Inside Hawaii Real Estate, I'm Will Tanaka. And I'm Leonie Lam. And we are honored to be your hosts for today's show Inside Hawaii Real Estate. Will is a full-time Hawaii Real Estate professional and a licensed attorney. And Leonie is a Hawaii Real Estate broker, a 20-year veteran in the industry and a board member of the Honolulu Board of Realtors. And our combined experience has led us to the show. So what time is it? It is showtime, baby. So just in the last few days, there were a couple of real estate topics that came up in the news that we wanted to discuss together and with you. So there's been three hot topics in Hawaii Real Estate right now. Number one, a new condo tower development in Moili-Eli in town. And number two, Oahu short-term rental law. And number three, perspectives on buying in Hawaii. All right, so in the new home development arena, there's a new condo development that's in the works, right? That's right. It's called Kui Lei Place. So over the weekend, news outlets reported out that the very, very well-known and well-respected local Kamayana developer, the Kobayashi Group, is planning to build a brand new residential condo tower complex called Kui Lei Place. And it's gonna have over 1,000 condo units in Moili-Eli. Moili-Eli, where in Moili-Eli? It's actually gonna be on Kapilani Boulevard. It's gonna be on the block that's in between sort of Iolani school and then Kaimiki High School on the other side.  They're proposing a 400-foot tower so much higher than the existing towers that are there now. And they're looking at building 1,005 units to be exact. And 60% of those units are considered or going to be for affordable housing.  So they're not gonna be able to purchase unless they meet those limits. And then they have to live in the unit or owner-occupy it as they call it. The rest of the units, like 40% of it, they're gonna be market-priced and then there's gonna be a mix of one, two, and three-bedroom units, no studios. Oh, no studios, okay, one, two, and three bedrooms. Okay, that's interesting. And there's been a lot of talks about affordable housing in Hawaii. And when we're talking about affordable, what does that really mean? Yeah, so for this particular project, the prices are not final, but what they are saying or the developer is proposing is their prices are for a one-bedroom, you're looking at about 371,800. So about 372,000 for a one-bedroom. And then they said for three bedrooms, you're looking at about 813,000 or so. So these ranges are the so-called affordable and it's gonna be available and affordable to people, probably in the moderate to moderately high-income levels. Okay, so 372 for a one-bedroom, about 800,000 for a three-bedroom. And whether that's considered affordable will really depend upon the buyer situation, right? Because if you look at the median sales price for single-family homes, it's 1.1 million. I remember earlier this year, I sold a one-bedroom condo for about 350,000, but the condo, the building itself was built in the 1960s. And also got a first-time home buyer into a small, tiny two-bedroom apartment for less than 300,000. But if you consider the age of the building, it built in the 1960s, maybe it was fair value. So 370,000 for a one-bedroom in town at Cooley Place, it may be considered affordable for some. Yeah, and you know, so for 372,000-dollar condo, what would the mortgage payments look like for something like that? Okay, so for 372, let's break this down. 20% down, that would be 75,000 for a down payment. The monthly payment would be around 2,200 a month with the current interest rates. But that also means that they need to save up some money. Right, because they're gonna have to save for the down payment. And so they're looking at maybe like a $2,200 a month mortgage payment plus the maintenance fees and utilities. And when you're talking about affordable three-bedroom and the price point is around $800,000, then what would a home buyer be looking at paying? Yeah, then you could expect to double to about 4,500 a month and you'll also have to add a monthly maintenance fee so they could kind of take it over the 5,000 a month threshold, right, and other expenses. Got it, got it. So then why would, I mean, why wouldn't someone just continue to rent versus buying, right? Would that be cheaper for them? You know, that's always the question, especially for first-time home buyers or people, you know, maybe living with their parents or just move back. I mean, it really depends on everyone's personal situation. I mean, take my own parents, for example. You know, after they sold their condo in Japan, when I was six to bring our family to the US, they never rented a home again. So they've always rented for the last 40 years.  You know, we didn't have HOAs and if something went wrong, I remember the landlord coming to our house and, you know, fixing stuff at our house. Got it, got it. So I guess in the long term, there's just something about home ownership, right? I mean, there's both tangible and intangibles. There's the building equity in the home, which essentially for most people, it builds their wealth, right? I mean, that's kind of the basis for building their wealth. I think that there's tax deductions. You could rent out part of the property, which is what I did with my home years ago when I first purchased. We rented out a portion to help offset our mortgage. And so I guess there's just overall sense of pride, home ownership, a sense of stability, possibly creating a legacy for future generations, right? And so I guess, you know, that's part of the benefits. No, absolutely, yeah.   We might help them, you know, depending on our situation. But anyways, you know, great points on home ownership. And you know, we talked about affordable units for clearly placed for people also with moderate incomes. So I mean, I'm kind of curious, what are the price ranges for market prices? And when I say market price, I mean, you know, we're talking about condos that it's unrestricted, investors, second-home owners could purchase. What are the prices for those? So you're asking about the prices for the ones that are not deemed affordable, the other 40% of this particular project, right? That's right. Yeah, expected. Prices are not set yet, but what they threw out was 401 bedroom, it could be about 705,000. And then, you know, for the three bedrooms, it's gonna be over a million. Over a million, okay, wow, okay. Well, I believe that the state board just endorsed clearly placed to move forward. Yeah, that's right. I think it's gonna be, it's still gonna be a long process, it looks like. They're gonna need to get building permits. They're gonna need to be approved by the city council and ensure a myriad of other items before this project really gets going, but it's looking good. And basically, I think it's gonna be a very good project for this area. This area hasn't seen any new development in quite a long time. I think it's gonna be like a revitalization in some aspects, hopefully it'll become a more walkable community and somewhere that will be desirable to be right in town. So I think that's gonna be a huge benefit. And part of it's gonna be affordable and part of it's gonna be market. And I know that more information will be coming out soon. And if all goes as planned, according to the developer, hopefully, we'll see sales begin even as early as later this year or probably early in 2023. That's coming up? Yeah, it's coming up. So we'll stay tuned for more information. I just wanted to, we just wanted to stay updated on that. So another really hot topic that we wanted to kind of cover that's been on the news like just this past weekend is the Honolulu short-term rental law. What's the latest going on with that? Okay, well, let's first talk about what is a short-term rental? So a short-term rental is when you rent a property for one night up to 30 days. So they're also known as vacation rentals. I consider it as an alternative to a hotel. So renting out a property for 29 days or less is considered short-term. Are you talking about like Airbnb's or like VRBO's? Exactly, Airbnb's, VRBO's and also some short-term rental units could operate like a hotel. For example, you know, the Ritz-Carlton Waikiki part of it is actually owned by the Ritz, the hotel itself. But part of it, another tower, it's owned by actual investors and some homeowners, but it's a specific condo unit that they own and they use an outside property manager or have it managed by the hotel operation. So the property is a legal short-term rental property like the Ritz, for example, then you're allowed to rent it