Hey friends today, we're hanging out at Disney's animal kingdom I wanted to come out and show you all the cool Christmas and holiday offerings for this year I know we've got the merry menagerie back and those were so cute the little animal puppets and Discovery Island and then also the Christmas tree is up They're playing some like animal kingdom Christmas style music and we're gonna ride some rides and eat some food Anyhoo, let's go do this The first thing we see before we actually even make it in the park is the animal kingdom Christmas tree And I just realized that this Christmas tree is the only Christmas tree that has tons of Disney characters in it Like all the other trees really don't have many Disney characters, but this one has a lot. I Really never realized that I mean I know Epcot has a lot of world showcase and Magic Kingdom is very Christmas-oriented with like toy soldiers and stuff like that But this has actual like Disney characters like Winnie the Pooh, Chip and Dale, Mickey Mouse, and no other trees have that. I love all the ornaments and as you can see there's a little hidden Mickey on the tree right there We've got Stitch inside the train. We've got Tigger. We've got Piglet These are some of the animals from Animal Kingdom or from Lion King. We've got Jiminy Cricket right there See like they have so many Disney characters and like it's just kind of shocking that out of all the trees This tree would have the most Disney character influence. You got Chip and Dale and the Stone Globe right there. It's very cool I like this tree a lot As I said in the beginning of the video the merry menagerie is back And they swapped out the photo opportunity with the merry menagerie like photo op and I really love it I love the little puppets. They are so cute and they're actually sporadically out like throughout the day And you never know who's gonna be out like which one I think there's like ten of them But I'm not too sure but we'll see who we actually stumble upon today Right here is the photo opportunity. You see we got the little fox there and this snowflake is kind of like Animal Kingdom's Like holiday like symbol.  I feel like I'm missing like a major major part of my day I'm gonna have to pull out the annual pass holder card in my wallet to actually get in the park Kind of like I was like wait a second We've got some nice Animal Kingdom garland right here and can you hear the Christmas music? It is really awesome I really like it I'm not too sure if they have any holiday treats or snack offering I know in the past they used to have like Thanksgiving dinner down at Saltually canteen or they had a couple actually of turkey dinners throughout the park like one in Tiffins 2 and The cupcakes that they have out now are autumn cupcakes and they're actually pretty like they're nice I haven't had one yet. So if we don't find any holiday treats Maybe I'll try that or I'll try the spaghetti and meatballs cupcake because that's one that I haven't tried yet Honestly, it sounds a little fascinating a spaghetti a meatball cupcake But there she is the tree of life and I can see some of the puppets actually out right now They're actually flying around. I don't know if you can see it. We'll get a closer look at a second. Oh wait They're coming to us. That's awesome There they are look at that I got a good bird's-eye view there. Yeah And here's the fox look at that isn't that the cutest Who's that little friend My little friend nice to meet you. Oh nice to meet you. Oh, can I pet?  Oh Boy, we got a bear coming up over here. Oh I like how they're just walking around playing music to slide music. That is really awesome We got the big bear and then we got the little bear over here. Look at that. Oh Look at that smile. I Love it. These are so adorable Twinkle that is awesome twinkles my new best friend that is amazing Oh Aren't those the cutest things ever I love it so much and they actually come and go so some other animals have come out And I'm sure we'll be seeing some other ones because we're gonna loop back here But I love it. It is so cute and I look forward to it every year now an animal kingdom I hope it stays forever You can see a lot more decorations up here and here are some of the merry menagerie characters actually and these have been up for a While though, I just like the kind of classic look that animal kingdom does with the Christmas decorations They've got the bear. They've got the penguin I didn't see the penguin come out yet And he was one of my favorites because I like how he runs across the floors and it says I am a puppet and They're 2999 that is so awesome. Isn't it they are so cute They also have like a nice little animal kingdom tumbler and also they have some ears now I don't know if these ears have anything to do with the merry menagerie, but they look like they do. They're very soft 2999 I think they are I mean the color scheming actually matches. So I think there's a merry menagerie ears Also, it's the first time I'm seeing these two. It's like the partner statue Christmas like apparel They have partner statue hats and also scarves. I've never seen these before, but they're they're very nice 1999 and then they got some generic ones over here, but those ones they're nifty as I was walking away. It looks like some more of our puppet friends are coming out to join the party Look at I like how they're just walking around the park Just a casual little stroll Look at that adorable I had to run back to see the reindeer. I mean they are just so so cool Here is a look at the wait times for today seems like it's a pretty busy day in the park Expansion Everest is 55 minutes dinosaurs 45 flight of passage was 120 Navi River was 90 minutes and Kilimanjaro safaris was 60 minutes. So it's definitely a little bit busy This is the first week that a lot of international travelers have made it over and I'm so excited that People get to actually come visit Walt Disney World from all around the world again And I got to meet some people from the UK that were like on the first and second flights out and it's It makes me really happy even though it actually makes it busier in the parks But that's good the more business the more cast members come back the more things actually get moving and getting straightened out in the way that it was and I'm happy. I'm happy for everyone We're actually gonna start in Africa normally I always head over towards Asia because I like to ride expedition Everest and we probably will ride expedition Everest But Santa Claus is actually out and about in the park and he's floating around in a boat So I want to try to catch him and also see if there any is a any holiday treats out There is no set schedule for Santa Claus So you either need to be in the right place at the right time Or you just need to stand by the water for like a good half an hour to an hour and you'll definitely be able to catch Them then I'm pretty sure it's every hour that he actually comes around. Oh But take a look over here by the Dawab bar. This is one of my favorite places actually get a drink and hang out They got some nice Christmas decorations and we're about to see a little show again I haven't seen anyone perform in this little market area in such a long time and I'm actually really happy I'm kind of rushing up there front row. We got to be we got to be front row for this That was so awesome to see them outperforming again I don't know if they've been doing it for a while But that's the first time that I've actually got to see it and it's also amazing to see them actually call people up To like come dance. That's what makes Disney magical I remember like first coming to Disney and getting called out to do like audience participation things and I talked about it for years I still talk about it sometimes, but you know what I mean? Like it's such an amazing magical experience to be like called out to do something fun Something silly something serious and I love it. It kind of just gives me like the good Disney feels You know what I mean? One of the things that I do remember doing when I first came to Disney was actually being in the Backlot studio tour over at MGM studios. I got to participate in that and I remember it was like the coolest thing ever Also, I remember doing American Idol there There was a lot of guest participation at MGM studios and I loved them all or I loved actually talking to The mayor of Main Street at Magic Kingdom. There's a lot like I said, I love it and makes Disney magical Oh I was hoping for a Santa Claus, but it looks like it's not him. It is a holiday I Think I'm gonna make my way over to Asia where the rivers of light seating is because that's where you can actually see All of the cavalcade. Oh wait, I just call rivers of light seating no more rivers of light But I think you guys know what I'm talking about This is where I was talking about well it used to be rivers of light now It's kite tails and you can actually sit here and all the cavalcade So actually make their way through so if you wanted to see all of the different characters On the cavalcade then just sit here and wait for like an hour and you'll be able to see every single morning come by Oh speaking of that. There's Pocahontas How funny is that that was not planned at all and Miko too We're just gonna wait out here for a little bit. Hopefully Santa will make his way around again We just saw Pocahontas and Miko and that was really cool because I wasn't expecting to see them But if expedition ever so opens up, I might actually just run over there real quick So there's a good chance we might miss Santa and then we'd have to wait again like either the half an hour or the hour So top decision, you know what I mean? No wait for expedition ever or see Santa Claus Well, I heard expedition ever's running. So we're gonna wait out here for a little bit Up looks like they're opening up right about now. So we're just on time. Look at there's zero way zero minute wait Oh There we go, it's open now Well that happens so fast The funny thing is I'm running I'm a single rider. I could just go with a single rider line But if I wait in the standby line I could do front row, but look at look at all the people coming in We plan that perfectly. Well, I don't even know if we planned it. I think it was just the timing was perfect Earlier though, you remember seeing the wait time was 60 minutes So it's like I said a very busy day and this is a good way to get on the ride I'm actually really happy because I probably would have bought the lightning lane You know what I mean to skip the 60 minutes Up here you can ask if you want to wait for the front row and they have a separate little area right there But since we had no weight, I don't mind waiting a little longer. This is the single rider line This is the front row line. I just like front row on expedition ever. Back row is fun and thrilling But front row you kind of get like a nice POV as you're going through the forest And I like it it starts off nice and relaxing and then all of a sudden you enter and encounter the Yeti And here we are lucky number one I always like checking to see the things that get dropped on the track Looks like there's a chap stick down there. We've got a Dasani bottle over there a couple of other fancy things Some trinkets a dingle hopper We got a Nike visor down there a water bottle another chap stick someone's 50th annual pass I seen don't want to lose