Hi everyone, Joe for jaskiescasebreaks.com coming at you with 2019-2020 Panini Contenders Optic Basketball 2-Box Picker Team number 7, T-Mall Edition. That's a big e-commerce site in China. It's exclusive that Panini did for them Pretty cool stuff. Also, if you bought two teams, you get an entry for a chance at the Pelicans Now the red waves are exclusive to the set, but they're a little more common. The gold waves So the autographs are not super common here, but the gold wave is really Is really what we're looking for so You want to put the heat on? Yeah, okay go for it. I guess Teddy's cold All right, Alan with a spot with two teams gets an entry Arthur with two teams. That's an entry Bill Billy with two teams. That's an entry Eric with two teams. That's an entry Gabe with two teams. That's an entry Johnny to team Sky with two teams Instagram tree so sky Rosario, Pat. Just spot checking here. Alright, there you go. Let's copy all those names here. Let's put it right here. Let's roll it and randomize it. Three and a five, eight times. Name on top gets the Pelicans in this two box break. After eight. One, two, and eighth and final time. It's Eric K. There you go, Eric. After eight, you get the Pelicans in this two box break. Good luck. I wonder if these two boxes will cooperate with you. I don't know what's come out of the previous boxes, but we're about to find out. Look at this. Look at this toner scam. I got a little pop-up on my computer saying the toner is empty. 0% toner. Allegedly. Does this look like 0% toner to you? Now maybe it's an early warning system. That's possible, but they should say so and not be like, I mean, 0% should mean like, I've got no toner in there. That's how they get you to buy. It's how big toner gets you to buy more toner, folks. Follow the money, ladies and gentlemen. See what big toner is doing out there.  That's what it is. You're right, Kyle. Alright.  He is a Superstar, isn't he? Alright. Not number, but these are pretty nice. There's Kobe White for the Bulls. That'll be for Matthew. Oh, I think I see some gold down there. There's Joel MB for the Sixers. Billy. Behind Kenba is the Red Wave. Julius Randall. He sure is, Sam. There's Julius Randall. Red Wave and the Gold Wave behind Kenba is Rudy Gaubert. You taught Jazz. Matt Lieber with that one. Yeah, I did see, I did see the Lakers getting Trezz. Turns out Rob Polinka kind of, kind of knows what he's doing. So far, so good. Alright. Next box.  Going back to Baxus. It's possible. Yeah, it is possible. I mean, the West is still tough. We still haven't seen all the dust settle with all the player movement. Gabe with the Celtics. Let's see what we've got here behind Wendell Cart. Nice, Luka Donchich. Even these second year Luka Donchiches can do pretty well in the secondary market. Any more top loaders? Alright, Dallas. That'll be for Matt Lieber. I mean, has Dallas made moves yet? If they have a healthy Porzingis, they add some pieces. That could be dangerous team. Al Horford. Philadelphia's got him on the move. Red Wave for Billy and the Sixers. And Wendell Carter Jr. reveals a Hassan Whiteside for the Portland Trail Blazers. Arthur with the Trail Blazers. I mean, it's got to click one of these days for the for the Trail Blazers too, right? They've got too much talent on that team. That goes to Portland. That's for Arthur. I and that's Wendell Carter Jr. for the Bulls. And that's for Matthew Sheara. And that is that, ladies and gentlemen, the Gold Wave Hunt continues in these Team All Boxes. Thanks everyone for getting into the action. Really appreciate it. I'm Joe. I'll see you next time for the next break. Bye-bye.


to MCH 2022, the four-intent battery, you probably know that battery, I mean, battery. No, we are not talking about batteries, but battery-powered cars. So here with me on stage is Martin Herfoot to talk to you about demystifying Tesla's Bluetooth passive entry system. Please give him a very warm round of applause. Thank you very much for the introduction, and thanks you for being here. I'm talking about Project Temper today, and this is, as you can see here, about Tesla cars. It's the fourth time that I'm giving this talk, but actually I was adding quite some new stuff as well. Every time I did it, I tried to make an effort and add some new things. Right. So about Tri-Fonite Org, you might have seen the logo in the lower, right? It's a group logo that is almost pretty retro already, because that was 18 years ago when we started, together with, or more than that, together with Colin Mulliner and me, and we did a lot of Bluetooth-related research. Back then, of course, mainly Bluetooth Classic, and we were participating in some test events with the Bluetooth SIG, which is the standardization body for the Bluetooth protocol, and we were helping vendors back then with their smart phones, not smart phones, but their feature phones and Symbian phones, stuff like that, in order to have, like, not the easy low-hanging Bluetooth vulnerabilities. So, and about me, I'm from Salzburg, Austria, pretty much like the Herald. He's not from Salzburg, though. He's from Vienna, and I'm a regular participant and also speaker at some instances at C3 in Germany, so which is the yearly CCC Congress since 1998, without missing even one. And I also am the author of the Tesla Radar app, which I will talk a little bit about later. And, of course, I own the Tesla myself because always renting or having to rent one in order to do tests just didn't work out for me. And a little bit of memory lane. My first camp that I participated was actually in 2005. It was what the heck? It was in Linde, also in the Netherlands, and I found a picture of me talking, like, in one of the old Flickr accounts that is still linked up in the page, and as you can tell, no difference, right? And back then I was talking not only about Bluetooth security and stuff we found. One of the projects I was talking about back then was also Car Whisperer, my first project that went into the automotive direction and what I did there, we were injecting audio messages into cars with hand presets and there was a lot of fun. That was possible back then because of standard pin everybody used. So it got a little more complicated with Teslas. They use obviously not a standard four-digit passkey in order to unlock the car. They do it for driving though, as you might know. Maybe as a show of hands, how many of you do have a Tesla or drive a Tesla? All right, so that's like 