long protocol here. I mean, you initiate the Slack session, you test the attenuation and all the charges that can here respond, and then you pick the one that has the lowest attenuation. So that's probably the one you're talking to. In step six and seven, you say, oh, okay, I've picked you. You're the charger for me. Can I join? And he goes, yeah, sure. The shared key is this. And that's just in the clear. Unless you've got this security mode turned on, which we've never seen happen, this is just given to the car. And to anyone that can lift that has a key for the network. There's some authentication later, but once you've got the master key, you're in. So can we do this in the world? Well, we set up an experiment. So we got a car, we were in around some charging stations, and then we just set up software-defined radio. We've done this with different equipment set up over time, and just put the antenna at various points in the car, round nearby, a bit of an exploratory thing, to just see what kind of signal we could collect and whether we could use that for something.  Every now and then we pick up an electric car rental and we tested a bit further. But even then, 14 locations, six networks, enough to have a good overview of what was happening in the industry, all in the UK, where we're from. But all kinds of places, service stations, hotels, wherever we could find a CCS charger. And to put it into a bit of perspective, so these are places where we're placing the SDR and the antennas. Some of it was super, super close range. You're inside the car, we're interested in whether the signal is leaking out from the cable, whether it's leaking out from the car, which part of the electronics. Some of it was further away. You'll notice it's even sunny in England sometimes, as this picture shows. Here we've got someone just behind the car, in a bay behind, probably five meters away. And you're not going to suspect someone there for picking up your signal. And the other one on the right, it's about four meters away, next bay. But this is a reasonable short distance. And even some with two vehicles. So this is when we had the I-PACE and the GOLF at the same time. And we just went to, at this point, one of the bigger charging parks we could get to. Of course, now that's changed and you have easily 50. But here two was enough, and just one radio shared between and multiple sessions being picked up. And so the end result was, we picked up a signal basically every OEM. You could certainly see on like a frequency plot. So these plots in the top right, they're all spectrums. You can see this distinctive frequency usage that you get with home plug. So you notice these deep notches, they're in there to not interfere with amateur bands.  The other thing to say is it vastly varied between location, between site, between charger hardware, how much of the signal came through, and how much noise. You've got all of these noise spikes around. You've got a lot of high power electrical devices working there to provide the charging. So you get a lot of noise when the charging starts. But point is we could pick up the signal everywhere we went. And then we built a receiver. So this is open source, this is entirely software receiver. It takes a file in of just the raw signal and it processes it and pulls out the packets it can find. And this is pretty much just doing what a normal mode then would do, but it's open instead of in a proprietary GIC. So it detects the packets, it synchronizes on them, it does all the OFDM, and then at the end, spits out everything it possibly can. So messages, keys, messages that fail to decode, but you might be able to get some data out of all of these, dumps them into a big database. And as I say, it's available. If it's useful to community, please use it, please build on it. So, I mean, this is a big table of numbers, don't really need to read or parse it very much. The important things are probably left-hand column, lots and lots of messages, thousands, big variation, some sites very bad, some sites much better, but lots of messages. Column on the right, these are messages that fully validated their CRCs, and so these are ones that are good. So these are both metrics of how well we were able to pick it up. So for two examples there, next to the cable, beautiful clean signal, very easy, and is nearly 100% of the messages for the valid. And they're all modulated slightly differently depending on which bit of the protocol they're in, so some of them are easy to pick up than others, but overall you can pick up enough to have a whole session. A bit further away, of course, the performance falls down. We're still picking up some, you know, the bay next door or the bay behind, and I think with more equipment optimization, this was just stuff we had in the lab, you could increase this number further. And then from that we had, we ran off the code, it took a long time to perfect, but then out of individual messages, we just dumped out values. And so what we're seeing here are messages we receive from the end of this Slack protocol. So in the, you can see in this sort of key column, which messages is coming out of and which value we're getting. And two are interesting here. One, for this privacy and fingerprints or identifiers issue, there's a vehicle Mac. We ended up getting the same cars multiple times over a period of months, these didn't change. I mean, the Mac addresses, you could rotate them fine, but they weren't being rotated. Some manufacturers and some batches of cars did not have vehicle unique identifiers, and we see this happening in auto charge, actually. Some vehicles are not compatible because some of the Macs are zeroed. The majority that we saw did have complete unique Macs. You can identify that car forever from that and you can pick it