those bad boys only get one that was great. I'm so happy We were just hanging around this area once it reopened because now I got to show you what it looks like The line is all the way out here and it says 40 minutes. Oh 50 minutes 50 minutes So it happens very quick and we're only gone for five minutes where we're on the ride for five minutes. Oh Look there goes Santa Claus So I think he's gonna make a left and head towards Discovery Island So then we're gonna be able to catch him when he comes back around through Africa So we're gonna make our way over that way right now, but I see him in the distance. Say good. Bye We got to catch Santa Claus. We're gonna power through Asia and end up over in Africa real quick They move pretty fast, but I think we caught them Look at this we've got Donald and Daisy in their holiday best Well, they're cute Okay, we caught them, but I think Santa's coming right behind them And I think I know a good spot where we can get a really good shot of Santa So we're gonna kind of come over there real quick Right here at the upcountry landing. They have this little like walkway down here that gets you really close to the water So hopefully we'll see them from here Look at that Merry Christmas to all and happy holidays Tis the season to deck the halls. Thank you Celebrating the season with all of you as he sails down the Discovery River Santa yelled nice hat and that was really cool And I think we'll just stay here and we'll wait for Mickey and Minnie because I think they're gonna come down in their festive holiday wear as well And it seems like we got here just at the right time We cut Santa Claus and then like I said Mickey and Minnie right behind them. I Remember waiting like an hour and a half to see Mickey and Minnie in their holiday outfits when they were actually doing meet and greets in Discovery Island and honestly got me thinking a lot of these wait times could be really cut down If the characters came back and more the shows actually, you know started again because it's kind of like You know spreading out the herd of people the more things they have to do the Lower the wait times are gonna be because they're gonna be in different areas Like I said at one point of time there was a steady hour worth of people waiting to see Mickey and Minnie in their holiday outfits And can you imagine what that would do to the wait time surrounding around the park or even? Finding Nemo, do you know what I mean and that goes for all the parks once they bring in more shows more entertainment more meet and greets Things in wait times are gonna definitely go down lower As I was waiting and talking about Mickey and Minnie a friend told me where I can find some holiday treats And they actually have quite a few they've got a mini holiday apple They've got a Mickey peppermint marshmallow mini holiday marshmallow, then they've got a Mickey Santa Claus rice crispy treat a mini Santa cereal treat Mickey gingerbread cookie Mickey Christmas tree cupcake a lot of actual ones So I think we're gonna order some of these These are actually all located at Zuri sweet shop Which at the moment seems to be only placed actually get holiday items and that's not so much like the animal kingdom themed I think these are just universal like all around the parks holiday items I don't think they rolled out the Christmas or holiday treats here just yet, but still why I'm here I might as well get a couple of them, you know Right in here at Zuri sweet shop Oh, look at these Christmas decorations. Oh, actually, I don't even know if these are Christmas decorations They look it, but not too sure. They're actually really pretty though. Oh Yeah, they have a lot a lot of items they all look really good They have three different cupcakes that are different Christmas holiday ones They have a chocolate they have a vanilla and then they have a red velvet one Then they've got the mini marshmallows and the Mickey ones. They've got holiday candy apples over here and Santa rice Krispy treat right there along with looks like some Santa Mickey gingerbread cookies to lots of good stuff First things first I think we're gonna try the Santa rice Krispy treat and also take a look at that cool Christmas decoration. Isn't that nifty? I really like it the Santa cause Christmas treat is just a whole bunch of rice Krispies and some red Sparkles and probably white chocolate dipped and you could probably get this at any park But like I said, at least we're trying something holiday-ish here at Animal Kingdom, and I don't mind if I do And of course we have to go ears first Wow that is a good rice Krispy treat right there and I thought the ears were marshmallow, but they're actually rice Krispy treats It's also good It's okay that it wasn't marshmallow because we have a whole marshmallow treat right here a little mini marshmallow Isn't that so nice and also look at that read like I love the festive Christmas decorations. That's really awesome But now we're gonna have to try this one. I do want to point out this read that's made of a bunch of different beer Bottle caps you can see we got Tusker Lager right there some Guinness. We've got a Pilsner Lager Looks like a Miller light there and even some coca-cola ones as well This is a really really nifty thing in fact I feel like all of these are actually in order like these are all like special ones But this is the only one that has toaster on it. So you know what I mean? So like this one must have recently got added to it Now we're gonna jump into this bad boy ears first Honestly, I'm not the biggest fan of this actually. I mean it's okay, but it's a lot of chocolate I mean the coating around the marshmallow is like really really thick and I wasn't expecting that I much rather get the Santa Rice Krispy treat sorry mini Now that we had some treats I want to actually go show you guys the line for Kilimanjaro safaris It is queuing up in a way that I've never seen before Let me know in the comments if you've ever seen this before but this is the first time I've ever seen this It says Kilimanjaro safaris is a 75 minute wait and they actually have the backstage area open Look at this and you're queuing up going down here and you're going backstage actually I've never seen this before this is pretty intense though. Don't you think? Back here is the back side of Tuster house and fact here are their coolers Look at that watermelon strawberries grapes apples and steamed corn and butter all inside there I don't know if those are actually for Tuster house. It does say Tuster house complex though. So who knows This is something else like I said, I've never seen this before It's one way to actually cure what people in the line stops right here. I Guess it's safe to say we're not gonna be riding Kilimanjaro safaris today That is so so long it says 75 minutes and I've never seen them queuing up back there So that was kind of a real shock and just seeing all around there every once in a while They do things like that like Magic Kingdom. They'll open up like the floodgates on the side of Main Street so you can exit And sometimes they do they open up the backstage areas so that you know You can extend the queue out or you can exit the park and just really nifty to see it for that You know what I mean? Now we're gonna start making our ways out again, but I want to say hi to some of our little friends again I love it. I have to at least see all of them. I still haven't seen. Oh, there's a seal Got it. I got super excited. I gotta go see the seal But there was a penguin Look at this What's her name or his name what is it snowflake I like it snowflake you're adorable Nice there he is. Look at this little guy I love it. We're a little dance Well, that was a lot of fun I think that's gonna do it for us today. I mean we got to try some holiday treats see most of the Holiday offerings ride expedition ever and look at the bubbles at the end. That was beautiful any hoos I hope you enjoyed the video. I enjoyed making it. We'll see you next time. Bye


Thank you everyone for coming. Before I start, I just want to make a big thank you to Johannes who very kindly lent me his laptop the last-minute thing but It's really helped me. It's his first camp and literally the first thing he did when he came to camp was sign up to be an angel and do volunteering so I'm Really inspirational there so I'm Dan Hagen This for me is my second camp I came to the camp in 2011 and Really that that opened my mind to Hardware hacking as something that could I could possibly do Literally came to the camp with no idea of which end of the soldering iron to hold basically and And so in the subsequent three years or so I quit my job and I now run a company along with my family are doing a Wireless control for model railways and this talk has really come out of the research that went into the power supply side of that But more importantly this talk is really to sort of give back to this community You know Just something to say. Thank you for the sort of the things that I've learned from this community in that time So why is it why is the talk called singing capacitors and winding inductors? Well, these are the key components that will generate the signals that we can use to perform these side-channel attacks And we'll see actually that they're gonna that they almost certainly are leaking really really important information And they probably shouldn't so I just want to take you back now to 2013 Snowden has just revealed himself to be the NSA leaker and a question that's on lots of people's minds is Does encryption work and his answer really sent shockwaves through the crypto community? But there is a sting in the tail with this This answer and that is this question about what it means to be to have properly implemented cryptography systems So let's consider all the things that need to be put into a Usable system for a real-world user and this is this slide really illustrates that that Engineering challenge and as you can see there's only really one solve problem and the other problems get progressively harder as we go down the stack Today, we're just gonna focus on implementation. The other ones are talks in their own rights and before we look at that Let's just have a Look at protocols and understand what's kind of missing from protocols That would lead us to consider implementation in more detail so It wouldn't be a cryptography talk if we didn't include our old friends Alice and Bob His Alice and Bob and they want to communicate with each other and they want their protocols to ensure Certain property that they have certain properties for instance that a any Easter up as such as Eve can't Recover information just simply by listening to the the traffic going between them similarly a malicious attacker such as Mallory Is not able to pretend to be Alice and Bob to the other of the two parties So what's missing from this? Well consider what happens at Bob Bob's end of the Communications channel so Really, it's not Bob that's doing the communication, but it's some Device on his behalf Messages go into that device and messages come out of it But essentially the assumption is that is a black box And also that that black box contains a secret key that never leaves that that black box now Really in reality that that is a machine as a machine that has Internal machinery and as we know about machinery That can generate all sorts of signals Okay, and these