500% more than usual because usually it's just one guy, me. All right, but that's at least some more, that's cool. And this talk is about telling you why you should be really careful using the Tesla phone as a key and also like the NFC. Some of the things have been mitigated but Project Tempo was investigating the Bluetooth Low Energy Interface that Tesla has in their cars. And this interface that I'm talking about is primarily found in all Tesla Model 3 and Y but also on the new facelift variants of Model S and X. So it turned out that this phone key feature which got introduced with Tesla Model 3 turned out to be a quite popular thing and I believe it's also gonna be in the road still whenever this appears and it's like the thing that Tesla puts all their effort on and it's just an estimation that about two million cars to date do have that feature. And what it also allows is not unlocking the car or like driving it, it's also like having a continuous ID so tracking and identifying vehicles on the radio level is pretty easy. And also you can like send messages there and how you do that I'm gonna show you. So most or not most some of the things have been fixed by Tesla over the time some of them partially. So I talk about one thing that got mitigated but kind of reopened by one of the attacks I'm going to show today. And all the or most the things are findings that came from reverse engineering the official Tesla app which is an easy process as you might know the only thing is of course they use obfuscation so you have a lot of guesswork as well. So the original research started with Tesla radar in 19 but it intensified in 2021 when playing a little more with the app and looking into that communication. All right phone key, what is it? It's like the big innovation that they had you use your phone as your car key and that's a pretty good idea and as said it's gonna be part of future models. So what's like the ways to unlock a Tesla? Of course you guys that own a Tesla already know that but for the ones that don't I explained that in a short slide here. So you have like your phone which is pretty capable of using like the network based API which you require to have internet for. Then it's the NFC protocol which is in purple here which is used for directly interacting with the car and then you have Bluetooth with kind of in the middle and as said here VCSEC is the protocol which is spoken from the phone and also from the key fob via Bluetooth Low Energy to your car. All right NFC card, these are the ways you can read that later on to unlock I just summarized that here a little bit and due to timely constraints I'm also not gonna show the videos which I have like linked in the presentation and that's gonna be your homework to show afterwards but to watch afterwards.  Like with the key fob, with the phone key or with the NFC card? Show of hands like key fob, one, two, three and with the phone key, one, two, three, four, said Ray, all right and with the NFC card still one, one, all right, good. So that was the official result from the Tesla from the Twitter poll I did so like 83% back then are using phone key including myself, I do own a key fob though which costs a fortune for I think what it is and right, phone key is the thing the most people use. Usually how does that work? The smartphone finds the vehicle that has some indicators that show that this is the right vehicle to talk to and it connects because the car would act as a BLE peripheral implementing a generic attribute service that you can interact with and there's no pairing required and this has also some background maybe why this is not required and of course you can unlock your car, you can start, you can open the front do stuff like that. So whenever this car advertises a gut service there will be a name, like a standard attribute or a service and also a two-vehicle characteristic and a front vehicle characteristic and then pretty much also is very intuitive what's gonna be done with these characteristics I guess. As well it's exposing an IB constructor and I think that's mainly done in order to have iPhones natively detect the car with all that background process optimization I think they built that in because Apple makes it really hard to have a background process that does not rely on Apple technology. Yeah and the advertisement is like pretty easy to find out so there's this UUID and then they have a major and minor ID which is part of the IB and specification and these are like the attributes that an iPhone along with the device address of the car would recognize the car for it to be connected. And as well the name of the vehicle has some cryptic input or in cryptic stuff, right? So whoever scans for BLE devices next to a Tesla will find a few of like these names starting with an S and then there's an eight bytes hex sequence, hex encoded sequence ending with a C in the most case. I guess most of you found that already. So C I believe stands for the center interface then we have a driver side, passenger side and the rear side but these names are guessed because like passenger side on the right hand drive would be the driver side so I think they kind of messed up there already. So but the thing, the eight bytes in the hex seemed random to me at first and they seem to be unique to a vehicle and they are always turned on and unique to the vehicle and that kind of led to the thing with the permanent ID so anybody with a phone could tell whether my car is in the proximity of Bluetooth or not. Which is a privacy issue which I pointed out in 2019 to Tesla and that's also when I published the Tesla radar app which is a showcase for how easy it would be to spot a Tesla over a larger area given that there's enough people with the Bluetooth phone participating in the Tesla radar ecosystem. And in a way it is allowing to stalk people, right? And even though the Apple AirTag implements way more security and privacy features in their AirTag technology so they randomize their IDs they are really hard to really track and reliably track but even this caused a massive outcry in the privacy community that this is not a thing that they should do. Of course, slipping a Tesla into somebody's purse is hard but that would be the maybe the reason that Tesla permanent ID never got that of an issue. So I had a correspondence with Tesla and they said, well, we know that is the case but we don't change it because as long as there's cameras everywhere that also film