up later sessions as normal. Then there's also, of course, the key. This arrives a few seconds into starting a session and you pick it up. I mean, that's the key in plain text there. You also get it in Wireshark. And then from then on, the code automatically starts to decrypt the rest of the session once it's got that key. We're also outwitting traffic to Wireshark. It's a little bit of a messy capture here, but you can kind of see the process evolving. So at the top, there's this request to get the master key. That's the stages six and seven I was talking about before, getting it back and then trying to find the control that's actually going to initiate the charge. Keen observers on the blue lines, it talks support 15, 118. That's the ISO number of the standard. That was a kind of fun little Easter egg. And then it sets up a tunnel and then sets up higher communication where there's a whole stack of things. It's IP communication. Then there's TCP on top. Then maybe there's crypto on top of that. And then there's just sending XML back and forth for state of charge, for charging speed, temperature and all these other things. That's also up where you would have like automated billing and stuff per the standard. All of those would require you to have a TLS session. So I'm not saying that there is traffic for that that we've ever seen unencrypted or accessible from here. You're only getting the lower layers. There's also a lot of support though for external additional services to be built on. This is ultimately an IP link, right? With two Linux boxes either end, you could put any services you want. You can open additional ports, you can have a web interface and so on. And there's some talk about that, although we haven't seen it much in the wild being deployed. But any of that, you're then back into whether the developer secures that as well as they should. For the simplest standard, DIN70121, this is just charging. There's no security on top of that. But there's also only so much you can learn. You can get the identifier out, you can listen to traffic, but there's not too much important stuff going over it. There has been latterly some talk about different approaches to trying to cure this. Some people, one particularly big manufacturer is talking about just establishing a VPN on top, which maybe goes back to your own charging provider. I mean, that or TLS is providing you some crypto either way. I think the big problem is doing the PKI to support this and having the right keys for every charger, for the car, for the driver, for everyone involved. Still ongoing. Right, so as Richard just told us, he basically found that there is a unique high quality unintentional wireless channel when you use PLC charging or when you use CCS and that uses PLC. So the main question we asked ourselves was, can we actually also inject? Because the charging cable is a perfect antenna, right? We can receive, it emits the signal. So can we also inject into the antenna? So we looked at what can someone do, like a threat model about active attack? So how can you actually interact with this communication and what can you do? So since CCS or in general electric vehicles are becoming part of critical infrastructure, so they will be acting as battery buffers for renewable energies. We will have vehicle to grid communication and feed electricity back into the grid. It's kind of important that they are available. So we need this communication, otherwise we will not be able to use these services. So we looked at, can we disrupt an individual vehicle? So this actually is probably the weakest motivation, but we just had it yesterday actually when we drove here from LA. We wanted to charge our car and all of the chargers were occupied. So could you interrupt actually one of the chargers and get the cable? I mean, no one would notice, right? So most of the cars, don't know if you're aware of that, but most of the cars actually unlock the charging cable if the charging has stopped or is interrupted. We assume it's a safety feature, but yeah, most of the cars we tested, actually all of the cars I believe, implemented this feature. So yeah, you could just disrupt a single vehicle, get the charging cable, charge yours and be happy. But of course, there could be another motivation, a financial motivation for example, back in Oxford in the UK, DPD has fully electric fleet now. I believe 40 to 50 vehicles fully electric. So if you can just knock out their entire fleet, so they can't charge, let's say during the night, you could just blackmail them. They will turn up in the morning and the cars are not charged. Another motivation could be unspecific disruption. So you try to disrupt as many cars as possible or as many charging parks as possible, to for example, disrupt supply chain. We saw earlier buses are getting electrified, ferries and trucks. So if you just cause widespread disruption, that's gonna be an issue. Especially if we then go a few years further and look at vehicle to grid communication and bi-directional charging. Oh yeah, I should mention maybe for this threat model or for these goals, we assume exactly the same capabilities. So just access to software defined radio or transmitter off the shelf you can get from Amazon and a little bit of knowledge about digital signal processing. So we found Brokenwire and Brokenwire exploits the CSMA-CA mechanism used by Homeplug Greenfy. So how did we actually find this? Well again, we had this, there is an unintentional wireless channel, can we inject? And then we looked at the standard actually and we found this interesting phrase. And this phrase basically says that the modem should consider someone else communicating if they receive a preamble with 2DB above noise. What this means is basically the receiver or the transmitter would actually