things are known as side channels and here's just a few of them and You might notice that quite a few of these ones towards the bottom here are actually ones that have appeared in the last few months So this is a present problem that we're facing now This is a problem that has been around for quite some time and actually when the first The first description of this comes from this book here called spy catcher And it concerns a cypher machine known as a haggling and this was used by several governments At the time in particular the Egyptian government I just want to read a few quotes from this because I think it's sort of lays Lays the sort of foundations for understanding how these how these attacks might actually be used in in kind of real Situations and also how they work Under the hood as it were so let me just read a few quotes from that if I may So operation Holt was begun in the early 1950s when GC HQ Asked MI5 if they could help obtain intelligence about diplomatic ciphers being used in London GC HQ hoped that one of the M of MI5 agents might be able to steal some of the way cipher tape Which they could then use to attack the cipher I'm sure that with the new high sensitivity microphones We have it must be possible to get something out of a cipher machine They have to be reset every morning by the cipher clerk Suppose we could pick up the sound of the new settings being made I Felt sure that that GC HQ will be able to use the sounds to determine What is known as the core position of the machine and from there being a position to attack the cipher if We could get the settings of three Possibly four wheels of the machine. They would have broken the cipher I Installed a series of high sensitivity microphones at various distances from the haggling as well as a probe microphone in the wall behind it Each microphone was connected in turn to an oscilloscope so that the sounds it recorded were translated into visual readings. I Checked with a post office investigation unit and obtained a complete list of telephone installations at the embassy There appeared to be one either inside or very close to the cipher complex So we decided to install special facilities on the telephone and use the microphone to capture the sounds of the cipher machine The post office faulted the telephone system and we waited for the Egyptians to call the post office The cipher room was in an annex the haggling clattering away inside Three cipher clerks were busy operating the telex machine and processing the diplomatic cables I began to extend the cable Slowly turning my back on him so that the engineer could slip a small washer into the receiver to modify it for special facilities I placed the telephone back on top of his desk not more than two feet from the haggling machine. I Hurried back from the Egyptian embassies the seventh floor to monitor the sounds from the receiver It seemed at first to be an electronic haze But after some fine tuning the clatter of the haggling was clearly audible The new technique of breaking ciphers by detecting intelligence about the machine through technical surveillance became known by the code word engulf It was a vital breakthrough the combined mi-5 gchq operation Enabled us to read the Egyptian cipher in the London embassy through the the Suez crisis So there's a question that is left As a result of that which is how did they get from the sounds that the The machine made to a determination of the positions of these wheels and We can perhaps look to see a more modern equivalent of this And that is something known as keyboard emanations So this is the idea that you can take a keyboard and the sounds that it makes and then determine from those sounds for instance What passwords are being entered into the keyboard? So one of the earliest papers on this used a neural network for? classifying key presses and so I looked to see if I could actually do a similar kind of thing Perhaps on a slightly smaller scale. So I took a laptop and hit the Enter key makes a different sound to the That's actually the space key the space key and the enter key I did that until I was basically bored and so I've got some training data there essentially Then I then compute an FFT over each of the individual key presses and create a neural network and my output from a neural network is one for say space zero for enter and I use the training data that I've got there to automatically train the neural network to to do the classification So that's actually look at the data that it generated so on the top line as you can see it's the enter key and on the bottom of the space key and You can see on the left hand column the time domain. It's fairly hard to sort of Distinguish the top and the bottom but when we look in the frequency domain on the right you can very clearly see that there is a Distinguishable patterns between the enter key and the space key and it's those patterns the neural network is actually looking at each One of the FFT bins as they're called is being used as an input to the neural network So how well does that are a little toy example do well? fairly well It's I'm pretty happy with that and I could probably go on now to to actually do full password recovery and there are more sophisticated techniques using hidden mark-off models hidden mark-off models and so on this note the bottom goes for the code that Comes as well for the rest of this It will be online later. If you really need it now come talk to me after the talk Okay, so we've just looked at passwords, but this talk is really about cryptography and then acoustic cryptanalysis, but actually acoustic cryptanalysis really is a An extension of a type of attack known as a power analysis attack So we can learn quite a lot about acoustic cryptanalysis by taking a look first of all at power analysis attacks And you'll see there's a very slight change that's required to go from one to the other So let's have a look and see how power analysis attacks works. So consider What's going on internally inside a machine? This is a not gate. It's a CMOS not gate Which means the that the transistors are complementary when one is switched on the other one switched off So we tie the input to VCC or logic one and current then is Rushes into the gates of these two transistors, but eventually goes towards zero and Current is then sunk from downstream gates. Okay, so then what happens when we connect the input to ground So that that current then is sunk down to ground from those those gates and we then Source current to the downstream Logic gates. Okay, so the take-home message from this is Power is only consumed when switching occurs. Okay, or to put it in other terms If data doesn't change from clock cycle to clock cycle We expect there to be proportionately less power consumption than that than it would be if data was changing Okay, so how can we exploit this this property? Well, let's look at a toy example here. Okay, and in this toy example We'll focus first of all on the second step. Okay, so we're going to measure The power consumption of this last operation, which is taking a constant register r0 and clearing out register r1 Okay, and what does that do? Well? Basically, the power consumption will be proportional to the number of bits that are set in Z Now how are we going to use this? Well at the top our first operation is taking the exclusive or register r3 and R2 which is values x and c now x is supposed to sound for something unknown something that doesn't leave the machine Either the key or something derived from the key and c is something chosen or it's deciphered text But it's something that we can actually Change in the system. Okay, so that's let's consider then What the operation of exclusive or which is what's being used here actually does so when? C is zero when a bit of C is zero X and Z are the same, but when C is one or set X and Z are The opposites of each other so we basically have a mechanism here for flipping the bits in X Putting them into Z and I'm measuring how many bits are in Z. Okay, so let's look at an example here In this example, we start off with C is all zeros and this gives us a baseline so in this example Two bits are set so we know that there are two bits set in X Okay, we first flip the the least significant bit of C and that results in three bits So what does that mean? Okay? Well the only bit that has changed in Z is the least significant bit and we now know that that there is One more bit set than there was in the previous one So that must mean that that is one and we know that C is doing is flipping the value in X So we have our first value in X that must be a zero and if you look at the the remaining Measurements you can essentially read off the value. It's going to be zero one one zero. So there we go That's toy example. Is this practical? Not really because it requires us to know a lot of internal details about this machine and also We need to get the timing quite precise and actually if you think about a modern process It can allow out-of-order execution and all sorts of other things So this is not going to be practical, but it actually It contains within it the sort of main ideas for a lot of the the tax So let's look at a more practical and this is an actual Setup that I put together. So what did I do? I used a an AVR microcontroller. I Created a naive implementation of AES now. Maybe you don't know what AES is We'll talk about that a little bit more detail later on but just for now some encryption algorithm, okay? We use one pin of the microcontroller and we sample that and whether that was set or not that sets or Resets the least significant bit of the key that we're using Okay, so this allows us to just see the difference between what difference that actually makes we use a What they call a current sense resistor a very small value resistor and we use that to measure the current going through that resistor And we use a fairly standard digital storage oscilloscope and a bit of Python scripting To to get that data and then finally we use one pin of the microcontroller to synchronize together all the the traces that we're going to to measure so just a zoom in on that stat current sense was the notice how small this loop is that's just a Minimize the amount of Noise that might go into the system. Okay, so this is the data that we gathered. So we've gathered 2000 runs for and the top right. It's when the least significant bit is zero I should mention also that the the key is all zeros and the the plain text is only Only doing the encryption not decryption zone the plain text is also all zeros Okay, in this in this particular case, but the only difference between the the the top left and the top right is that? that bit is either zero on the one hand or one on the other hand so What you can see in the in the bottom left is the difference between these two now if you think about it if the data Did not cause changes in the in the power consumption that should be a straight line Or as close to a straight line as we could we could imagine but it's not we actually see some spikes in there and those spikes indicate where Data differences result in power differences. Okay, so let's just zoom in a little bit more on on what's going here. So you'll notice here the Unfortunately the the the axes are going in the wrong direction. This is where that the the processor is in sleep mode This is where the process is actually doing