your number plate we don't see a reason of changing anything there. So I think that was the reason when I made that app public and kind of show how big of a thing that could be. And first it was for showcasing privacy issues then it was a game for Tesla fans so there's some gamification in there there's a ranking actually Thomas right here in the second row is like the number one Tesla spotter for a long, long, long time. And yeah, I'll give him a... And I don't know how many 10,000s of Teslas you spotted but you're like the number one spotter even though you're not on that ranking list anymore because you're super observers currently under maintenance right? But very good work. And of course it's a big data collection for work. I think there's a statistic from May and there was about 154 unique cars in the network from about 50 in the meantime 50 different countries. So there's a lot of players and if you found this interesting I have to say at the moment I'm having technical issues with the app so just allow it communicating on wifi please if you wanna use it because it kind of retransmit a lot and causes a lot of and I have to find out about that. So but back to the thing with the eight characters that are hex encoded or eight bytes that are hex encoded and of course it's unique to the vehicle and the win would also be like the vehicle identification number is also a thing that is unique to vehicle. So it encodes a manufacturer ID, a model type and so on and that is hashed I found out hashed with a char one and then they cut out like the they butcher it up and say only the eight bytes are taken for the vehicle identification. So it's really hard to reverse that process since it's a cryptographic hash right so what I did is creating a rather small rainbow table of about 20 gigabytes and it has a pretty high hit rate so I can track back from that eight bytes hex encode I can see what the win is and can also see what the model would be of that kind of identifier. I also could find out like if it's a performance model or worth stealing if I'm behind a locked garage door so it's a pretty high hit rate at the moment I will have to add new wins to the index so the Austin Gigafactory has a different signature I would have to add that I didn't even do that now but there's a little room for improvement but it works rather well and also what I did at Christmas when I found out of that key win or like this win reversing thing I thought it would be interesting to take my new tripod and mount an antenna on top and put it in my car so the side pocket of the Model 3 is ideal for doing that so I put that with the antenna and went through whole Germany to the Gigafactory 4 and because I'm in Salzburg which is way down there and I drove along where the new battery factory is going to be and also Gigafactory 4 and there's a highway and always aiming my antenna inwards to the premises and what I found there was a lot of research prototypes and you would know from the win they do have an R which is interesting but also was interesting there was a lot of BLE like car jacking devices things that could be when you tamper with them pretty dangerous for the people working there but as everybody knows Tesla doesn't care there's a lot of people working there, right? So, and actually this is a video that got presented in May and it's been a similar video two days earlier so that's part of your homework you have to watch that several times for the YouTube algorithm please and it's about how you would pull off the relay attack I will talk about that a little later and also there being able to do a relay kind of triggered me and said that's too easy, right? I contacted the Bug Bounty team at Tesla again and told them that I believe this is an issue because what really happened I tried that the first day and I had like this two raspberry pies connected and I had one in the car trunk and one in my office and I was able to just drive around as long as in the office my phone was close to that relay I was able to drive to Salzburg like 20 kilometers away I always had my key card with me because I just as a fallback solution just to be able to drive it without the phone but the thing was that was too easy because it was a get-tack-a-set-up with two raspberry pies like really, really cheap and Tesla says yeah it's a known limitation of the protocol but in order to be safe please use pin to drive which is a four-digit numerical pin that you would have to enter before you are able to drive the car which does not really mitigate the risk of being robbed there's also a lot of stuff in the car which is unsafe in the end, right? but also I had a similar attack and also I tried to present that at Pound2Own and they said no it's out of scope because it's not too binary or it's like you have to have a key for that and we don't even have that I was interested then so what are the security features that you have enabled in your car? is it one, none? is it two, sentry mode? is it three, pin to drive? or is it four, both? so one, none who has none, do you have none of these features? all right, two sentry mode, who's using that? all right, one and who's using pin to drive? one, two, yeah, quite some and both, sentry mode and pin to drive all right, so that's a little bit of a trick question because Twitter only allows one answer so combining the lower two showed that only one third is protecting the car with pin to drive that means like in many cases attackers would be able to drive your car away just by doing a relay and for some reason sometimes this other Raspberry Pi on the picture disappears it's Liebherr office, I don't know why that is but that was the setup for the thing so to the left side you see the phone then you see the Raspberry Pi number one which is running Gattaker on the right hand side there would have been the other Raspberry Pi also with a Bluetooth dongle and talking to the car, right? Gattaker allows you to see all the messages flying by there like hacks and coded bytes stuff, right, which didn't make a lot of sense but you could intercept that and you could also inspect that and inject that and you could do some on real-time modification of the stuff you see but it started making sense when I was digging a little into that and I said there's these characteristics and can pretty much tell that this one is like in direction of the car and the other one comes from the car but what really turned out to be happening there there was a