for a few days or even a few weeks. Okay, so you're saying for 29 days or less, that is considered short-term. That's right. Okay, and then rentals 30 days or longer, that's considered long-term. That's right, exactly. Yeah, like a six-month rental, a one-year lease, long-term rentals. And the hot button issue that occurred earlier this year was that the city and county of Honolulu are mayor, which covers the entire island of Oahu passing ordinance called the Bill 41, which increased the minimum short-term rental period from 30 days to 90 days. So in other words, anything less than 90 days is considered short-term and is illegal. Okay, so that was instead of the 30 days or it's gonna be extended to 90 days. To 90 days, right. Okay, so yeah, I would say probably over the last five to six years, the city and county has really been cracking down on illegal Airbnb and other short-term rentals, right, with fines and stuff like that. Oh yeah, right. And I believe the homeowners and the community in Kailua really took the lead probably about seven or eight years ago when Airbnb started popping up on Oahu and there was an abundance of Airbnb's. And whether it's like they operate like a hotel where people could just Airbnb it for a few days or bed and breakfast, they were very prevalent and the community got together and really started to take notice and call for action from the city. Got it. So I notice now when you go into an Airbnb or a VRBO website and you do an online search for Hawaii or Honolulu specifically or Oahu rather, you'll see that probably 90%, would you say are concentrated in Waikiki? Like that's where you're gonna find them at this point. Yeah, the overwhelming majority. I mean, 90%, I think that's pretty accurate. So you could just go on the VRBO or Airbnb. And if it's outside of the Waikiki area, then it's a short-term rental ad. It's gonna say minimum 30 days. Got it. And so, outside of Waikiki where it's resort zone, which essentially means hotel zone basically, right? Can you do Airbnb or do they have Airbnb outside of Waikiki? Yeah, so it's a very limited circumstance. So you're gonna be either in a resort zone or nearby where that's particular building is as an exception. And then the other exception is back in, way back in the 90s when they started limiting short-term rentals to less than 30 days. There were homeowners who were doing Airbnb's 30 years before Airbnb's existed. And they had an opportunity to be grandfathered in. So they applied for what's called a non-conforming use certificate, NUCs. And so homes with those NUCs could still Airbnb it and do short-term rentals. On Oahu there's less than probably 800 homes and condos in the entire island. So it's very few. Yeah, very limited. So you were mentioning earlier about bill 41, the short-term and that how it was gonna go from 30 to 90. And so that was moving forward with that. But then just over the weekend, it was announced that this law, the 90 days, it was gonna go into effect like on Sunday this week, but then a judge put a stop to it and so it's still back to 30 days again. Okay, that's right. So the mayor passed the 90 day short-term rental law back in April of this year. It was supposed to start this Sunday, October 23rd, but a federal judge recently granted a preliminary injunction or in the city and county of Honolulu to not increase the short-term rental period from 30 to 90 days. Okay, so right now then we're back at 30. Exactly, back at 90, I'm sorry, back at 30, yes. We're back at 30. Back at 30. Back at 30. And can you explain to me, the layman, like what is a preliminary injunction? Okay, so preliminary injunction is a fancy word for a temporary order. So it's not a final decision by the court, it's just preliminary, it's just temporary. So when the complaint, the lawsuit was brought up back in this past summer, with the information that the judge had to this point, he decided that there's some constitutional legal issues that could harm the homeowners who would no longer be able to rent it out between 30 to 89 days. So as of right now, the short-term rental period is still anything less than 30 days, and we'll just have to kind of wait and see what happens next. Do you think there's gonna be more to come or do you think that it's gonna remain at 30, like what do you think? Ooh, so okay, so with this issue, so the people who actually follow the lawsuit, these are very limited. So it's not completely, it's not like everyone's suing the city and county, it's these specific people who are renting it for a minimum 30 days at a time. So they want what happened back in the 80s where they just want a special exception to continue to do that. And then for anyone new, then the 90 day rental, short-term rental law would apply. So it's a very specific group of people who actually follow that lawsuit. I get it, I get it. So what does it mean for us? Like why is it such a hot topic? Do you think?  I know traveling nurses need a place to stay for shorter periods of time. And oftentimes it could be a couple of months, three months and it would be oftentimes less than 30 days. And I heard of someone else, a new grandparents, right? Who's here to take care of their new grandchild, the place, you know, their kid's place is too small. So they need to stay for a couple of months. But again, hotels are too expensive. So I think there is a need for these short-term rentals that are shorter than 90 days, but longer than the 30 days. I get it. That's an interesting perspective. And you know, I guess it was because some of the homeowners were investors of these short-term rentals that they were running. I guess they were operating it in not a legal way or maybe they were abusing the system and running illegal Airbnb type of operations, right? And then I guess maybe with Hawaii not having enough homes, having housing shortage and all that, the investors were profiting and they weren't really helping with the housing shortage situation because it was attractive for them to invest in these properties where they were able to do these Airbnb's and everything, especially in residential areas, right? Exactly.   Then might as well just stay in Waikiki, for example.  But again, you know, you also wanna, there's some level of protectionism for the prices for the local families. So there's always gonna be a balancing factor and hopefully, you know, we'll reach a resolution and probably sometime next year on that. Yeah. Well, I call you highlighted the two sides to it, right? Because there's the short-term housing need for, you know, actual people that need to have like the shorter than 30 days. And so I understand that side of it and then I also understand the other side of it. So it makes sense. Yeah. So let's segue on to the third topic that we wanted to talk about, which was purchasing real estate in Hawaii, right? If I wanted to purchase a home or investment in Hawaii, what is the home buying process like? Well, that's a loaded question, Leone. I mean, we've both personally been through the home buying process throughout the years.  And, you know, that's one thing to get to know is that Hawaii is a very buyer-friendly state. What do you mean by buyer-friendly? What does that mean? Buyer-friendly, okay. So typically when you enter into a contract, you're locked in, right?  And when you enter, so when you enter into a Hawaii real estate contract, the buyer puts in their earnest money deposit, but as the buyer, you should know that you're not as locked in. So maybe when I say buyer-friendly, maybe it's more like consumer protection. Maybe that's a better word, consumer protection. Well, right, because you're saying the buyer has rights and the opportunity to really understand everything about what they're purchasing being their home. And then they can get all of that before they even complete the purchase, even though they're purchasing under a contract. Is that what you're saying? Yeah, that's right. So it's like buying an Apple phone, right? I think you still have like a 14-day warranty or money back and you could still get a refund and, you know, make sure that it's the right phone for you.  