encryption This little spike indicates where we sample that pin to determine whether or not we set or unset that least significant bit And as you can see there, that's the that's the difference between the two so looking zooming in it now on the The detail of those top two what you can actually see here if you know a little bit about a yes You might be able to recognize the first section is what's known as key expansion And then you can see individual rounds of encryption happening there. So that gives us timing information So even in a very simple setup like this We can determine lots and lots of information from just from looking at the power power consumption. Okay, so this this type of Setup is used in something known as differential power analysis So the basic idea with that very similar to what we did there except we put lots and lots of data into into our system lots of input into our system and then we We look to see What we do we make a some? Hypothesis about what the key might potentially be okay, and based on those hypotheses We infer some changes that might be observable. So that might mean that the most or the least significant bit or whichever bit it is maybe set or unset and we Use that to partition our set of traces and if our hypothesis is correct Then the difference between those two traces will be much greater than it will be in the other cases and the more traces we take the the More significant that those differences become if we pick the right hypothesis. Okay, so that's differential power analysis And we've just looked there at a symmetric crypto system. Let's look at Something known as module exponentiation, which is required for RSA public key crypto system. So you might be looking at this mod n business. You think and what does that mean? Okay, well, you're all experts in that because if I was to say to you The first day of the year is a Monday. Tell me which day a day of the week the 100th day is well, you'd be computing 100 mod 7 What you do there is you repeatedly subtract 7 from 100 until the value you had was less than 7 that's all mod does However, you don't need to know that really to understand what's going on here because it's the exponentiation part We we kind of interested in now If I were to give you the value y in this case and I was to say what is the value of x? That is it turns out to be a quite hard problem. It's known as the discrete log problem and it's what gives RSA It's it's security essentially so Remember that in a second because it will be important when we discuss this that won't be discussed module exponentiation Making that efficient. So how do we make it efficient? Well the naive approach is to multiply the base by the exponent by the number of the number in the exponent. So in this first example, we're looking at a where the exponent is a A power of two and so we can recursively group pairs of Terms and so you see that we've gone from four watch your three multiplications to Just two there and you can imagine with very much larger numbers that becomes even more efficient if we don't have a power of two in the exponent we can we can factor out into powers of two expand do a little bit of Rearrangement and we end up with a standard form, which is basically starting from the most significant bit of the binary expansion of the exponent and so we We basically Square at each bit as we go along and we multiply only if that bit is set as you can kind of see in this particular example Okay, so this this sounds great because means we've gone from Very very large multiplications remember X could be a 2048 bit number or it could be a 1496 bit number So this is great. We've got really efficient a way of doing this but turns out this is really really bad in terms of side channels because These numbers aren't going to be implemented by particular instructions on this machine They're going to be implemented in software and actually it's possible to have a slightly different Implementation for squaring than it is for multiplication So if you can observe that you can basically you can basically read off the value of X by just looking at the differences between exponentiation, so between multiplication and squaring and so yeah, basically the That this leads to you know the side channel attacks based on that now I'm more And the point being is that they don't have to compute the discrete log You don't you can get X without having to do that in that case so the most recent paper on Acoustic crypt analysis essentially used this idea, but in a more sophisticated form This is attacking GNU PG And in the particular implementation again coming back to this idea that the implementation is what what's letting letting it's down Okay, so that that was power analysis tax Now how do we switch from power analysis to acoustic crypt analysis? So we want to replace that that resistor which is in the power line and we don't have we may not have access to the power line We want to replace that with the power supply itself Okay, so we need to understand how power supplies work Okay, so let's look at internals and we'll think about this from the perspective of a control systems engineer So a control systems engineer looks at it in a sort of block form like this and it's a sort of ubiquitous design pattern That's that's found in control systems and you got your output that might be your voltage and you have your desired goal You know might be you want to get three point three volts and keep it at that And to using feedback you're measuring that to ensure that you keep the output Steady in the face of external disturbances and actually it's really really important that If if this external disturbance pushes that output Away you want to be able to react to that quickly and you can only do that if your control loop has enough Bandwidth in it so that bandwidth is important and it's important for us because actually that bandwidth is the same bandwidth That's available to us For this particular side channel and we need as much bandwidth as we can get away with So here's a so-called linear power supply and you can see that that Control control loop and the feedback directly you've got the two feedback resistors And you've got the reference voltage and you got this pass transistor that we're which is basically our plant This turns out to be not very useful for acoustic cryptanalysis because these types of power supplies tend to be fairly Noise free not completely noise free, but tends to be fairly noise free. What we're interested in is a switching power supply Now this is a buck converter, which I illustrate through the medium of my little pony and as you can see here when this Mosfet pass transistor is actually switched on the the current Goes through this inductor and the inductors the main Component that's actually sort of driving this and it ramps up You can see this in the in the bottom graph bottom right-hand graph there And then we switch switch the transistor off the current continues to go around because that's how inductors work And that that's switching that occurs has very sharp edges to it and those actually have induced harmonics and so you've got lots and lots of noise in the system inherently and There's there's modulation of that through this feedback and the pulse width modulation. Okay, so how would we? Measure the bandwidth that's in a power supply like this. So One way to do that is to look at the the feedback loop and we can inject a Signal into that feedback loops loop. So we take a signal generator and a transformer and have a little a resistor Just in that feedback loop and we're gonna have this we're gonna sweep through all the frequencies that We were interested in and we'll see what happens when the When the signal goes through that that control loop and comes out the other end so it could be that the signal is Has higher amplitude or lower amplitude it could be phase shifted One particular thing we want to avoid for instance is that the signal goes through that control loop is higher amplitude But isn't phase because when it goes through again, it's going to be even more Higher amplitude and that's going to be unstable. It might even oscillate. Okay, so The control system engineer will create something known as a BODY plot And we'll basically look to ensure there's enough margin there But he can use that plot to determine how much bandwidth is available in that power supply. Okay, so if we've we've got a power supply Theory behind us. Let's look at an actual power supply. This one has this is an evaluation module and it has the Connectors so we can put our function generator on there and you can see there the various components We've put put there before look in particular the the inductor and the capacitor Those are the things that actually going to generate the noise in the system. Okay. Now. I put this on to a Onto a well a set up basically I've got a box there that resonates so That amplifies the sound. I've also got a cone now if you look at this you kind of think well Doesn't that to look a little bit like a gramophone and that's no Accident because really if we're gonna use a function generator. We could also use an MP3 player or Some other device like that as I've got here and so let's see if we can place music through our power supply So I did is I took a track I I pitch shifted it because the frequency response at the low end is not so good and this Should be what it sounds like Okay, you may not be able to hear that so well, but that's that's Sam recording by a blue singer called Bessie Smith if you want to actually hear this If you actually want to hear this Live I have all this equipment with me so you can actually come along and hear it with your own ears okay, so Yeah, okay, so what actually causes these components to generate this sort of noise So there's two main ones for inductors We have something knows magneto restriction and then for capacitors, particularly ceramic ones multi-layer ceramic capacitors The piezoelectric effect actually is what kind of generates this and it's a sort of reciprocity there So if you if you hit a circuit board that's got these sort of capacitors you can induce Voltages in their currents into those systems, okay, so we want to now measure the Measure that the sound from our power supply, okay, and we also want to measure that at a distance and We don't want to we using a normal microphone like the one I've got here is not going to be any use because what it's not going to be as much use as say an ultrasonic microphone because Basically that those frequencies are going to go way up into ultrasound so we need an ultrasonic microphone and they are expensive to buy even the cheap ones are moderately expensive you can get You know get them for maybe a hundred and fifty euros or so if you're just playing with this stuff You probably don't want to spend that amount however The wildlife recordists have already gone ahead and thought about this problem And they've come up with them this particular they've used this particular module and there's other examples you can get there But these ones they've determined that they actually have quite good frequency response beyond 20 kilohertz Which is the normal limit for these kind of? Microphone capsules so I wanted to build my own microphone around this capsule and so this is the analog Signal path we have to increase the The game so you have some gain and basically increase