protocol and that's the VCSEC protocol and that's a protobuf based protocol and you found it's easy to have found like indications that this is used for that and it's used for phone key, key fob for the tire pressure subsystem maybe for backend communication because there's some messages in there that would imply that and also maybe for other use cases so it started in app version 335 and you have to see that the official Tesla app is for a lot of more products than just for the Model 3 so that's why it's not version 1 so they use it for the power wall they use it for S and X and older models of the car and also now for the Model 3 and Y that have that phone key feature and that why this has just been introduced in April 2018 and as said this protobuf file which is like a description of the protocol was really easy to instruct with the PBTK tool in the beginning but they made that a little bit harder with version 4 when they switched library to wire which is also the same kind of protobuf implementation but just by another vendor and different regime because protobuf is Google and it has a very similar output and I'm going to show you a little more of these messages soon so as said this is the history so I just took like one protocol file of each version and you see there's quite some growth over time at the moment I think this is not even up to date anymore so it's been two months or two and a half months since there 77 messages, 45 enums which I graphed out on this really small, small, small image the blue things are the things that are referenced in the code on the Android app because that was easy to find out so what's actually active code use and these of course were the interesting bits to look at and also like if you see and that's like the first example here you see like with the green prefix this is the length of the thing coming and it's not easy just to modify the length and do some buffer overflow so this is optional, right but there, from there on, the message is encoded and having that protocol that you were able to extract and now is also like available in the VCSEC archive on GitHub you can decode that message with the product tool and what's happening is like one of the easiest requests is to see what are the whitest keys in that vehicle and that's an information request and you do not have to be authenticated for that it tells you all the key IDs and you could also get the public keys of the enrolled keys which is not a big deal because it's a public key half but what's interesting to have seen is that there is a service key in every vehicle you can use it and it looks like from the signature as if it was an NFC key and this NFC key has a public key that did not change a lot so I think for years and years they're using the same service key which makes it a little bit of a risk that once one of these service keys surface is on eBay this is gonna be a problem but this is not what we are talking about so we have like also NFC keys the ones that you get as an owner these are looking like that they do not have a crypto counter the phone key does have a crypto counter is a rolling key thing and that has to do with being able to have the passive unlock functions enabled so like without touching your phone you would be able to enter the car like in any other keyless systems and that's what a key fob would look like on that level of course these white list entries are connected with roles that imply permissions and the service key would have all of the permissions all the nine permissions that are defined in the protocol are given to the service key makes a lot of sense and usually as a phone you just have four of those it would be the local drive local unlock lock and the remote unlock and remote drive the NFC cards also have the permissions of adding stuff to the white list because it's necessary once you have that NFC card you use it in order to white list your key and there's a message type from VCSEC which is pretty comprehensive because it contains all the kind of sub message types that are possible to be sent from the car to your phone and of course there's also like one of the most common examples you see authentication request here that's whenever you pull the handle it's from VCSEC and you message to your phone and you would have to answer it correctly for the car to unlock and also there's like a command status a vehicle status where it tells you whether it's locked or unlocked stuff like that and then the other side of the spectrum you have the two VCSEC message which embeds all kind of stuff so unsigned messages come also in a few different things and these are used for messages without a direct security context but are also used in order to encapsulate messages in a signed message that do have a security context and that's some assigned message there and as the name implies you've got to have cryptographic keys in order to do that and VCSEC uses asymmetric keys based on the elliptic curve cryptography key pairs and that's like the open SSL command in order to generate a key for that yourself and what then happens once you whitelist that key and you know the protocol you would have to tap your NFC card but then a shared secret is derived via the Tiffy-Hellman key protocol and then you can use your key with the car once it's the whitelisted and send signed messages to it so that was a lot of guesswork but I finally got that working and the crypto algorithm used for the whole process is the Galois counter mode with associated data it's best known from SSH because it's a really stable implementation it's really secure and it's a very good match for the use case it implements a rolling code so you have the crypto counter that always has to increase and then you have additional data which is used as a challenge response for the passive entry functions and it's intending to prevent replay attacks of course also the rolling code there's some differences though the shared secret is 16 octets but the invocation counter or the crypto counter for the GCM usually is eight bytes Tesla is using four bytes for that and that's also making sense because eight bytes if you see like every keystroke with SSH needs a next value and here like every signed message that you send to the car is like one counter up so it's like four bytes is already a lot for that right and there's different signature types that also become important later on so you have like ones of the GCM with and without a token or like