So you wanna make sure that before you get really locked in, that you do your due diligence. And as long as you cancel within the contract deadline, so the buyer can cancel the contract and get your deposit back. So for someone that wants to purchase real estate in Hawaii, I mean, besides the purchase price, which is gonna be stated and negotiated and all of that, what would the buyer's typical costs look like? I mean, how long does the entire process take? Okay, so let's just, for ease of reference, a million dollar property, you know, you're buying a property for a million dollars. So buyer's costs will be typically 1% to 2%. So that includes the lender's fees, appraisal fees, the inspections, escrow and title fees. And, you know, some people ask, well, how about the realtor's commission? So in Hawaii, and just generally the seller pays, both the seller's commission, seller's agent's commission and the buyer's realtor's commission. So the buyer's not responsible for paying the realtor's commissions.  I mean, that's, you know, that's an exciting time if when an offer gets accepted. Yeah, so that's when the buyers do diligence and inspection period begins. That's right. Okay, and so escrow is open, the buyer puts in their initial earnest money deposit because they're saying, hey, I'm going to buy this house. So they put down a deposit. And then one of the first things that the buyer would want to do is to get a general home inspection. There's also many other inspections that we would recommend, depending on the age and the price point and the type of home it is condo versus single family home, right? Absolutely. So general home inspection, it's even a contract that's highly or strongly recommended that all buyers get a general home inspector. And on top of that, I mean, depends on what the home inspection report says, but there's also sewer scoping that's when you get like a plumbing company to get a little camera and then scope the entire length from the house all the way to the public sewer line. And even with older homes, you just want to make sure that there's no break, there's no damages, because some of these homes, they were built in the 50s and 60s and maybe these pipes were not made to last that long. We also have roof inspectors, solar PV panel inspectors, AC electrical structural engineers for ocean properties, there's soils engineers, pool inspections. I mean, it's kind of unlimited. Well, I shouldn't say unlimited, but there's a lot. So that's a lot of inspections, right? And so the cost of these due diligence, sort of inspections, the buyer would be responsible for paying for all of these, right? That's right. And also if I was a buyer and I wanted all of it because I want to make sure that this house is gonna last or everything is good with it, how long would all of that take? Oh, great question. Okay, so generally the inspection period, and we call it the J1 inspection period, is between about 10 to 15 days, more common 10 to 12 days. So this means that the buyer for any reason could cancel the contract during this 10 to 15 day period and get their money back. And once you get the inspection report, you could try to get more inspection like a sewer scope, for example. And the realtor, the buyer's realtor will go over three options with you. So number one, you could request for repairs and credits from the seller. Number two, you could accept the property as is. So it's damaged, there are some repairs, the roof is old, but you could accept it as is. Or number three, you could cancel the escrow and get your money back. And yeah. Yeah, so in addition to the inspections and like being able to cancel during that period, there are two other ways to cancel the contract. Is it the review of title report? And then also the review of sellers will appropriate disclosure statement. Oh yeah, those are two important stuff. So those are three ways to inspection, review of title report. So there's disclosure statement. And generally, those usually about seven to 10 days, that's the contingency deadline from the receipt of those documents. So you wanna make sure that the escrow company is that the parties that we too are on top of it and delivers a title report to you as soon as it's ready. And sellers disclosure, it's a really important document that must be thoroughly reviewed. And usually you have about seven to 10 days after you receive it. And you could always ask the seller more specific questions. He just says, hey, water leak and then fixed. What's that really mean? Oh, okay, there was a leak during the 49th of rain and they fixed it by putting a French drain. Okay, now the buyers were more comfortable with proceeding. So yeah, there's a lot that goes into just the beginning portion of buying a home in Hawaii. Yeah, so what is the timeframe look like? So I mean, we kind of talked about like if you wanna purchase a property and then all these, you know, obvious the due diligence or all these inspections that you wanna have done on the property so you can make sure about what you're buying but what does the timeframe look like? So the timeframe is usually from beginning to end once escrow opens, typically 45 days. About 45 days from beginning to end. And that's 45 days if you're financing, right? If you're financing, if it's cash, 30 days typical, I've seen people close it as soon as a couple of weeks up to 30 days. So it does depend on that on the situation. I understand, wow, that's a lot to cover. That was a lot of hot topics today. So thank you so much everyone for tuning in to Inside Hawaii Real Estate and we will see you next time. Thank you so much for watching Think Tech Hawaii. If you like what we do, please like us and click the subscribe button on YouTube and the follow button on Vimeo. You can also follow us on Facebook, Instagram, Twitter and LinkedIn and donate to us at thinktechhawaii.com. Mahalo.


Serge, will the Bitcoin hype fade this year, do you think? I don't think the publicity will fade. I think, I'm glad it's found a level where it stopped going up, but it goes parabolic every three or four years, if you look back, so maybe that was this year's run. Maybe in three or four years we have another run. You've never been like this year, in any case. There is a finite supply. So if it does become a store of value, which it's working on, and if it ever becomes a medium of exchange, which is probably not going to happen, but maybe the guys who love it say so, then it's actually going to be worth something. To me, I'm not going to buy any for quite some time. If I saw a dip, now it's silly to say it because if I saw a dip I'd get out of the way. So no, I'm not going to buy any Bitcoin. Would you buy the futures? I will play the futures. I probably, if the futures get to a point where margin isn't so crazy, I'll probably get involved but small. It'll never be more than a percent and a half of my portfolio. Danielle, obviously there's this whole question about when a central bank will come out with their own cryptocurrency or back one. How is the Fed viewing Bitcoin? So I think that they're definitely looking for flaws in Bitcoin. They're studying the infrastructure very closely. The Bank of England came out just a few days ago and said that they're looking into creating their own cryptocurrency. So I found that to be fascinating because that's the first out of the gate of any of the central banks. There is an inevitability of Fed coin happening, of the Federal Reserve having an electronic currency. But the question is how that happens. If you talk to the Uberdubs, they want for it to not be anonymous. But Jay Powell and Randy Quarles are both on the record saying if there's going to be Fed coin it is going to be equally anonymous to the exchange of bills. So why do we need a Fed coin just because of all the interest in Bitcoin? No, at some point it becomes a matter of national security because we know that Russia, China and Venezuela were the very first three countries out of the gate because they do want to monitor what their citizens are purchasing. If everybody else on the planet has one and we don't, it's just no bueno. And Gabriella, what are you telling clients about Bitcoin? I mean, honestly, I don't think the interest in cryptocurrencies is going to go away. We hear a lot about it and we get a lot of questions from clients. My grandpa was just asking me about Bitcoin over New Year's down in Brazil. So I don't think us trying to understand it is going to go away. But what we're trying to tell clients is focus much more on the asset classes that we can really understand and assign an intrinsic value to. Things like stocks, things like bonds, things like other kinds of commodities. If you want to call Bitcoin a commodity, we're not trying to become active investors in Bitcoin at this point. Jeff, I think you'd agree with that, right? Because it's not like stocks where you have a conference call, you have an earnings report to parse. If I can't find a reason to buy it on any given day and I can't find a reason to sell it on any given day, I'm just not going to trade it.