the signal and we want to put this through a Low-pass filter and anti-aliasing filter. Why do we need this? Well, think about what happens in a like an old Western movie your You'll you're viewing that at 25 frames per second And a wheel on a wagon goes around much much much faster than that and so it can appear to be going Either backwards or it could be going slower than in that actually going because you're not you're not sampling High enough rates. Okay, so in our case We want to make sure that any higher frequencies and ones we're interested or us are filtered away So we're looking at 125 kilohertz of bandwidth That's that's a pretty respectable amount of this kind of microphone There's the detail I Don't expect you to take all that in at the moment But if you want this this also will be available as part of the source code as to look at But it very closely follows what that previous diagram showed So on the digital side of it and we're using a arm microcontroller that has a hardware timer Notice that we're sampling at 250 kilo samples per second. That's because our We because we are highest frequencies 125 kilohertz We need to maintain what's known as the night Nyquist criterion So we have to sample it twice the rate and so that's why we're running at that twice the rate there And so we put into a ring buffer and that reduces the the strictness of our timing so we don't have to be quite so so Synchronized in that timing there. We have a bit of glue logic here If if you can find a way of getting rid of that glue logic because there is a USB fire on board this device Good luck to you. I've had difficulties doing that. Anyway, so there's there's our glue logic that interfaces to our main host processor by USB and then we have a stack of Drivers and going from the USB side all the way up to a wrapped Code for using with numpy and pricing scripts and the rest of it. So this is what it looks like and The final thing we need to do is we need to make make sure that we can actually record a distance. Okay, so What we actually need is essentially something that Has high directivity so we could either shotgun mic, but for ultrasound you might have to sort of scratch your head and think well Are those slots the right? Distance apart and the rest of it easy way of doing that is to use a parabolic reflector so if if you notice that the The focal length of this reflector is Five centimeters and for 20 kilohertz and above we can fit several wavelengths inside the inside that Focal length that indicates to me that this would actually be quite good for ultrasound. It probably would be good for normal speech okay, and So I've sort of tested it but not really really long distance If you want to test this later on can talk to me that would be a good good thing to try out So this is more close-up pictures of that So I tested it tested the sort of frequency response using a rodent repeller and you can see quite a nice pretty sort of spectrogram there and There's a sort of little animation that goes with that And you know we can do it as a real-time FFT. It's quite quite good fun to do that kind of stuff now Later on we're gonna Very short in short while we're gonna want to look to see how we can actually Do the signal processing on the acoustic crypt analysis side, so It's important to understand when we've got a When we were actually picking out particular frequencies We want to think about tracking that frequency over time So that that might the amplitude might go up or down and that might be useful for us So if if we were to take our FFT frame size to be the entire sample that gives us no locality So we don't we can't really measure a period of time. So Reducing the frame size Gives us greater locality, but we then sacrifice Resolution I think this is potentially related to Heisenberg's uncertainty, so I'm sure somebody will correct me on this and then the other problem we have if we if we abruptly Cut off our our sample we have these side lobes as they call and that's not inherent in the In the signal, so we use a windowing function to make sure that we only get the frequencies that we're interested in Okay, so finally we can actually talk about acoustic crypt analysis. So That's actually look at Go back to AES and this is just a very brief outline of what a yes includes. Okay I want to focus on this thing Called the S-box lookups or the substitution box lookups because actually it turns out that they are where Sort of the pivot for how we actually can get data out of our system. So There was a paper by Daniel Bernstein Looking at something known as a cache timing attack and the idea behind this essentially is that lookups In lookup tables actually depend on the index you use in those in those lookup tables So S-boxes are essentially implemented as lookup tables, okay So and they actually use the key the key or a value derived from the key to perform that lookup and so Essentially, that's what we're going to use here to do this this particular side channel attack. So Just reiterating what I said there about the S-box is the other thing to mention is actually you can combine lots of those stages that we looked at in In the outline and to make very large Lookup tables and the problem there obviously gets much worse and in particular those lookup tables Don't fit completely into L1 and L2 caches. Okay, so that's how the timing differences You know the cache misses cause those timing differences Okay, it this this is actually a current Sort of live problem or an ongoing problem in the sense that for instance the recent truecip audit show that this was a problem with truecip So it's something to again. It's the implementation side of things that's letting us down Okay, so how do we actually do this this attack so we've got a secret key and a plain text and The time to do this S-box lookup depends on the value a as we said, okay, so first of all Well, let me just move forward here actually we've got we've got two phases in in the in the attack But the first phase is to compute The that distribution s essentially so pre-compute what what that distribution is now think about one example of this The the one that maximizes the the time to do the to do that lookup Okay, and actually If you think about the very first S-box lookup that happens It turns out that it's really well correlated to the overall runtime of our encryption Okay, so we we already know what the particular index that's going to maximize s is and So we already know what index is going to maximize s and then in phase two essentially if we if we pick out or if we if we rerun this but with The key being fixed, but then lots and lots of different Plain texts then actually we can compute a new distribution and there will be one Value in there that's going to maximize the runtime and that then allows us to go back and Unwind the exclusive or operation and then recover at least that value for the Of the key and we can do that for all the other bytes in the key And so yeah, and so that's basically the in outline how how that attack works now Just think about what this actually requires all it requires is us to know the runtime of our of our Program, okay, so let's let's look at how we can actually do that now This is an actual sort of experimental setup. I've got a motherboard here. I've taken everything out I've even made my own heatsink to get rid of the fan basically just so that I can have that as quiet as possible and I've got a Power brick again, I put it on a resonator to increase the sound And I'm now going to sort of send packets to that and see how long that that actually takes to Run things and see if I can actually measure that just through the power supply. So just just to show you here in This sort of if you like that sort of proof of concept of that that part of it in the bottom left We're going to show starting and stopping program and the bottom right that actually tells you the CPU load So, you know with a hundred percent or so and then the top is our real-time FFT Okay, so let's just run that animation There we go, so focus at the top primarily and you'll see just now Yep, there's a phase shift there not phase shift. Sorry a frequency shift and that occurs Just as we stop the program. So we start we start the program again. Okay Right, so you can see the CPU load go up to hundred percent Okay, and then we'll see again that when the program stops will actually see that phase shift happen again So the frequency shift I keep saying that there we go So that frequency shift just happened there So what basically we can track that and we can use that to measure how long our program runs so that is how we can use that to basically Determine the runtime of the encryption and from that we use that cache timing attack to recover the key Okay, so how do we so to just to summarize and to Finishing things off here. How do we mitigate this? Well, don't use sbox xbox sbox look up So if you can avoid it replace it with something else that Can require constant time if you actually a hardware manufacturer Think about using different types of mlcc's that don't have this problem you can actually parallel up mlcc's if they do have this problem to reduce that somewhat and There are other techniques of doing scoring multiplying for instance Montgomery's ladder, but there's more sophisticated ways of doing that Okay, so conclusions Really, it's to say that implementation details matter And Really, I want to kind of encourage you to play with these these kind of ideas You know tried to make your own sort of setup and see what you can you can achieve from that Yeah, and so basically that that that's that's the the key thing so implementation and Play with the ideas basically so just want to credit for the various slides there questions from the audience Thank you Yes, thank you for your talk. Thank you Yes, we have a lot of time for Q&A If you have questions, please come up to the microphones if you don't have questions Please keep seated because everything else would disturb the ones that who have questions So the microphones are here in the front Until then I make just the normal announcements, please if you go keep your trash with you remember the thunderstorms and Yes Again, maybe I don't you don't have heard it until now Yes, the Goli is quite happy with us, and they think we are good people here. So now there's a question Some as we aren't building our own power supplies for our own laptops or writing our own Implementations of the AES-256 algorithm. Yeah, what are you suggesting we do as normal users to protect ourselves from this sort of attack vector when We aren't building our own hardware or writing our own algorithms Okay, so I mean to kind of take the example of sort of true grip there. I mean that's that That's an example where we've had sort of Independent audit of that code and that that has kind of identified that those problems of are present Okay, so as an end user Although you can't necessarily change things in your code You know like to that to be the case you can actually Find out from other people that know, you know that can identify these problems and basically do the research about which particular products have known to have particular problems with them, so I would encourage There to be more auditing it if you like of code that's out there in a similar sort of way, but yeah, I mean other than actually sort of building your own hardware