the present key also as a signing message there's like different actions I don't go too much into detail here you can read that on the slides which are online already and also like in the VCSEC protocol archive different things signed message example you see there's a proto buff message as bytes encoded in here then you see the signature type it has there's the signature key ID things for the car to verify the phone I'm talking to possesses the secret key that I do know the public key of what can you do with that since unrestricted requests include that you can enumerate the keys you can see how many keys are enrolled for this device for this vehicle how many Apple, how many Android devices are there how many NFCs you can find out about that and the process of white listing a key just requires you to have like that NFC card and usually you log into your Tesla account so that's what the official app is doing and since you have like access to the owner API with your login you get a token you get the VIN identifiers for all the cars that you are permitted to lock and unlock and finally your app goes ahead and finds the vehicle and begins the white listing process it would send an information request and get like the public key of the car receives that and also then sends information requests to get the list of white listed keys then it tries or it asks the owner to tap the key card and then with that authorization on the B pillar or a flasker blade in the middle this car is getting in the car finally the phone asks again show me again the white list of keys and once this key is on there the process is done and there you go with the authorization timer attack so out of convenience Tesla decided in August last year that it would be really great if I was if I was like as a car owner tapping the NFC card would get in the car it would be so great for the owners using the NFC card just to be able to drive without any further action without any further key card action right so what they introduced was the authorization timer 130 seconds that do not require an extra tap for that bad news because during this time frame attackers were able to also enroll their own key in your vehicle without you really noticing it right there was no indication on the screen and actually there's also a presentation in that video it's also linked on the Trifonite page also homework please watch it several times and give it a thumb and this is about the staged thing where you can also force a user to use the NFC card because usually if you do have a phone you won't bother using your NFC card but there's some situations where you in the easiest case just use a 2.4 gigahertz jamming jamming device and would just jam the frequency and the phone would disconnect and in order to get into the car you would have to use your NFC card for tapping it and there you go the authorization timer attack would have become possible and owning a key on the device does allow you to lock and unlock the vehicle and to drive the vehicle but that's also when Tesla said yeah use pin to drive so people with the key cannot drive your car they can rob everything from interior but not driving because you have to enter that four digit key and that's when I did another video that shows how easy it is to bypass this pin entry just by sending that remote drive command to the car which was intended to be used in the summon feature where you can say like in the parking lot please car back out of that really narrow space because I want to get into that and this pin to drive dialog just disappears when you send that command so Tesla was not really happy about that information getting into public but red and then there's something else which is fun to play with Tesla has a really broken trust model so I put in here Cartman there you know that and it's like that cars, the Tesla car always would say respect our tarot car and would not even ask that are so every message that is sent from the car to the phone is trusted by default so the car never has to prove to the phone that it's really the car so this is an issue the other way around of course the phone would always have to prove by signing a message it would have to prove I'm the real device but not vice versa and of course that's like the next step was how to emulate a car so the phones will talk to me instead of the car and of course you would have to expose an IEP construction like the car also would do and then it was a little bit tricky because you would use the extended inquiry format in order to the extended inquiry response which is not easy to do with the blue Zee bus API which I was first trying to use there I ended up using Python library which is able to do that and there you go and you can look like that Tesla car and you also would have to use a BD address and set your Bluetooth address accordingly but once you did that any phone would talk to you thinking you're the car and since you never have to prove you are the car you can tell it bullshit like hey your key is not valid anymore so once the phone would connect I would say please send me an authorization and the phone would go ahead send that authorization next thing happening the car says sorry you're not on the list it's like a bouncer at the disco right and the phone would go ahead and say show me the guest list I'm sure I'm on there and the bouncer would go see it's an almost empty guest list you're not there and then the phone is convinced and says right I dropped the key and I say goodbye I don't bother you anymore and that's how the key drop attack works users locked out would have to use the NFC card in order to get back into the car which opens that window of that authorization attack where attackers could put their key in the car right again it's like a little tricky so be careful when having like issues like that but turned out that the key that was stored in the device in your phone was not really deleted so it was dropped but it was not really deleted that means next time you talk to the car it would be clear in a short time that the car knows the key and your phone still knows the key so it's kind of a soft restoration and not a full key enrollment so again this could be attacked by oh there's a small demo I will skip that this just shows how the tool works in order to drop the key of a car put it easy here with the evil bit this is not anymore in the current version so it's like a little different naming there but you see how you present