stop transmitting when someone else is already transmitting to make sure there's no interference happening. For some of you who might not be familiar with CSMA-CA, here's just a diagram how this usually works. So let's assume you have a car and a charger and they don't have, or wouldn't have CSMA-CA, the car would send a message, charger replies, all are happy. But if they send at the same time, you would have interference. So instead, actually the Home Plug Green Fire Modem checks if the channel is clear to send. And if it is clear to send, it would send the message and so on. And if it is actually not clear to send, and you can see it here, it waits for a random period of time. So it backs off and then tries again and checks is the channel now clear. And if it is, it sends the message. So on the previous slide, I just showed you the standard says someone is communicating or the channel is busy if we see a preamble 2 dB above noise. And so what someone could do, actually if we now have an attacker, someone could just during a communication, which is happening just fine, start sending a signal to make the channel look busy. So in our case actually, that is the preamble. So here you can see Home Plug Green Fire Frame. We collected by just plucking a modem into a software defined radio. So this is in the time domain. And the first bit you can see is the preamble. So that is used to detect if someone is communicating and also do frequency offset correction and timing. And then you have the frame control and yeah, the legacy frame control and the AV frame control. And then you have the payload. And as I said, this was collected while plucking the modem actually into our receiver. And there is also some noise, of course. And you might have already spotted it, but there is also another preamble in there. And this is a preamble which is 2 dB above noise. And this preamble actually already caused the modems to back off because they consider this as, oh, someone is communicating. I need to stop. I need to wait until this communication has ended. So when we found this vulnerability, we initially tested it in our lab. We got these development boards. These boards have exactly the same Qualcomm chip as you can find it in charging stations. It's a QCA 7000. And yeah, as I said, it's exactly the same chip. We connected one to a Raspberry Pi and this was our electric vehicle and then the other one, which was our charging station. So the Raspberry Pi was actually just providing some traffic so we can measure packet loss and the quality, like, examine the quality of the channel basically. Yeah, we connected them with a charging cable and then we had an attacker, which you can see in the lower part. We used just a super simple antenna. It's a very low frequency. So PLC is communicating at around two to 28 megahertz, like in this band. So we set the center frequency to 17 megahertz. So we have a pretty high or large wavelengths.  And I'll have a photo later where you can see it. We connected this to a small amplifier and the LimeSDR. So this setup costs you maybe, I mean, now the LimeSDR actually got quite expensive, but it was maybe $250, $300 before the chip prices, yeah. Right, so we did some experiments in our lab, like in the university. You can see the home plug green fire modems in the back. Our attacker set up in the front and this was roughly, I don't know, maybe eight, nine meters and we successfully disrupted it. So we plotted some graphs. We basically tested for a given distance, how much power do we need to disrupt this charging communication? I mean, just a home plug green fire communication. And as you can see, so it's plotted in DBM and milliwatts on the left DBM. You can see that for a distance of 10 meters, we actually were able to disrupt this communication with less than 10 DBM or 10 milliwatts. So your Wi-Fi router is probably transmitting at around 100 milliwatts. So just to give you an idea, this is like very, very low output power and this was from 10 meters away. So we also wanted to test, can we actually disrupt between floors just for the sake of it? And yeah, we were able to do it. So you can see on the first floor, we put the modems there. We didn't even stretch out the charging cable.  And then we were the floor below and we had the antenna lined up and just transmitted. I can't remember exactly how much power we had for this experiment, but it was on the order of like 70 to 100 milliwatts. So of course we were curious actually, I mean, we only tested it so far in the lab. Can we actually target charging stations out in the wild? Can we test it on real cars? So we got all of our equipment into the boot of a car. Here actually you can see our antenna, which is just a bunch of wires, as I mentioned. Amplifier, LIME-SDR, bench power supply, which we powered with a UPS, but we changed the setup. So now we actually just use a power bank with the step-up converter because we need 12 volts for the amplifier. So you can easily fit this in your backpack, for example. And yeah, we tested different scenarios. So for example, can I just attach the antenna to the side of the car or just in the boot and then drive or pass by a charger? Can we do a scenario where I'm behind some like bushes and then disrupt the charging? This is, so I would say scenario two, three and four are commonly seen at supermarkets, for example. And then we did another one, which was just focusing on distance. So we wanted to see how far can we actually go, given our power budget of one watt, which was limited by government regulations. So we couldn't bring Smith higher than one watt. I also want to say we don't reveal which cars we tested and which chargers, just because we want to stress it's a standards issue. It's not an individual car manufacturer who implemented it wrong. They follow the standard and the standard, like Home Black Green Fire, is just vulnerable. So these were the cars we tested. This overview just shows you, it's not just cheap cars. It goes up to $150,000 cars. So it was actually quite sad.  