Wow, those lights are bright. Hi, my name is Ron Minnick. I work at Google. And my talk today is about replacing your exploit-ridden firmware with a Linux kernel. Now, for the past 10 years when I've talked about firmware, people have gotten used to assuming that I'm wearing my Corbut hat, which is a Corbut hat. It's a very nice hat. I am not wearing my Corbut hat today. This is very much not a Corbut talk. We have a couple of partners I need to mention. Tour in the audience here today, Sean Marie Verdonen. And I'm going to slaughter the names with my terrible accent and Guillaume. And we have several people who've worked on this at Google and then Tramel Hudson from Two Sigma, who's been very important. And Andrei Merchowsky at Cisco, who helped a lot with the Go part, I'll describe in a bit. Going to start with the results. We had a Facebook compute node, which I'm calling the OCP node, up in our booth. And we got the booth time from eight minutes to 20 seconds. And to be honest, to my way of thinking, that's maybe the single least important part about this work. And you'll see why I'm saying that in a minute. All the user land is written in Go. So we have a kernel and an init ramFS in Flash. And the user land for that init ramFS is all Go, including init. This brings Linux performance reliability. And I forgot to say security to firmware. And a key point of this, and you'll see what I mean by this in a minute, is we eliminate all of the UEFI and ME post-boot activity. Here's the problem. When we began Linux, we all joined it in the 90s. It controlled everything about the x86 platform. It was classic Intel 586 processor. But where we are today, between Linux and the hardware, there are at least two and a half kernels. And they are complete proprietary and, not surprisingly, based on that, they're exploit friendly. It's pretty easy to write exploits for these other operating systems. These run at a higher privilege level than Linux. They can control and manipulate Linux. And those exploits can persist. So unlike the kind of exploits where you write something to the disk, and we can always get out from under that by formatting the disk, again, these exploits can be placed in the operating, the motherboard flash. And you're never going to get them out. So once they're in there, maybe one of your options is you shred your motherboard, because there's just no other way out of the problem. I used to give this talk. And the title was, if you trust your computer, you're crazy. Fortunately, hopefully, I'm going to talk about ways to deal with some of these problems.  So here are the operating systems. And there is the one you're used to, which is ring zero Linux. And then there's ring minus one. We call that ring minus one. It's never really been ring minus one. But basically, we kind of ran out of ring numbers. So fine. It's ring minus one. And so we've come to call the other two, ring minus two and ring minus three. The ring minus two, kernel and half kernel, control everything about the CPU. I call system manage mode a half kernel because it traps the 80, 86, 16 bit mode. Every time you close your lid or do certain other things on your Mac or on your laptop, it's probably trapping to 80, 86 classic 16 bit mode. That should make you happy, right? No protections at all in that mode. And then there's the UEFI kernel running in 64 bit page mode. And sometimes things trapped SMM and pop out in UEFI. So Linux isn't even running at that point. And then there's ring minus three. And this is the one that has people really worried. This is, there are three 80, 86 CPUs on your die usually. One's called the management engine and that's the one of concern. The other one is called the integrated sensor hub. We're not gonna worry about that today. And I don't know why I really love the name of the other one. It's the innovation engine. I just, every time I say that, I kind of have to laugh a little. The ME though runs Minix three. And that's why this is the year of Minix on the desktop because if you add up all the nodes running Windows and all the nodes running Linux, that's less than all the nodes running Minix three, which I guess Andy Tannenbaum would like to know. What's in ring minus two and ring minus three IP stacks? And there's no common code between these as far as I can tell. File systems, drivers, disnet, USB and mouse. Why do you have to have file systems in the ME cause it can reimage your node? Web servers, there's a web server in the ring minus three 80, 86 running Minix. That was the result, you know, that was the thing you might have read about a recent exploit with a zero length password giving you full admin access to your machine. And again, these things can reimage your work station if it's turned off. If it's plugged into the wall and turned off and on a net, it'll get re-imaged maybe without you knowing it. Here are some of the components of the management engine. I can't claim I know what all these do. I can't claim to understand why there's full network manageability, regular network manageability and manageability. I don't know why, you know, small business technology is in there. What small business technology meant originally about 10 years ago is it's really inconvenient to set up passwords so we just don't have a password for the ME. There's a thing in there called the Outbreak Containment Heuristic. I don't know if that comes from the movie. And then the Protected Audio Video Path, which at least some people claim to me means DRM for audio and video. Here is a, and these slides are open and I'll mail them to you if you don't catch them. So don't worry about copying this, but Facilius Riveraus about 10 years ago did a fantastic master's thesis on ME flaws. And it was kind of depressing because basically everything could get attacked. And not all those have gotten fixed. So just for fun, you can Google Intel ME exploit. 50 million hits, I kind of enjoyed that. And the wired headline was pretty funny. Intel fixes a critical bug that lingered for seven dang years. You know, and if you do the math that's kind of like kind of a billion machines. And you know, the fix is just reflash your firmware. Now how many people want to believe that a billion machines have been repatched since last spring with new firmware to fix this bug? I certainly don't believe it. I think I'm sure that bug is still out there and the web servers are still out there and you can still send a lot of them zero length password and have admin access. The ring minus two half OS was originally used for power management. It came in with the 486. Here's the problem. I have a laptop based on a 486 running DOS and I closed the lid and I wanted to sleep. DOS isn't gonna do that. And so what they did is add a very high privilege mode higher privilege than ring zero that sort of can take over the machine when certain events happen. They're called system management interrupts and that stuff can take certain actions. And you know, can't really go into all the details. It's a pretty long story but all kinds of interrupts can go there. So back in the day, you had a kernel that didn't support USB and you plugged the USB mouse in it and it worked. It's because of a full USB stack that exists in system management mode.  And that's why sometimes maybe you'd plug a mouse in and it wouldn't work because USB stack didn't support that particular mouse. Are there SMI exploits? Yeah, there are a lot of SMI exploits. And the big problem with SMM is the way in which it works is once enabled, you can't turn it off. As part of enabling it, you set a bit that essentially takes a big chunk of RAM and makes it invisible to every other operating mode. So it kind of, it's a cloaking device, right? It just vanishes. This memory with its stuff in it. So you kind of can't really know what it's gonna do. You can't disable it. You can't turn it off and it's hidden. So it's a good way to maintain vendor control over you. And finally there's ring minus two, which is UEFI. That runs on the main CPU along with SMM. This is an extremely complex kernel. And I think one source of the exploits is that a lot of people that say vendors are writing against this kernel and don't really know other rules and they make mistakes. And the result is that there are big giant holes that people can drive exploits through. For the most part, UEFI, from what I can tell the security model is obscurity. How many people here have written code for UEFI? I'm just curious. Oh, that is a lot. Okay, did you like it? Okay, so I never liked it personally, but I'm just curious. Are there UEFI exploits? Oh my gosh, there are UEFI exploits. And kind of the weird thing about UEFI, the model has always been that it's so darn smart that a kernel can sort of drop random bits of UEFI update into memory and then pull this chain and UEFI will update itself perfectly. There are no bugs in this process. And of course there are bugs because we all write code with bugs. And the worry for me has always been that