that car with that almost empty guest list in a way and the phone just disconnects so but there's a new attack as well and that's new for this conference here it's the crypto counter confusion attack and the thing is that you cannot only tell the phone that you're not on the guest list sorry you could also say well that crypto counter you used is a little bit smaller than expected I could make up an analogy story for that shorter than smaller than expected I don't do that so the phone key will ask and when you tell it right so this crypto value is too little too small because it's not allowed to roll back that counter for a reason and Tesla is really strict with that and does not allow the crypto counter to be lower than last time because of replay attacks and of course there's also confusion going on so the phone app will ask the car so all right it's smaller value as you expected so what is the value that I should use in order to send you signed messages and the phone, the vehicle or the fake vehicle would say well how about 4.2 billion and that works right you can set all the 32 bit value to the maximum and that is putting also some trouble onto the owners because as you know the key is not deleted even when you say in the app all right I delete the key, re-enroll it it's still in there and the counter is still that high so usually the owner would have to reinstall the app in order to get rid of that old key and being able to enroll a new key for that same car and if you combine that with the key drop attack this is even faster so it really is a mess at the moment so the state model of the car just do not play very well with that and it's funny to have seen that the iOS app allows a maximum value of 4.29 and unsigned in 32 but the Android app is using a signed in for that verification so just half of the value is allowed as a maximum value to tell the phone to be using the next time and what's happening if it's at the highest value so the counter cannot be increased anymore so the phone is no longer able to send signed messages it's pretty much useless for that purpose but if you have, if you really reinstall the app reinstall that, have a new key enrolled with the white listing process of course you expose yourself there again but also if there's two devices with the exact same name which usually doesn't happen in Teslas when you enroll keys I observed that every time I unlocked the car with my new key which has the same name there seems to be some security mechanism to be kicking in because what the car then does is for some reason it asks me to tap my NFC card on the B-pillar in order to drive there you go, key injection again so this is opening up again that vector that every time the owner gets in the car and wants to drive has to tap the NFC card the attacker could enroll a new key again so this is not good in a way and this is another example for a message here it's when the car wants to know like about the current counter value so where the temporary tool would say it's like 4.2 billion what else does it tell you? it tells you about the token which is used for that passive entry a passive entry thing so as said earlier passive entry is relying on a challenge response scheme so it would ask for authorization at the car the car would then reply back with the correct counter number and also with the challenge which is in the token here built into the answer so that means whenever the car asks me to do the passive entry the phone would use that, encrypt the answer so there you go, challenge response and of course this relies or this process relies not only on the counter being increasing but also about the token being changed very often because once this token is not changing you can just take that and be offline and be the evil car again and ask the car for authorization responses and that's what the authorization replay attack or authorization response extraction attack does it's just that so you get that token from the vehicle and then you go to a restaurant wherever this owner sits or in the airport and you ask and you just pretend to be the car again and you keep asking the phone for authorization responses with that token that you have in the car because it turned out it doesn't change over days so it's really a long time same token pretty bad and then what you do you collect these authorization responses via the temporary tool a temporary tool and then you dispense it with the temporary tool both these tools are on GitHub by the way so that's how easy that would work and that's been it for the new attacks and of course there's some tools and resources on GitHub during the talk I was mentioning the VCSEC archive a collection of all the protocols extracted so far there's like the temporary tool where you temporarily impersonate a tester and do like stuff like the key drop attack and the crypto counter attack and you can also see like the message you receive encoded like to human readable form so it's pretty neat maybe if you need help just contact me and of course the other side the VCSEC client would be the temporary tool and you use that in order to send messages to the car that you craft yourself there's also some authorization collection mode implemented in the newest version we just dump the authorization responses to a file that you or that you read from a file and just dispense them from there and there's this VCSEC archive which also comes with a decode script that help you read the messages that you receive and there's also that tool which is basically a wrapper for the API that I made public on Rapid API where you can put these eight hacks encoded bytes to and it would spit out a win maybe also the model for sure but the win is a premium feature and last but not least there is an app which is planned I plan to program that it's like 80% ready it's called Tesla key and it doesn't talk to strangers because root of all evil if you may agree or not is that the official app talks to anybody also at moments when this is not even possible so like why should my phone open the car when I'm not even close to it question number one question number two why should it that be at three o'clock in the morning when my phone is on the charger and in the home network or why should it talk back to a legit car when it's when it's booked into the office network so like a lot of possibilities key checks which are pretty easy to implement actually and these will be part of the Tesla key app which you can