and Testing it yourself. I think there's there's not a lot extra that Can be done there Should we consider wrapping our power bricks in sound dampening foam? So probably not actually I mean, I think I think the point is that the to give you an example of how how many Packets need to be sent to do the sort of attack the cache timing attack we're talking there in the original paper We were talking about something like two to the 22 so that's going to be quite a long You're gonna be send that sort that sat there a long time with your with your microphone Trying to listen to these things although although it's possible in principle in actual practice. It's it's There's a lot of effort that require is required to do this kind of attack really and if you see what happens with Paranas attacks in those particular cases People really you know if they really want to get into the system They they'll they'll they'll spend the time to do it, but kind of an ordinary user probably wouldn't See that as part of their threat model if you like Okay, thank you. Thank you The next question from the other microphone For your test set up you had to remove all the fans and everything that made noise Yeah, this be defeated by putting a fan in the power supply So if you so if you look at the the the paper I showed about the most recent analysis paper they actually said that the In their particulates case the the fan Didn't actually make any difference in terms of what they were they were measuring actually so it's sort of a very low Frequency kind of thing and it doesn't actually it doesn't have enough sort of Information coming through it to make any difference in my case actually what I was trying to do there I wasn't actually trying to use the power brick at all I was actually trying to use the power supplies on the board the switching power supplies there and For whatever reason that particular board doesn't seem to have this as a problem Maybe they use the right sort of capacitors. I don't know but yeah, so You don't have to remove the the fan, but It doesn't make any difference if you if you do basically next question again from that microphone Modern CPU sometimes have hardware encryption. Yeah instructions. Do are you aware of any? Analysis of their side channels because they would be a prime target Yeah, and Did you know of anyone using se and the instruction? I'm not sorry come to Work with the data and it's complemented the same time So I'm not aware of anything anything particularly to do with sort of the you know Intel instruction set or anything to do with that Yeah, I mean I Would actually I mean this this particular project is something that I've been working on maybe for last sort of six months or so and so That particular level of detail. I haven't really got into yet, but I'm sure if there are things like that There will be you know papers and various things on that to look for but but thanks for the questions Another question from here Okay, so if I got you on talk white and the acoustic analysis relies on the cache timings Not what I initially thought on the instantaneous Current consumption I like DPA or something like that because that would also be I think that that should also be Visible in the SMPS. Yeah, but would have a Much higher frequency range. So, okay So the reason I've used the cache timing attack here as a sort of an example So suggesting this is the way of doing it is that I wanted this to well I'm learning this as I go along and I wanted this to be as literally the most simplest one I could possibly think of as a way of doing this and so Here the only requirement is that you know how long the thing runs for and there's a very easy to determine that from that However, there's as we know as we saw from the from the as we heard actually from the the power supply Big play in the music. There is a very rich Spectrum in there. And so yeah, you can actually see a lot more information if you're really looking hard for that information So, yeah, definitely it'll be in there if it's if it's being transmitted on the power line. Yeah Okay, but do you know of any? Attacks or papers which mentioned that they Basically here the instantaneous current consumption. Oh, yeah I mean, so so if you actually look at that again, I'll go back to that that paper. I'm not excited. They're the most recent acoustic crypt analysis paper they They actually Yeah, they can actually sort of see almost in sort of real time as as it's computing the the You know as it's computing between different values in the Modular exponentiation so they can actually sort of differentiate those things, you know, almost like a DPA attack there as you say in real time So yeah, it is possible to do that, but I would cast that as a an intermediate to more advanced level of Skill to do that kind of thing Thank you. Thank you. There's a question on that microphone. Thank you. Good talk From a professional audio background, okay, and one of the things that's fairly well known Is that? Because of ground bounce and ground noise issues, you sometimes get noises in the recorded audio Yeah, but correlate with my with mouse movements and such. Okay. Yeah. Yeah, this being essentially the same. It's the same thing. Yeah. Yeah the at least partial cure for which is To turn off the deep-sleep sea states in the biops, right? Okay, so the processor does not hide off Right as much. Yeah, and that significantly reduces the level of switching of power consumption that you get Okay But of course that up that that observation from the audio recording scene Give us nice to another possible side channel attack here. Yeah, basically the same thing. Yeah, but Using enabling the microphone on the machine Okay, yeah, if you've got a Skype connection open or Yeah, I mean, I yeah, I guess that kind of comes back to that that idea of Yeah, but right back at the beginning we're talking about with the you know the Telephone and using that to essentially get the the data Away from the the system under attack. Yeah, so using the microphone Skype or something like that Except you're not really using the microphone. Yeah, you're using the ground noise Right on the analog section on the motherboard right most laptops is appalling. Yeah. Yeah, okay picking that up and digitizing that as the Okay, that's interesting. I have to look at it more into more detail. It sounds like it could be you know potential Interesting things are looking Yeah, okay. Thank you for the question. Thanks. And I think this is a class question. At least there's nobody else standing there Well, actually, it's an answer for the guy that was asking about the fans So it's about the fans. Yes, it's an answer to the guy that was asking about the fans So hopefully he can understand. Yeah, why it didn't affect the research that they did on the paper. Oh, yeah Basically, there are two things that you should take into account Fans usually make noise at mood at much lower frequencies because they aren't that fast compared to the kilohertz Misuments you were making. Yeah But the second and more principal reason is that when you are doing cryptography with a with a half Good algorithm. Yeah, you will have approximately the same amount of ones and zeros plus less some error So when you do I mean measurement as you were doing on on your own on your own measurements Yeah, you will find out that thanks to test hysteresis of the fans The amount of noise you get when there is a one and when there is a zero more or less cancels itself always Right, so you will get more or less the same amount of noise during the world measurement after you have done a few of them Yeah, okay, that makes sense. Thanks. Thanks for the clarification. Welcome. Thank you Yes, that were our questions and this was then Hagen. I think he has another applause


And vitamin D help with irritable bowel syndrome. Hi, this is Dr. Ruscio, and let's discuss this issue. Irritable bowel syndrome has a number of symptoms that can constitute it, but typically there's gas, bloating, abdominal pain, and altered bowel function, constipation, diarrhea, and it's a very common condition and many people suffer with some degree of the symptoms of IBS. So we've all heard about vitamin D, and I think we've heard a lot of claims that vitamin D is kind of like the next wonder supplement. And we've reviewed previously how many of those claims have probably been over exaggerated. However, we still want to keep a keen eye to literature and see if there are areas where vitamin D supplementation seems prudent, seems to make sense, seems to be helpful. Recently, and very excitingly, a landmark study was published where a group of patients, all who had IBS, half of them were given vitamin D, the other half were given placebo. So placebo control is a very good science and the symptoms were tracked over the course of six months. And what the researchers found was that there was a significant impact on symptoms of IBS in the vitamin D supplementation group compared to those who did not receive the vitamin D. And I'll just quote from the study here, over the six month intervention period, a significantly greater improvement in IBS symptoms, such as abdominal pain and distension, flatulence, rumbling, and overall gastrointestinal symptoms was observed in the patients receiving vitamin D as compared to placebo. The only thing that didn't positively change was bowel habit. So if people were constipated or had diarrhea, there didn't seem to be a large impact on their frequency of bowel movements, but all the other symptoms improved. Now these patients were given 50,000 IUs of vitamin D3 every other week. And if you were to take vitamin D orally, this would equate to about 3,500 IUs a day. Most vitamin D supplements contain about 2,000 IUs per capsule or per drop or per pearl or whatever it is. So what we see here is that a very reasonable dose of vitamin D, not a mega dose, nothing crazy. 3,500 IUs a day roughly or 50,000 IUs every other week was enough to have a favorable impact on symptoms in IBS. Now why is this? Perhaps it's the antimicrobial benefits that we see from vitamin D, but potentially it's the immunomodulatory impact that we see from vitamin D. We don't necessarily know exactly why. This study wasn't trying to answer the why, it was trying to answer the question of clinically and very practically, does vitamin D supplementation help with the symptoms of IBS? This study, which was a very well performed study, looking at humans, placebo versus control, clearly showed that there was a benefit for IBS symptoms with vitamin D. So taking a reasonable dose of vitamin D is probably not a bad idea for those that have IBS. It's inexpensive, it's very safe, and as long as you have your vitamin D levels periodically monitored to make sure that you don't become excessive in vitamin D, then I think this is a fairly safe play. Of course, this is just the first study of its kind, at least to my knowledge. So to be very conservative, we'd wanna see this repeated a few more times, but again, this is kind of your gold standard level of science, a placebo controlled trial. So if you're suffering with IBS, a reasonable dose of vitamin D, either 50,000 I use every other week, or we could theorize 3,500 I use every day, has a very good chance to help with your IBS symptoms. So this is Dr. Ruchio, and I hope this information helps you get healthy and get back to your life. Thanks.