we get an exploited UEFI written and then we go and say, hey, I don't like your UEFI update yourself, but it's an exploited UEFI. And it says, sure, I updated myself, but it doesn't. So the worry has been that you can make an exploit that can't ever be removed. And again, the only remediation is a shredder. Here are some of the UEFI components. This is on the OCP node, which is a pretty limited node. I am told that there can be hundreds of these. And just look at some of this stuff. There is USB stack. There's an IPv6 and IPv4 protocol stuff. Has anybody here got a machine with an ISA bus? Just curious. There's ISA bus support in case you find something from long ago. There's just a lot of stuff in there, IDE. And all this stuff is polling IO driven. It's got lots of delays build-in. Okay, it's very, very primitive drivers. And that's one reason it's so slow to boot. So we've got these two and a half hidden OSs. They have a lot of capabilities. They have network stacks and web servers. They implement self-modifying code that can persist across power cycles and reinstalls. They hide, have bugs, they can control Linux. And my reaction and exploits, of course, have happened. And so this is where my old talk used to end, right? Are you scared yet? If you're not scared yet, maybe I didn't explain it very well because I sure am scared. I think this is a bad situation. So how do we fix this mess? Now, I've actually, or everyone's smile, someone comes to me and says AMD. This isn't a problem on AMD. That's completely wrong. It did not used to be wrong. It is wrong now. You really can't just move AMD and have everything work. People say to me, but Ryzen is totally open. That's only partially true. Some of the weirder bits of VFI on the AMD processors are moved to something called the platform security process or the PSP kind of brings up DRAM, not the main processor. And the PSP code to bring up DRAM will never be released. So kind of AMD is more open in the things that are open, but it's not open in a sense of things closed on Intel are still things closed on AMD, if that makes any sense. So we're focusing on Intel X86. And partly that's just my bias. That's the processors I use. And the goal here is to reduce the scope of the two and a half OSes, and I will say that a lot of what we're doing here will apply to AMD processors, just not the management engine parts. This project is called NERF. UEFI stands for Unified Extensible Firmware Interface. We consider extensibility harmful. So NERF stands for Non-Extensible Reduced Firmware. Whoops, wrong way. The goal is you make firmware less capable of doing harm. You make the things that does do very visible. We get rid of all those runtime components in the management engine and UEFI.  Your node won't turn on in many cases, but we did take away its web server and IP stack. Good thing to do in my opinion. And we also removed the UEFI IP stack and other drivers it might have. And finally, we removed our ability to reflash themselves. We don't want them doing that, so they don't. Linux should manage this stuff, right? There are probably 30 million plus Chromebooks out there, and when your Chromebook gets a new BIOS image, Linux reflashes that image. That works. I haven't heard of any problems like we had with EFI where someone tried to boot Linux on EFI and brick the machine. That used to happen a lot. It doesn't happen with Chromebooks.  We disable system management node or we vector it to Linux, a Linux kernel, and then a user land written in Go. And for anybody here doing Go, we really welcome anyone who wants to join just the Go part of this project and nothing else. So being part of and contributing to this project doesn't mean you have to be a kernel person or a firmware person. There's a significant user land activity, too. So we don't want the ME at all. You can't get rid of the ME. It's on the die. The ME is the first thing that turns on when you turn on the chip. The ME starts all the clocks up. On the later processors, there's a reset vector. The main CPU fetches it. The ME feeds that vector to the CPU in a lot of cases. The ME is not going to go away. It's there for good. If you remove the ME firmware, your node may never work again. It may not turn on. In a lot of cases, it'll turn on and turn itself off in 30 minutes. And the idea there is the ME says, something's wrong with firmware. I'll give you 30 minutes to fix it. And then I'll turn off.  But two and a half years or so ago, Tram Hudson started looking at the ME firmware. And he learned a lot about it. And since that point, there have been other people breaking this stuff open. And boy, we've learned a lot. But the big thing is, Nicholas Korna wrote a thing called the ME Cleaner in Python. And on a neat little system like the MinoMax, this $159, I really love MinoMax's board. It has an 8 meg flash. Believe it or not, 5 meg of that flash is just for the ME. If you run the ME Cleaner on that thing, 300K of it is left. So out of that 5 meg, you really only need 300K to boot Linux on that platform. And again, it removes the web server and the IP stack. And all those things you really don't want it doing. I should mention that server platform is not completely solved. If I run a ME Cleaner on the OCP node, OCP node won't turn on. Don't know why yet, but that's something we're going to plan to work on in November. Here's what the components of that ME image look like on the MinoMax. You can see BUP, bootup, kernel. I assume that's Minux 3. There's some interesting names in here. Policy, RSA, FPM, just random stuff that kind of make you worry a little. Because one of the things that people have found is there's a fair amount of zero days in anything related to networking in the ME, as well as in anything related to RSA. On the OCP, this is what it looks like. Again, see the funniness there? There's BUP and BUP. So it's kind of like a BUP that kind of is there for a lot of stuff, and then sort of, I guess, a sub-BUP that also has to run. And the ME Cleaner seems to remove everything after the first BUP, and that's why it won't turn on. So that's the ME. And we've made that work on the MinoMax and a number of other boards, so let's move on to SMM. If you get into the game early enough, and we think our Linux kernel is getting in early enough, we can completely disable SMM. Now, back in the day when we had Linux BIOS, which is the 1999 to 2007 or so name for Coreboot, we ran thousands of compute nodes at Los Alamos with no SMM. And we had a nice conversation once with an x86 vendor who claimed that it was impossible to run a server node with SMM turned off. And we said, well, you'll have to talk to Linux networks about their 100,000 servers they've sold with SMM turned off and explain to them that it can't work, but it's working fine for us too. So as far as I know, there's no requirement in most cases to run system manage mode. It is there. Vendors use it to do value add, which means stuff that locks you into that particular vendor. I don't think we need it. But let's pretend we have a node for whatever reason that it turns out we have to have it. I've worked on, I've developed some stuff that allows you to vector an SM interrupt into the Linux kernel. So this is kind of nice, because the SM interrupt now becomes like any other sort of interrupt. And we can manage it in Linux, not in hidden code, off somewhere in the chipset. So we kind of have two approaches. Kill SMM or vector it to Linux, but keep Linux in control is the theme here. Onto UEFI. UEFI is huge. It's extremely complex. We find a lot of errors in programming of it, just for that reason. There are some things that still seem to need to go there on some platforms. So single error correction, double error detection interrupts seem to want to go to UEFI. Maybe that's not as true as it used to be, but it's possible. But we really want to remove all the opportunities to put exploits into UEFI, and that remains removing most of UEFI. So it was the unified extensible firmware interface. We make it non-extensible. Here again are some of the UEFI components. By the way, that digital thermometer sensor, that's not a typo. That's right out of the thing. I don't know what a thermometer is. Maybe someone here knows, but I haven't quite worked it out. Here are some of the UEFI components. And this is an iChart, and you won't be tested on this, and you probably don't even want to know. But there's a lot of stuff here, right? And if it looks like a kernel, well, it is a kernel. It's a big kernel. It's actually a sizable fraction of the size of Linux. So here's what we do. Here's the standard UEFI boot steps. Over here is the security phase. In security, you kind of start up in 16-bit mode and do some other things and verify the processor and chip set in it and board in it bits. And this is where lots of stuff happens that you are never going to find out about. That's just highly proprietary stuff. The vendors hold this very tight. They don't even distribute information