So it was quite fun driving the shooting break. But yeah, and so yeah, as you can see, all of them are vulnerable. It also doesn't matter what the charging capacity is. So of course, if you charge with the higher capacity, you might have more noise, but didn't really matter, it still worked. So we did the distance experiment. Again, one watt of amplification. So roughly one watt, it was just below. And we were able to disrupt it from around 50 meters. So what can we do to prevent this? So to prevent leaking the signal or actually having the antenna or the charging cable acting as an antenna, of course shielding would be the way to go. But actually shielding doesn't work here very well because the cable is already quite stiff and heavy. Adding shielding might reduce the vulnerability or susceptibility to EMI, but actually in the end, you just increase the power. And since we were talking about super low transmission power here, you can buy a 10 watt, 70 watt or 600 watt amplifier in this band and you would still be good and then yeah, you would need to add more shielding. So it's an arms race. Another idea would be upgrade the firmware of the Qualcomm chip. And if anyone from Qualcomm is here by any chance, I mean, we would be happy to chat about this because it would be quite interesting to know if actually the preamble detection and the 2DB, if this is a threshold which is set in firmware, or if it's a hardware limitation. And then finally, one thing we noticed, once you disrupt the charging session, it stays disrupted. So you would need to walk there, unplug the cable, plug it in again, tap your card or activate via the app or if you have plug and charge, I guess it would do it automatically, but you would need to re-authenticate, which is a pain because if you have a depot, like the DPD fleet I mentioned earlier, you'd need to go there, disrupt it, it takes 20 seconds and then you leave and it will be disrupted for the whole night. It automatically doesn't re-authenticate or re-continue the charging session. So we said redeploying the same vulnerabilities. So why was this the title of our talk? Well, what is next? That's the big question. And currently there is work going on on the MegaWatt charging system, MCS. And interestingly, so it has almost four MegaWatt charging capacity, but interestingly, it also uses power line communication again. It uses differential PLC, which should be, yeah, not as easy to disrupt, but we haven't tested it yet because it's not widely deployed yet. Just for your information, this is like the plug. Compared to CCS, I mean, it looks quite similar, but you now have a communication interface in the middle for a twisted pair. Yeah, so the differential signaling should significantly improve like the EMC compatibility of the PLC communication. But yeah, as I said, we haven't tested this yet. And using a shielded, unshielded twisted pair, UDP wire should also help to increase noise immunity. Roughly 40 dB higher is Jarin saying on their website. So Jarin is the standardization body of CCS and MCS. But I would like to highlight here that even if you shield the cable, you use differential PLC and you use twisted pair, the signal could just couple into some other bits, right? Like onto the PCB directly, so you could modulate your signal into a higher carrier, high frequency carrier. And so it's not, if you just make the wire not attackable, it doesn't mean the system is not attackable. And now there is also the North American charging standard. I guess you all know it, it's the Tesla plug and they say basically that for DC charging, the electric vehicle should or NACS should support power line communication to make it compatible with DIN7121. And it should also support ISO 5118, which means if it needs to support ISO 5118, it needs to support PLC communication. So what is the conclusion? Well, CCS is vulnerable to wireless attacks. We show that we can e-drop on it, but we can also inject. Roughly 20 million vehicles are currently vulnerable because CCS is mainly used or is the DC charging standard in Europe. It's also widely used in the US and in some parts of Asia. And we just think PLC is just not a good technology to use in such a critical communication. So I just have a video for you. Just ignore the Renault Saria on the left. As I said, I didn't want to reveal which car we tested on, but yeah. So the car was charging as you could see. And we put the equipment as you saw in one of the photos in the back of the car. And then as soon as we pass by, you will see that the charging stopped. Yeah, and this is the error where you need to go unplug it, plug it in again so it doesn't go away automatically. Right, that's it. If you have any questions, feel free to reach out to us on brokenwire.fail. We have more information. There is also the paper available and there is also some information on Nest. Yeah, for the CDE we got. But yeah, happy to take any questions. Thank you. Oh yeah, sorry. There is a microphone right here if you have any questions. Hi. Just a question, were you able to also, there was a, you mentioned about the billing. You can, there's a communication between vehicle and the charging station. And there was a billing associated with it. Were you also able to get into the billing? Like able to manipulate the user to charge? Sorry, if I understood you correctly, you're talking, or you're asking about the identifier which is transmitted between the car and the charger. So there are different implementations I would say. There is one which is called auto charge which is basically the MAC address of your EV charging controller. And so if you have the MAC address, yeah, you can, so if I e-stop on your communication and get your MAC address and spoof my MAC address, I could charge and you would be paying for it. Okay, so basically we can sniff MAC address from the car between the charger during the session. And then we can use this to bill for that user that we sniff. Is that correct? Sorry, could you speak up a bit? It's hard to hear. So the car connects to the charging station during the initial session, we sniff the MAC address and then can we replay that to charge the user? Right, if we can replay, sorry, do you want to?  