follow on Twitter in order to get informed so it's still I think I put some much pressure on me saying that this is released in Q3 of 2022 but I'm not losing the hope right so conclusions relay attacks are possible NFC key cards are dangerous and the app should be improved in many many parts right and also the VCSEC does not stand for Vehicle Control Security as many and I did assume I was hoping it stands for security it stands for Vehicle Control Secondary which explains a lot by the way and again we see that here in that use case also convenience like the 132nd counter the inability to switch off the permanent ID things like that are like really bad for security again so you might ask yourself so we were talking about the NFC card and also the phone as a key what about the key far so the key far was a little bit special I found out I got one as said but it's not talking to me so I don't know what I'm doing wrong I'm always nice I'm getting I got it a new battery even and doesn't really want to talk to me but I'm on that and working on that also some credits there is very similar work by a guy called Lex in Ireland big credit to him because we got in touch and turns out he's an amazing guy also to the maker of Gattaker Sandeep who did the Noble Blino framework which Gattak is using and also to Josh Belder who helped me with knowing about that remote drive in the command that makes the pin to drive dialogue disappear so you might think well I got that implant in my hand for starting my car is it too late and the answer is no it's not too late you can chop off your hand anytime or you just know the protocol and delete it from the white list right also possible whatever convenes so thanks for your attention I think we have like three minutes left for Q&A and also here there's a lot of links that you can follow in order to see the slides to to get in touch with me to fund my research on Patreon all there thanks very much for your attention we actually got four minutes for Q&A so please queue up at the microphones in the middle if you keep your questions short and the answers as well we can fit everybody in and I think there's also a little surprise maybe for for quick and short questions there might be a surprise in it for you so please usually I have motor balls with me but it's too hot for that now there's stickers Tesla radar stickers and every questioner gets one and you also find them on the sticker table so if you don't want to ask a question all right questions please don't be afraid all right so maybe we have some time for demo no just kidding thanks for the talk a short question can you make a very easy automation that just turns off your Bluetooth when it's on the charger and it's after a certain time and turns it on again automatically in the morning that would mitigate a whole lot with a whole lot of that effort it would be possible to mitigate a lot but usually people are really used to using Bluetooth because of the smartwatch they have things like that it would be inconvenient to disable Bluetooth and for everything what I would like to see is a little switch in the app right temporarily disabled that would help a lot as well it is what I do my Bluetooth turns off at 10 o'clock at night and on again at 7 in the morning makes a lot of sense have your sticker it's a special one I sign it for you later all right any more questions there's one more please close to the microphone first of all great talk did you take a look at the implementation of BLE and especially the proximity implementation of the protocol itself yes actually they is still on there this is an interesting message I because there was too many messages in the presentation already so this is about an alert that you get or that I got when the signal strength or the proximity was wrong the readout for all the sensors was too high actually this is not the there you go so we have an alert there and it shows that the readout of all the RSS eyes was too high for this to be a real unlock event so there's something to it but I think it's not security related it's just for the upcoming roadster that does not have door handles anymore so you get there with your key and the right door opens I think that's what this is for and this was just a confusion that turned out to be generating that alert so there is something about proximity maybe we talk about later a little bit more if you like I will be around yeah sure yeah I read somewhere online that the BLE implementation was it would also be a good mitigation I'm able to fit the last one in if it's a short question and a short answer I will try my best I have two short questions don't they use measurements of time to reply to mitigate replay attack and the modern car keys use an accelerometer so if you don't have your car moving your key moving it doesn't work can they two very good questions I do my best to be really short in the answer the first question is like time of flight how long is the delay Tesla and the protocol is very generous with that so it's like about more than 100 milliseconds maybe 200 in order to also have like old phones being able to play the game right they have to be really generous there and that also played out very well with using a VPN which also introduces delay second question was ah what was that can't we disable the unlocking if we don't detect the oh the movement so it's in the protocol already so the phone may tell the car well I've been moving so I have movement good the car would then decide whether it would allow unlock but the thing is this message from the phone I'm moving is an unsigned message so you can inject that and the overall decision is taken by the car right so it's like a stupid approach again and on that bombshell I will end this talk please give a very warm applause to Martin Hefford