about what this means widely in the vendor. But here's the neat part. They've done a good job with that interface. This is a very well-defined interface. Documented, all the code follows the rules. And this is the so-called driver execution environment. This thing conforms to that interface. All these DXEs conform to it. And this thing called the boot manager conforms to it. And the boot manager is just another kind of DXE, the big difference being that, notice, these all have an arrow coming back and that one doesn't. So it runs a bunch of these, then it pops into this, doesn't expect it to return, and this guy loads your OS. This red box here, you could think of as grub. Here's the thing that should worry you a little. Final OS environment, runtime, what is that? Well, that's an EFI OS present app. Again, when Linux is running, EFI is running. And that's the thing we don't like. That's the thing we're trying to get rid of. So again, I mentioned that that boot manager conforms to this well-defined interface. So what we do, we build a Linux kernel that conforms to that well-defined interface, and we replace the BIOS with that. I guess everybody here has booted a PC and seen that big screen that says what do you want to boot from and what time it is and all that stuff. That becomes this Linux kernel. So you pop into the Linux kernel and away you go. And on the node upstairs, it's about 20 seconds. We timed it again yesterday, not eight minutes, 20 seconds. And again, on the node upstairs, what we have is this Go-based user land, and the default action of that is to run a DH client, a Wget to get the kernel, and then a Kexec, all that stuff's written in Go. And that's about a three-second process, over 100 megabits to a Raspberry Pi. Now, Tram's been leaning on me really hard. And so as a result, this is actually a different talk than it was a week ago. Tram keeps saying, hey, this actually exists in an open-source form. You should replace that. And so we've decided that's what we're going to do. And so this is an open-source thing that is slightly modified so that it really knows how to boot that even faster. And we think we're going to be able to shave that 20 seconds down to a lot less time, which I think is all to the good. So that's where we're headed. So again, we can't fix this stuff. This is what we did in the old days with Linux, BIOS, and then Coreboot. We rewrote this. Even on Chromebooks that run Coreboot, that nowadays is a binary blob. And we're not going to get that stuff again. I really don't see how it's going to happen. So the only real option is to put ourselves, so I'm not doing so over this point, or put ourselves right there at the line that runs through that green Dexie core oval. So as I said, we can fix this problem partially, but partial is better than nothing. And we can get rid of all the runtime components that come with EFI. And that's really the goal. So how do you rebuild bits of EFI? And again, these slides are going to be distributed. You don't have to type real fast to try and copy them. Tram's done some real nice work with building a kind of set of make files and things to automate his head's thing. And part of his head's thing is part of what we're doing with Nerf. So we're going to be building what he does to allow you to really kind of automate building a Nerf image for your motherboard. We've had some good results on a Dell R630, as well as the MinoMax, as well as the OCP nodes. So anyway, that's kind of where we are with this. So using Linux makes firmware a lot easier. If you're ever done firmware, you know that with every little board, there are all these tweaks you have to do. I mean, the simplest one is there might be on an AMD, a GPIO. And that single GPIO on an IO bridge is used to turn on memory, let's just say. I've had cases where I have five different boards from the same vendor and every time they use a different GPIO. So even trivial, trivial changes make your life really difficult. But what is another nice thing about that defined interface we have is on the right side of the interface when we start Linux, that's a pretty standard x86 platform, and it's functional. So we thought for a long time we were going to have to finally tune the kernel for each of these boards we're on. I've used the same kernel for the MinoMax, which is a tiny thing, and the OCP, which is a very big thing, and it's worked fine. So this actually makes our life a little easier. One of the participants, Ryan O'Leary, wanted me to mention, actually, that what he wanted me to mention is no longer true because of change in plans. We were slightly tied to the BIOS vendor because of ACPI setup. I think some of those issues are going to go away. So I wanted to just talk a little bit about user space. Our user space is written in Go, and there are a lot of reasons for that. We tend to trust Go a lot more than C at Google. It's really viewed with favor. If you can have a thing in C and instead have a thing in Go. I spent many years with BuildRoot and BusyBox and all those things, and I started this Uroot project about six years ago when I had yet again another BuildRoot failure, and I just got tired of trying to figure out all the config scripts and stuff. So all our commands are written in Go. And in mode 1 for Uroot, in fact, when we build an init ramfs, it includes the Go tool chain. All the packages needed to build all the commands, all the command source. And when you boot, and then commands start running, they're dynamically compiled. It typically takes about 200 milliseconds to build a command like bin date. Since we're putting this in a ramfs, after that, it's just essentially instantaneous to run. So that's the security guys really like this because you bring a machine up and all the source is visible, and we kind of bring along everything that's needed. But it's a 5.9 meg init ramfs, even LCMA compressed. So sometimes there just is not enough room. And so, or you've got a really slow processor like NRM, and you really don't want to get a compilation step, even a fast one in a way of booting. So we have a different mode. We have one program in many sim links, which should be familiar to anyone who's used BusyBox. So it's kind of a multi-point binary. So you type ls, and it actually runs the same command. It looks at argv of 0, and then calls a function named ls. And what we do here is we use the go abstract syntax tree package to rewrite commands in the packages. So I have a command called ls. It's package main. We actually parse that with ast, and rewrite that to package ls. Get all those packages. We compile them all into one binary. That takes 15 seconds. Now, the thing about go is every compiler instance supports all the architecture and OS combinations you can think of. So you never do a cross-tool build again. You get the go compiler. If you want to compile for arm, go arc equal arm, run your compilation. You've got an arm binary. So that's really kind of handy. In this mode, of course, we don't include the source code or the tool chain, but it does reduce the footprint to 2 meg. And this is really handy, again, when FlashSpace is limited. There's kind of an interesting implication here for startup, which is that all the init scripts get replaced with one go program, one or two. And that leads to things coming up really fast. And at least from my point of view, I don't need to look at unit files and scripts and stuff. I look at one program for whatever platform I'm on, and I understand that the boot up, and it's really fast. So we actually have a project for Chromebooks where we can boot to x11 in a browser in five seconds. And this speed is part of that. So I don't know. This is leading to some other thoughts about maybe how we do things in normal machines. We just basically use go to write the init thing, and we're done. So go is a compiled language, but it's frequently used for scripting. That's why I use it all the time. I stopped writing bash scripts years ago. I just write go programs. It's actually easier and more reliable. So anyway, I kind of pushed a little hard to get through this because I wanted to cover questions. I literally have to leave here right at 5 o'clock to catch a taxi. And I just wanted to see if anyone had any comments or thoughts or questions about this project. Where we are going is we hope in 2018 to have some actual companies using this and shipping those with this embedded in it. And the reason they want it is they want to have firmware they understand, and it has a fast boot and is secure. And with that, I'll stop and see if anyone has any questions. Oh, yeah. Yeah, so we don't do secure boot. And I think if we use TPM, we'll probably try and look at how Chromebooks do it, because that's worked really well. There is a verified boot written in Go that's part of your route now that doesn't work, I must say. But we'd really like to look at going the track that Chrome OS took with their use of TPM and not the secure boot stuff. And to be honest