It doesn't, it's not the same for plug and charge and this is the sort of gold standard thing. Auto charge was just a couple of industry players wanting to get in on this kind of frictionless experience early, plug and charge, no, their certificates both sides, there's as far as we know, good crypto, it's not very widely deployed yet, but yeah, that's safe. Thanks a lot. Dumb question, will the slide deck be available on the GitHub site? The, this slide deck? That slide deck. It could be, yes. It's not currently, but it could be. There's certainly slides from other talks we've done on it. This one has a little bit of extra content, but yeah, that paper, codes, you can, yeah. Some appropriate slide deck, I know some folks where the slide deck would be great for explaining. Yeah, of course, yeah, I think you'll find all the resources there, no worries. One question, please. The MAC address that you identified, this is the MAC address of the vehicle of the charging system of the vehicle. There are two, and you get both of them in different messages. Are you sure it's the same one? So there's a modem one, and then there's one for the, where is it, the charge controller, and we've observed different behavior in different vehicles. Some of them have one bit different, some have the same MAC address in both, some have one of them blanks and one of them not, it depends on which one you're going to have. It's totally different DCUs, the MAC address, what you'll be in part of the TCU, and not part of the charging system. I'm sorry, I missed that bit, the MAC address. The MAC address will come from the TCU. From the controller on the EVCC. Yes, not from the charging system. But we have one from the modem and one from that, from the EVCC. So I could show you in some captures, and it does, as I say, vary between, but yeah, they establish a communication between the two high level entities, and then the very early initialization messages are modem to modem, so we have one for those as well. Okay, thanks. Hi, thank you. You were talking about NACS and similar vulnerabilities. Seeing as Naxx is coming up, what Sharon is trying to standardize it now, is this an opportunity to kind of address some of the vulnerabilities with some of your suggestions? Yes, would be our opinion. There's, I mean, some things are very difficult to change, right, you've got a standard that has this communication which possibly not the best choice baked into it, that's probably gonna be difficult to do. Some changes are coming that are really good, like MCS having this differential PLC, or changes you could deploy later, like firmware differences, or additional sort of detection systems for just constant preamble, something. But yeah, I mean, as a general rule, yes, let's try to fix this, and hence why we're sort of doing this talk now. And we'd be happy to engage with anyone that's doing work on any new charging standards. We are. Thank you. Sorry, if you need to, if you wanna need to. Yeah, so the question I have is like, the SDR you guys used to do this attack is kind of unique, because to do this you need something that has at least 28 megahertz of RF bandwidth. I'm sorry, I'm having difficulty hearing you. Probably just close to the mic is fine. Okay, so the SDR you guys used to do this is somewhat unique in the fact, because you need like about 28 megahertz of RF bandwidth in order to do this attack. But so like things like a hack RF won't work because they've only got 20 megahertz. Now the new LIME SDRs don't have this nice wide band that the original one did, and hence that's why the price of these have gone up. But I'm kinda curious, have you guys found anything other than like a high end USRP that will do this? Has it required RF bandwidth? Cause I'd love to hear about that. Yeah, so we played with a couple of different ones. I mean, I think prices went up a little bit across the board, at the time the big LIME SDR was what, a couple of hundred dollars. And that was really good, that was why we had it. And it also worked natively in that band. The previous work, the eavesdropping, I was using a Blade RF, which was reasonably inexpensive at the time, but it didn't tune to that band, so we had an up converter to bring up to there. And basically we've had pretty good success with those. I will, I'm not quite sure exactly what's gonna be the best buy at the moment, but my gut feeling is probably still a LIME SDR. They've got more expensive, but they're still not quite USRP territory. So the current, are you talking about the old version and trying to get it off eBay? Frankly, either, I would probably, a V2 would should work fine. We haven't tested the V2 ourselves, but you know, it- Well the V2 does have the required bandwidth? Yes. And it'll tune down to, you know, tune down to 22 to 30 megahertz. And in fact, I mean, depending on what attack you want to do, whether you're, you know, you could just do up conversion, down conversion and use something else, that might be quite a good route. I mean, if you wanted the recommendation what to buy, we could perhaps have a little offline chat, but most of the things that are above, you know, an