Ciao ragazzi, ho disegnato la nuova versione del mio sensor Windows Smart Door e come potete vedere finalmente la consumazione di potenza è perfetta. La consumazione di potenza di questa nuova versione del sensor Smart Door è molto bassa. Ho mescolato l'accurso con il kit di Power Profiler per Nordic e ho notato che l'accurso detectato è sotto il range di mescolazione del profiler. Ho fatto diversi test per verificare l'accurso della data, in ogni caso l'accurso della data, la consumazione è sotto 200nm e questo è un risultato molto buono considerando l'accurso simile a una consumazione di 6-8 micromperi. Ora vuoi sapere come sviluppare questo smart device? Allora ragazzi, cominciamo! Questo progetto è possibile con l'help di PCB Way e sì, questo progetto è sponso da PCB Way. Puoi comprare i vostri PCBs per solo $5. Prendete il link sotto al posto, il vostro primo ordino. Questa serie di video è creata per mostrare che molti smart devices che sono avanti non sono disegnati bene e che solo prende un po' per rendere i loro prodotti migliori. La prima cosa che ho fatto è scegliere un smart device per redesign e ho deciso di redesignare un molto semplice smart door windows sensor. You will understand that this device most of the time is in deep sleep mode, Austin by mode, so, reducing its power consumption during this mode can greatly increase battery life. In deep sleep mode, this device consume an average between 6 and 8 micromperi. By powering this device with 2 AAA battery, the manufacturer claims an average battery life is about 1 and 2 years. Honestly, I don't know if it's true, in particular with Wi-Fi version. My goal is to extend the life of this device even longer, you may wonder why. For only two reasons for now, the first one is to reduce the battery replacement and the second reason is to improve the user experience of this smart device. So using the microcontroller deep sleep mode is not a very good idea because it does not allow us to maximize the power consumption. The only alternative I know is to develop an external power latch to turn on the microcontroller only when needed. In addition, we need to use only components that are easy to find, so not particular complex interesse circuit like TPL by Texas Instrument. In this way, we avoid possible shortage problems. The power latch I need to develop should start the microcontroller only when the signal from the red switch goes from I to L and vice versa. So as you can understand the way it works is different compared to a simple IOT button. So we can't use a classic power latch like this. The new power latch needs to know the previous state of the sensor by comparing it with the current state. So I could use the flip flops to store the previous state, as you can see the solution works. But the problem is to generate the clock signal of the flip flops, which would be require some microampere and extra components. And since our goal is to reduce the power consumption, this solution is not the best for low power application. The operating state of the power latch remind me a true table of a logic gate. And yes, I'm talking about the XOR. After some testing and research, I found a solution to store the bit, the state, the previous state, with true XOR. I found this circuit. The configuration of the XOR in this circuit is very interesting, but not complete from my point of view. I found an open source project on github that used the same circuit. The problem with this solution is the power consumption still remaining too high. This is because the output signal from the logic gates is used to activate the enable of the LDO. Why not use a MOSFET directly? And the wish and current of the LDO consumes some microampere and this is a waste of energy. So starting from this circuit, I designed this. And this is the schematic of the project. In particular I want to show you the power latch. As you can see, the circuit consists of several components. Come puoi vedere, there are even more components than necessary to perform some tests. The circuit is designed to work with different configurations, in particular with different type of batteries, like AAA, alkaline or LiPo battery. Signs I plan to use 2 AAA batteries, I don't even need the LDO. I also added Bosch BME 680 to detect the temperature, humidity and air quality. Allora, the door or window is open and closed. And this is the PCB render. So this version is not as a modular design, as previous version, because I try to simplify the design of the device as much as possible. Now it's time to assemble the first prototypes. As you can see, the quality of the PCB is perfect and also the PCB is only 0.8 mm of thickness. Instead, this is the case I designed for this device. I did not use screws to simplify the design. I printed this case with my 3D printer. If you don't have a 3D printer, I recommend you to try PCBWay new service that for a few dollars you can print your own parts with different materials. Ok guys, this is the final result of this first prototype. I'm very happy of this final result. It's not bad the design. So guys, let's get see in detail the first prototype. I have printed this in PLA plastic white, as you can see. So here we have the magnet with the object's logo. If I, exactly, as you can see the red LED is on and then off. Perfect. I now simulate the open door and closed door. It's work. Perfect. Ok, now I can open the case in this way. So with my finger, perfect. I can open the case. So here we have the 2 AAA batteries. For now they are not alkaline, but it's only for a test. So I can remove the batteries in this way. Ok, to remove this, so the socket of the battery, I can press here and perfect. I can remove this. So here we have the external cover of the product of this device. And here we have the PCBs. After soldering the 2 terminals, 2 battery terminals, I can't remove these PCBs from here, from this plastic. For now it's in this way the design. But if you open all smart door sensor, they are built in this way for this reason. So I can use 2 cables, but in this way the design, the final result is better in my opinion. By the way you can't remove the PCBs easily. So to program this, I use this. As you can see we have 6 plug-up pins. You can find this on Aliexpress or Amazon, I don't know. So after connect the plug-up pin, here we have my serial custom bridge. Serial bridge, so by objects always. So in this way we are ready to program and debug this sensor. It's so easy. Maybe I can improve this, I don't know how. Maybe remove this piece of plastic here. In this way it's more easy to put the plug-up pin, but for now it works. So guys, let's get started with upload the firmware. The firmware I uploaded is a simple test to make sure the hardware is working properly. In the next video I will show you how to integrate this sensor with Amazon AWS IoT Core. I also wanted to show you some measurement I made with my oscilloscope and power provider. As you can see the circuit seems to be working properly. So in conclusion there are many things that can be improved, such as the reset button because now don't work properly. I could improve the design of the project and reduce the size of the device or change the my controller like an RF by Nordic. Below in the description you can find a link to the repo of the project. Please let me know if you like the project. And thank you again to PCBWay for sponsoring this project. And thank you for watching until the end and see you later, next time.


Welcome back to The Breakfast Here on Plus TV Africa. Our final conversation this morning is going to be talking about corruption in Nigeria's pension system. A couple of days ago, the BBC put out an investigative report that was done by Yemisei Degoke and, of course, are produced by Katie Mark, exposing a lot of the issues that Nigerians and pensioners have in Nigeria and have been dealing with for many, many years. This morning we're speaking with the producer of that investigative work, Katie Mark. Good morning. Thanks for joining us. Yes, good morning. Good morning. Thank you for having me. All right. I watched all of the nine minutes of that documentary. It was really, really sad for me. So I want us to start by talking about the whole process, what inspired, what brought about the idea of investigating Nigeria's pension system and how did those things feel for you going through the documentary? You know, we were approached by a reporter from Calaver who told us that his mum was about to retire and she was being asked to pay a bribe. And he felt that this issue was wider. So we asked him to see if we could capture this.  It's money that is legally theirs. He put on, he wore a secret camera and through secret filming we were able to capture him being asked to pay a bribe to get his mum's pension. You know, he was asked to pay three different bribes. And so he approached us and from there we started investigating. We found that there were so many issues in people trying to get their pension.  They paid into this pension. This isn't a favour the government is doing. This is their right. And they paid into the pension scheme and now they can't get it. It was, and to hear these people, you know, having to prove they're alive. Some people have spent years trying to prove their life but to get their money. They've worked hard. They've contributed to this country and now they should be relaxing and instead they are being, you know, struggling to get money that they are owed. So it was, it was, it was really sad. And it's so widespread as well. It's not just, you know, we concentrated on crossover because that's where our budget came from. That's when he asked us to do the investigation. But we found that the issue was happening all over, all over the country. So what are some of the loopholes you found, you know, when you produce this documentary? I want you to especially, you know, talk about the cases of people who were reported dead even though they're alive so they could not get their pension.  Yeah. So the work, the issue of ghost pensioners was a big one. So in, in Cross River when we're doing it, we found hundreds of names that have been put on a list of, they've been declared dead. So now they have to prove they're alive. This involves traveling to, to Calabar from wherever you are on the stage. You know, these are old people. Imagine eight hour bus journeys if you're 80 trying to get to this place. You have to prove you're alive. When they got there, they told us they were like subjected to, to dehumanizing treatment. They were, they were, there was one woman said they were treated as beggars on the street. There was a man that we spoke to that's been there five times, five times. He's old. He's trying to prove he's alive. He hasn't got any money. He's got, doesn't know anybody there. So he's sleeping on the street, you know, he was there for two weeks. Every day they've been told to come back. He was sleeping on the street in Calabar, this old man, having traveled the day and he's done that five times. You know, there's another man that we spoke to that had been a maths and science teacher for a really long time and it's the auditor general there that decides that if they should be verified, you know, this man knew the auditor general. They know, he knows him personally and he still, she still wasn't verifying him according to him. He asked, she asked him to apologize or asked he wouldn't get his pension. Your pension should not be dependent on apologizing to anybody. It is a right that you have, you know. So there were so many ways that, and we couldn't find the reason why this was being done. You know, we asked, we put our, all our claims to the officials that we investigated and none of them responded. Although since this has come out, there's been a bit more reaction and there's been reactions from people. And I think hopefully they'll be able to respond. Has there been any. So many opportunities to explain why they were doing this and they didn't. All right. So two things. Has there been any reaction from the government besides reactions to the documentary? Has there been any reactions from the government itself? And then also when, when they say people are dead, does that money still get paid out to a different person? No, it's just not paid. So, you know, ghost pension, this is a real, it's a real issue in Nigeria. So there are a lot of fictitious names that are put on lists and then someone is collecting that money. But the experts we talked to said this isn't done by people low down. This is normally done by other people high up that they can get away with it, right? And so it is a problem that needs to be fixed. But the real people that are being told their ghost pensioners, most of them are alive and in Cross River, 99% of them were alive. They were just told, there was suddenly one day the pension was stopped and looked on the list.  