with you, you're skirting right at the edge of what I really understand, so that may not be as good an answer as you'd like. But it is something we definitely will be looking at how to handle that. And Tram is, I should say, Tram is very concerned about this. Heads is part of a secure environment that he's building. And he really has a much better understanding of measured boots than I do. So to some extent, I'm going to follow his lead. But that's a good question. Oh, yeah, I'm back here. I'm sorry, core boot is not in here. No, so here's the mic. My take on this is that core boot is always preferred. I always prefer core boot, right? So on the minimax, when I can run core boot, I do. But there are situations where core boot's just not going to work. Core boot has not been on server platforms for 12 years because of this problem, because we couldn't get the information on how to turn on QuickPath. So we're back on server. And I think that's the important thing about this is we are now back in an area with sort of open sourcing the bios as deep as we can and on server. And that just hasn't been true for a very long time. So that's my idea. Always use core boot if you can. If you're stuck with a situation like this, look at Nerf. That's how I'm attacking this. Yeah? Microcode updates. We don't. Question was about Intel microcode updates. Here's the issue. On many processors now to turn on DRAM, which is essentially a billion instructions for the training step, you have to have the right microcode loaded. So that microcode load has to happen in that second thing, that PEI step. So there's nothing we can do about that, right? If they're going to turn on DRAM, they need the microcode that makes DRAM work correctly. And that happens before we get into this DXE level. So we can't really do much about microcode. So any other questions? Oh, yeah. I don't even know if this mic works, actually. I haven't tried it. Does this? Yes, this mic works. So more of a general comment. A lot of things that you seem to be complaining about aren't part of the EFI specification, but rather things that vendors have done that are suboptimal or horrific, like the use of SMM for things that should never be in SMM, enabling tons of modules in their EDK2 build that are unnecessary and that kind of thing. Because you can compile out all those. Sure. The vast majority of those modules in EDK2. Well, you can compile the Dixies that source is available for from a vendor for their network card, say. If they don't give you that source, you're stuck. And we have enough of them. And further, I mean, it's a good point. Yes, you can fix a lot of this. But the counterpoint is take a company like Google, which in published terms has at least a million machines in its fleet. The Google Linux compiler is tested at scale 24-7. When we boot EFI, it's very infrequent. So that testing is not nearly as strong. So I think there's a really strong case to say that that kernel that is so heavily tested and made performant should be the thing I put in firmware. That's my argument here. And I've had good results for that since 1999. So I'm buying that argument. But I take your point. But if you look at the Power 9, for example, IBM Power 9, they put Linux in firmware. So this is not really, I have to say, this is not a novel idea. It's a novel for x86, even though we've done it for a long time. But it's not an awful idea in general. Just one follow on from that. The bits that you said you had a repository of open source bits for the firmware. Have you interacted at all with the EDK2 open platform package where they have lots of they're trying to upstream open source platform support into EDK2 for a variety of ARM and x86 platforms? Yeah, I think there are a number of companies as an entity that are doing that. And I think there are people at Google doing that. I also think that when we kind of look at the overall picture, at least me personally, I shouldn't say I'm speaking for Google at this point, Linux, to me, makes far more sense as the thing to start at the end of PEI than UEFI. Oh, sure. I just meant for the bits that you mentioned that you had open source. Yeah, Tiano Core. And again, to Intel's credit, Tiano Core was open sourced. And there are a lot of pieces there that actually we use. The Dixie Core and there are two utility programs. But in the end, we want to get into Linux and firmware as soon as we can. Fair enough? Yeah, thanks. Did you have a question back there? No. OK, yeah. So for me, as a normal user, I'm not talking about servers, platform, other things. I have my notebook. Can I use this without having access to the? Yes, Tram is actually targeting notebooks. And is that your question? Yeah, and what exactly do I need for this? Because if I go to the vendor and ask, OK, can you give me a source code for your UEFI, ME, and other stuff? No, no, no. You don't need source code for UEFI at all from the vendor. And what about ME? You can never get source code for any ME anyway. Can I just replace it with? So the ME cleaner, you're not going to replace it either. The thing I didn't mention, I'm really good at this, the BUP, that very first thing, that is signed. You can't change that or things won't work. So it's all the stuff after the BUP that is not included in that signing. So what we're doing is removing all the stuff that's not part of that signed thing. And that's when we discovered that if all that's in there is the BUP, platform comes up, doesn't turn off after 30 minutes, everything seems to work fine. That's been the big discovery of the last two years, which none of us ever thought would happen. So you do not need the ME source from your laptop vendor. You need the ME cleaner from KORNA to clean it. You do not need UEFI source. You want to talk to Tram Hudson. And I should say, part of this discussion of KORBOOT or NERF, Tram was working really hard to kind of get KORBOOT on a lot of things. And it's just a tough lift, because that information is so tightly held. I think he's finding this NERF approach a lot easier and more approachable. But again, you do not need source from a laptop vendor to do this. Tram has done it. And if you want to talk to us later, we'll try and help you do it. Now, if you're going to do it, make sure you're OK with the idea of turning your laptop into a brick and recovering from that, because it's still early days. And any time you do this stuff, that can happen. Purism released some. Purism, the notebook, released something that they disabled Emilinos completely. Yes, I know that guy very well, actually. They said it's not gone, but it's simply disabled. So speaking about this web server that you said is still a problem. So the ME Cleaner removes all that code that implements the web server. The Purism work actually goes a little deeper and turns on this HAP mode, which is really pretty cool. So what's happening as a result of the, again, the last two years of work by a lot of really good people, we're slowly, slowly digging our way into basically disabling the ME, which I think is something we've all wanted for a long time, and I think we finally are learning really how to do that very effectively. That's the big goal. But Purism's work is, you don't want to view it in isolation. Purism's work is sort of part of this continuum of work. And everybody has been contributing, and it's sort of the next step in this work we're all doing to try and get it. I shouldn't say me, I haven't, it's other people doing this great stuff, but the community has been doing to get this disabled. And another question, is this ME cleaner or the possibility to clean that up, also working for the newest Intel processors, which is science stuff? I think, but we'd have to, I'd have to find out. Honestly, again, all this stuff is moving so fast that weekend and week out, there's sort of some new discovery and some new way of turning more stuff off. So it's been really fun to watch because we really didn't know we'd be able to do any of this. So yeah, I guess all you can do is watch events. Like I say, this was a different talk a week ago, because we're learning more and more day in and day out. Fast moving project, and we'd love to have anybody who wants to get involved get involved. So, yeah. I'll repeat your question, cause, oh, that's okay, yeah. I have two minutes and 54 seconds left. Just a follow up on what he asked. The disablement is actually working cause the Skylake stuff. This is an x86 core for ME and a Minix kernel. And there's been security research on just decompiling all ME. And they found an just disablement bit. So you can just flip a bit and everything after the boot up is gone. And the old ME cleaner works on an obscure risk architecture and that won't work on the old stuff. But if you've got a Skylake and Kaby Lake, you can just disable ME for good. So I just got told in no uncertain terms to stop. Thanks all for attending. And we again, I appreciate anything you want to do for this project. Thanks. Thank you.