RTL or something should work fine. I will also say, you might have some excess, even with the 20 megahertz from a hack RF, for two reasons. One, we did test broken wire with less of the preamble, you know, because some of this will get attenuated anyway, and I can't remember how low we went, but you could cut off a surprising amount and still have the preamble's register as accurate. Although the preambles don't use all the OFDM channels? They do, but even if some of it is horribly attenuated, there's enough signal for it to correlate well and trigger as a preamble. Oh, sweet. In theory, you should be able to do some eavesdropping because Greenfy replicates all across the band. So there's five copies or sort of seven copies, depending on which message you're talking about, for exactly the same problem. You know, it's a very, very hostile network if your hostile transmission environment on these wires, and so it's built to be robust against that and you could lose a whole chunk of the subcarriers and still recover messages. Of course, your mileage may vary, but you might have some excess with the hack RF, if not, yeah, probably swapping for a LimeSDR or the later RF in UpConverter. Very interesting, thank you. I didn't know that about it. I thought it was using all the audience.  Okay. Happy to talk more afterwards, yeah. Okay, okay, cool. Hi, I'm not really knowledgeable about the protocol, but it has Qualcomm implemented something like a spread spectrum or something that can mitigate the radiations. I mean, whenever we do EMC testing, we basically look for, if we have this type of radiations, we reduce the speed, reduce the slew rates or also doing some spread spectrum on the transceivers to mitigate the radiations. Has this been already placed on the table? So, no, it's an RF-EM system and there's certainly per-carrier control to stay under EMC limits. So part of it was, of course, that distinctive spectrum template that I showed, you know, notching out the amateur bands and you could power control there or notch more of them out if you needed to and for EMC purposes, fine. It is just under the threshold for radiation. I think realistically, it's just that if you turn up your LNA enough, you can kind of still pick it up, but it's still compliant. Okay, so. And then there's Plainty on above that in terms of varying modulation to try to get the best rates and so on, but that's less of a compliance thing and more of a throughput issue. Okay, so yeah, so only through differential wires canceling the fields and that will be enough for the mitigation right? Yeah, I mean, so some limitations of this are a wire, at which point it's just going to be leaking out all over the place. The differential down a twisted pair, yeah, that's probably going to be very helpful, but bear in mind, this is a technology that's coming from an in-home environment and genuinely people's power wiring, which is just wires randomly laid over 50 years by different electricians and so on. So it's not, it wasn't really built as a communication protocol for a purpose built environment, but rather making the best use that it could have of the conditions it had. And that's why it's not ideal there. And is the amount of information that you do during the handshake really needs the amount of speed or why not use lean or tech? Yeah, I mean, all the other charging standards do not, I typically use a canvas link and do fine. I think a lot of it was a future-proofing idea and there was some really nice design choices. Have an IP link, you can just do whatever, you can deploy the same technologies you have, there's no reinventing the wheel. Personally, I'm not sure PLC was the best underpinning for that, but no, it's hard to make a case, it was more to just create the capability to deploy whatever we might need in the future rather than because you need that much data. Okay. Well, thanks. Thanks very much. And thanks everyone for coming.


Difficult dialogues don't just happen live. They are built in assignments, such as discussions, written work, reflections, exams, teamwork, student self-made videos, videos selected by the professor, through mindfulness and self-care practices, and so forth. This work can be extended to any discipline. Difficult dialogues need to be part of every conversation. It is part of our daily communication. In all reality, difficult dialogues can happen in any discipline and in any organization. Difficult dialogues need to be part of our everyday communication. Verbal and non-verbal. And most importantly, we must listen to what is not said. One of the things that we need to realize is our students truly have a lot to teach us. And we also need to be willing, willing to go on the journey with our students because long after we're gone, they will still be here. This summarizes, this concludes, the reasons of why difficult dialogues are essential. They're not an add-on, they're integrated, they're essential.


Our company is a leading provider of vacations worldwide and we're using FileMaker really at this point to manage half of our business. We hired a company to help us from Mexico City and Celaya Mexico called Creative Database and basically they helped us kind of get started but I didn't want to lose control over our solution so basically we had them help us understand FileMaker better and then be able to develop on our own as well and one thing that was very important for us as a company was we had dealt with many developers in the past where they kept control and ownership of the code and source and then there was always problems with that. Now we can completely own our solution and over the past six months we've hired five people so we have our whole FileMaker department at our offices where now anything that comes up basically they want to solve with FileMaker.