It's obvious if, you know, we did it in one day, we went to a village where most people in that village have been put on the list of ghost pensioners. In one day, we were able to prove they're alive, you know, back statements, cards. Why is it taking the government years to do what we could do in one day? You know, if that's the case, if they're really trying to verify, then we need a better system that can do that. Reaction to the, you know, reaction from it, there's been so much positive reaction, you know, since it's gone online, because everybody, a lot of people seem to know somebody that this affects, right? And even if you're young, you think it doesn't affect you, it affects everybody, because if it's not working now, it's not going to work for us when we get there. You know, there's so much debt to pensioners to clear it. They need to start doing something about it now.  So why aren't ordinary people getting that money? That, you know, so he told us that like one governor, the pension of one governor could settle the pensions of three to four thousand teachers or something like that.    Some people are getting nine thousand Naira a month as pension. Why can't they pay nine thousand Naira a month, you know, if you can pay hundreds of thousands of Naira for someone that served four years.  All right, so what would you expect to happen next? What do you expect to be, it should be the response after this documentary? We hope to get some sort of, you know, when we were doing it, we tried to get official response, it was hard. But now, since this has come out, we hear that there's going to be a response from across the state government, we hope to get a response from across the state government to explain to these people because we didn't come, they told us these stories, we weren't trying to elicit these stories. We found, we thought, we didn't realize how big it was until we started doing it, so there were so many pensioners that were suffering, they should give us a response, and we gave them so much opportunity, we approached them numerous times to give us a response, so we hope there's a response from them. We hope just that people can see that this is happening, you know, just also just awareness, because now people think it's happening to them, to see that it's happening to a lot of people, that brings awareness, that brings a conversation, and we hope that conversation turns into action, you know. And you also expect the woman who, you know, was filming the video collecting bribes, I think she got 5,000 nair from one of the things that I watched, would you expect a person like that to be fired or to at least be punished for being a part of the corrupt system that is limiting people from getting their pensions? Yeah, so altogether she actually took 21,000 nair because she asked for three separate books, she kept asking, just seeing how far she could push it, right?  If people are getting paid properly, it goes way higher than her, so I don't want it to be like she's a scapegoat and that's what happens, because that's not the problem, if they don't change the system, it doesn't matter if they fire her or not, there'll still be problems in the system, and I don't want it to be like just one individual is being told that she's to blame, it's not like that, it's a problematic system, it's an inefficient and corrupt system that we have for pensions. So now that, you know, we know the scale of the problem, lots of people who are alive, declared dead by the government, being denied their pension, you know, people working in those government offices, collecting bribes from pensioners who are basically suffering. Now that we know, you know, just how serious this situation is, talking about the federal government, not just the state government, what's the expected response? This is the problem, because each, because the states, you know, we've been told for a really long time that the system is going to change, we've had promises from the top, the pensioners are going to be taken care of, they're going to clear the backlog, we know that in 2019, it was something like 400 billion naira was owed to pensioners, right? So they need to step in. And also, you know, recently, we know that they're trying to like invest pensioners' monies and all that kind of thing. So the federal government does need to step in to do something, but obviously we're in a federal system. So each individual state has its responsibility, they can do something individually, whether the federal government steps in or not. I think that, yes, we should hear something from the top, we should hear someone saying this is unacceptable, and something needs to be done about it. But states can start right now to do something like that, they can start cubbing the excessive pensions of governors, you know, and start giving that money to people who worked for the state for the whole time. But I know that they've been promises, and I just hope they come through with those promises, they keep saying they're going to, but we're not seeing any change on the ground. Katie Mark, thank you very much for your time and your thoughts you've shared with us on the breakfast. And this very important issue of, you know, the pensions, scam the pension fraud, and basically the corruption in our pension system. And we do hope, like the government says, that it would do something about it. Thank you so much for having me. All right, have a great day. And I hope it's not a conversation that ends after the, you know, documentary drops, you know, the BBC every now and then carries out these types of investigative work. It's important to see the reaction from the government. It's one of the things that we both asked, what's the reaction from the government? What's the reaction from the people? That's where the change should come from.  Just too many of these people who've dedicated 35, 40 years of their lives to service in Nigeria, both on a local, state and federal levels, that don't deserve to be treated this way. Nobody wants to see an 80-year-old man struggling to fill paper, work for his pension. I mean, in the documentary, it's one of the men, one of the, you know, the pensioners mentioned how he had to withdraw his kids from school because he could not afford the cost of education. So the government doesn't have to do something. And how much is it really? Nine thousand. These pensions that we're talking about. I mean, how much, even if it's a hundred thousand, even if it's 60,000 nair, how much is it really that Nigeria cannot afford? You know, and where does the money go to when you write off people and declare them as dead? You know, where does the money then go to? Even if you write them as dead, no efforts to reach out to the next of kin because they should be able to receive some form of benefit. And like she said, it's a system that is flawed and it's a bad system that needs to be fixed. Yes, that woman doesn't need to suffer for the use of it, but she needs to be fired also if she's collecting money from people. How many people have she collected that bribe? She said, you're coming to a shrine, so you have to be an offering. Yes. So how many, let's now imagine how many people she's collected bribe from just to get their pension. She's going to retire someday, so she should be fired. Let her understand the gravity of the crowd. But you know what? She learned that from people she met there in the office. So since those ones weren't caught, she should be fired. So the person who takes over her position understands why she was fired. And yes, it may not fix the rotten whole system, but she shouldn't go home and give that $5,000 to her husband. But I doubt they would fire her because, you know, these people are involved in this. I probably need to cut out that part of the documentary and just post it by myself, just to ensure that she gets more publicity and she's fired.  And you're giving a Nigerian worker who's also earning salary from government, giving her $21,000 so that she can process your papers. Has she actually gotten her salary in the past three months? That's another question we need to ask. She should be jailed. But anyway, that's actually private because she should be jailed, not just fired. Why not join in on the conversation? Well, on Plus TV Africa, Facebook, Twitter, Instagram, everywhere you go, find us, watch replays on all our social media platforms as well, and on our YouTube channel at Plus TV Africa. And please follow our new YouTube channel at Plus TV Africa Lifestyle. I am Annetta Felix. And I am Osaugi Ogbonwan. We wish you a beautiful Tuesday ahead. See you tomorrow. And take it easy.


Hi everyone, Joe for jashpeascasebrakes.com coming at you with 2020-2021 Panini Donnery's Basketball Hoppy Pack Break number Jordan, number 23. At the end of the break, we're giving away nine opulence basketball spots, so that's pretty cool. But first, the break. Big thanks everybody here for getting in on the action. There's all 30 teams in. Let's roll it. Let's randomize names and teams five into two seven times. Different dice roll for the giveaway. One, two, three, four, five, six, and seventh and final time. Five into two makes seven. Five into two, seven times for the teams. After seven times, we've got the Mavericks down to the Jazz. All right, so there's the first half of the list right there. There's Josh with the Timberwolves, and Jake Kirby with Charlie. It's just a little hobby pack, but you never know. No trade windows in these filler breaks or these giveaway breaks, whatever you want to call them. Let's print. This is the right pack, right? 30 cards. Yeah, 30 cards for the pack. Here's the final printout right there just real quick. We'll re-randomize that list a little bit later. There's KCP. Hopefully he's healthy.  It's going to be a tough game for the Lakers, for my Lakers. Got a blank card here. We got a Kendrick Nunn to 349. That's for Miami. That'll be for her, Vang. We got Marvels, James Harden. We've got Crunchtime, Trey Young. Craftsman, John Morant. That's Patrick Williams. Ooh, thought that was going to be Lamello for a second. Patrick Williams, pretty solid. That'll go to Josh and the Bulls. I think people like, love these inserts too. That Craftsman insert for Roy and the Grizzlies. Is this a good time to get Trey Young? Crunchtime? Moving on in the playoffs, Josh with the Hawks. This is Rocket's edition of James Harden as well. Lamello's or Anthony Edwards in there, anything like that. But the whole point of this is to try to win those opulent spots. You can win an expensive spot for a fraction of the price. There's some new dice. There's a new list. And let's roll it and randomize it three into three six times. So it's going to be the top nine after sixth the hard way. One, two, three, four, five. And good luck, sixth and final time. Now from ten on down, sad times. Nicholas, sorry. Very close, no cigar though. Thanks everyone for giving this a shot. Happy times for the top nine. Per, Kaim, Josh, Terry, Terry, Nicholas, Josh, Daniel and David. Congrats to all of you.  After watching live, we've got to do one more of these filler packs. We've got to sell some spots straight up. But if we get built to momentum, we'll be in Breaksville before you know it. I'm Joe. I'll see you next time for the next break. Bye-bye.