This is stock number 8J182A. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used Jeep headquarters. Today we are taking a look at this super clean like new 2018 Jeep Cherokee Latitude Plus. This vehicle has the 3.2 liter V6 Pentastar motor which pumps out 271 horsepower. From this HD video you will be able to tell that this Jeep is like new all the way around and just absolutely perfect. We shoot all of our videos in 1080p so if you have HD capabilities on your computer tablet or smartphone, turn them on now because it's like you're right here looking at the vehicle with me. So this one is Firestone Destination 22565R17 tires on the 17-inch painted alloy rims. These tires are like new. There's only right around 1200 miles on this vehicle. It has the LED running lights, the HID by Xenon headlamps and the factory fog lights. Front bumper is absolutely perfect. You have the seven slotted grille. Diamond black is the color. Didn't see any dents or dings on the hood. This side of the front bumper is in excellent shape. Passenger side rim, no scuffs, no scrapes. And as you go down this side of the vehicle you can see just how clean the body is, how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down you can still see the vehicle, hear the vehicle and have confidence in what you're looking at before you even get here. We sell a lot of vehicles out of state and we do that with the videos so customers can have the confidence that they're dealing with the right vehicle and the right people. Back rim is absolutely perfect and the back tires have just as much tread as those front tires. As we come around to the back, see the rear gate is in excellent shape. It does have the LED tail lamps. This one does include the towing package, the factory towing package which gives you the receiver hitch, four pin and seven pin wiring. You get the dual rear exhaust with the V6. Back up camera is right there. This is a power lift gate so it has the convenience group on it. Back storage area is very very clean like new back here. You have the cargo organizer, there's your button for the rear gate and all the four by fours come with a spare tire. Those seats do go down nice and flat. Press that button it'll beep at you three times then it'll come on down. Shuts nice and solidly and as we go around to this side of the vehicle like new on this side for full disclosure. No scuffs or scrapes on that rim. Four wheel disc brakes on the Cherokees. Very very nice and clean. You can see just how mirror like that paint is. Inside the latitude plus package gives you the black cloth and I think it's a vinyl leatherette trim. There are no rips or tears on these seats. Both these seats are heated and you get a power driver seat with the factory lumbar. Factory all weather formats also part of the cold weather group. Power windows, power locks and power mirrors. Auto headlamps and as we hop inside the vehicle you can see that this one has 1185 miles. Almost a full tank of fuel on this vehicle. You get the heated leather wrap steering wheel. No scuffs or scrapes on that cruise controls on that side. Bluetooth audio and information center controls on that side. This one comes with the 8.4 touchscreen radio. You get your heated seats and heated steering wheel buttons right there. This is also where your backup camera shows up and just a whole bunch of apps that you can do in there. I think this is the last radio that you can add the navigation to. All the other ones come with Android Auto and Apple CarPlay but this one does not. You can see it has the stability control, start stop, dual climate control. You can turn that start stop off. It has a four-wheel drive with the auto snow, sand, sport and mud. It has a USB, AUGS and SD card slot. The nine-speed automatic transmission, passenger floor mat and seat is absolutely perfect. No rips or tears on that and the headliner is in really nice condition. It has the homelink system and the 911 and assist buttons in the mirror. Those are always active. You don't have to pay a subscription for those. We'll take a quick look at the back seats and then we will check out under the hood. Back seats are just as clean as the front seats. No rips, no tears back here. Does have latch child safety system. Side curtain, knee bolster airbags. This vehicle has 10 airbags in it. Very safe vehicle. All weather floor mats back here and it does come with a 115 volt, 150 watt plug-in. So these seats do go down nice and flat.  These seats are also adjustable so they slide back and forth. And we'll take a quick look under the hood. Thank you so much for checking out the video. We hope this helps you make a decision on this vehicle. Pretty much like new all the way around and locally owned and driven here in town and traded in on a brand new one. This one has the 3.2 liter V6 Pentastar motor. Just a little bit smaller version of the 3.6 and this one pumps out 271 horsepower engine base. Very clean runs, very smooth. This vehicle has been fully safety and inspected by our service shop as a fresh oil and filter change. All the fluids have been checked and topped off and this Jeep is 100% ready to go. And to see more pictures of this Cherokee or one of our other 400 new and used cars, trucks, SUVs, minivans, Wranglers, you name it we got to go to our website www.summitauto.com. Full pictures and descriptions of every single vehicle on our lot. Videos of every single used vehicle that we have all at summitauto.com. Thank you so much for checking out the video. If you want to make this Jeep years today give us a call<PHONE_NUMBER>. Ask for one of our sales associates to make this Jeep years today. Once again that number is<PHONE_NUMBER>. Thanks again for checking out the video. If you want to check out more videos go to youtube.com slash Summit Auto. Remember to like subscribe and share on this vehicle and all the videos you see there. In fact in a second you'll see a link to subscribe to our YouTube channel on your left. A link to more used inventory videos like this one on your right. If you haven't been to our website on the bottom a link to this vehicle on our website. Click those check us out. We really look forward to help you with this super clean like new 2018 Jeep Cherokee Latitude Plus four-wheel drive. Thanks again.