Welcome to the weather forecast for the week beginning Wednesday September 21st. We are racing through September This is chief meteorologist John insworth for Longmont Public Media Sunday September 25th will be our new moon with just a little bit visible Because it's not eclipsing the Sun Speaking of the Sun we have a lot of some spot activity in the southern hemisphere at this time Not sure what's going on the backside, but these are some good good things that could create some aurora and like that Higher latitudes. I think we actually had a aurora last week down to Wyoming Server was a surprise to heliophysicists First day of fall hits Thursday September 22nd 7 o'clock 4 p.m. Mountain time Meteorological fall begins September 1st, but this year I didn't feel like that a lot We were so hit in 90 pretty easily We're up to yesterday, but The cool air has arrived right in time to match astronomical fall beginning nothing changed in the drought between Last week and this week except the exact placement of my Longmont pink dot So nothing changed there, but nationally there's a little less drought to our south and a little less drought out Nevada a little more in California But it is cooling off me are getting water now So right along my 25 not much happened I got some light sprinkles in like that the western slopes got a moderate amount of water and had some activity out on the eastern Plains against severe weather as it expands and Peaks around the end of June and backs off To the fourth week of September got just some out on the plains I'm actually going there this weekend, but we'll see what happens severe. Otherwise Looking at the actual forecast for severe weather. We have just general thunderstorms This is front and system moves in where the low is located in the upper level cool pool They may actually have a Marginal and slight risk near Salt Lake City. It has been 20 years and things like that in Salt Lake City in the past For Thursday general thunderstorms along the Rockies Friday. We get high and dry with storms to the south So flooding rains are possible from the Continental Divide and Westward and Southwestern in Arizona and up here in Montana, Idaho We have a cold front that's now made all the way down Elevation wise draped along the mountains and now down into northern New Mexico For Thursday at the front another truck coming in to kind of reinforce showers briefly Then all that moves out and we're gone smoke wise Wednesday to Friday pretty high and dry and clear So the big event is what is just beginning as I record this on Wednesday About 24 hours of showers I did not mean that to rhyme and then at the end of the month There's a little bit of a turn of moisture that could become more significant as we get closer But it's hard to forecast the next storm until the first storm is gone. It's one of my models Our normal temperatures are dropping pretty quickly from normal high of 76 to 72 And 46 to 42 normal low temperature in the next 10 days So you can see the moisture is back finally. We have a low sitting out here and from Tuesday to Wednesday It's kind of concentrating pulling moisture in we're actually going to have Significantly almost twice as much atmospheric moisture on Wednesday night into Thursday morning as we normally do at this time of year But the problem is the storm itself is not going directly over us It's going to pass to the north So we'll get some lift and we'll get some precipitation will be a third of an inch to a half Notables in the upper air over the next week or so Fiona's still spinning out here, but it's going to curve out to sea last week We didn't know because hadn't even formed yet where it would go Here's our giant high over texas. Here comes that low coming in from Pacific Northwest bringing in showers across most of colorado for Wednesday night Thursday morning Monday noon ridges back in the west trough of the east and that's pretty much Brings back warm temperatures. So it'll be above normal once again Let's put this in motion. Keep an eye on Fiona going away. Here comes that big trough into the west And it goes up into Montana over us. We definitely get a trough dragged across the state So we do get colder and get some showers. Then we have the ridge rapidly building out west Northwest flow a lot for a little bit for us This is Monday next week into Tuesday Wednesday. Here's an interesting thing. I think this is called 98l And right now it's just an investigation like Fiona was and it would be called Headed my mind. Oh, it's a Hermione. If it is the exact next storm that forms It would get the H name Hermione So temperature wise Kind of weird because night time temperatures can be above normal while daytime temperatures can be below normal So you see it popping back and forth between purples and blues and reds and that's not because it's really warm It's just a warm of the normal where you can see what is dropping into the 40s And then in monday and like that you got another cold front heading down on the plains about lots of warmth in the west All right, so looking at moisture. Again, here's the super concentration of moisture for Wednesday to Thursday Wish we could get more actual rain out of that, but it definitely would be cloudy and humid then we really rapidly dry out and Really nothing happens until later next week. How do we get some of the moisture feed up from the tropics again? And there it is trying to come up on tuesday in the arizona Four corners area Utah and they're finally into colorado for wednesday and thursday. Here comes possible Hermione Again where it's going to hit from texas to florida to curving out To see it's all up for grabs. It's just a wide Spread of possibilities. So for showers. I'm just going to look at the early part here Here comes all our 24 hours of rain or so western slopes get another shot So you might have some storms thursday afternoon if a little ripple comes through and then it's a dry dry dry dry So for precipitation about about a quarter inch to half inch or so is most likely about a third of an inch along i-25 Some pretty good water in the western central mountains and southwest four corners area needs it Add five days get the full ten day and everything gets us a little moisture with later showers But not much changes in the overall pattern temperatures in the 60s wednesday and thursday and Cool with a pretty good chance of least sprinkles and mist and drizzle if not some periods of rain We warm up pretty quickly to the low 80s bounce back down to the 70s and then try to get back to the 80s With a hint of some moisture coming back on tuesday. Maybe a little bit more beyond that So here's a hurricane fiona. It's pretty darn strong, but it's staying out here. It is going to um Threaten bermuda, but it looks like it's going to pass to the west northwest of it. Then it goes up here into uh, nervous coach us Here is the early model runs on 98l This since it really doesn't exist yet Everything possible is still on the table. You just have to watch the weather and wait for something to actually form We can get a good hook on what What's there and where it might go? Longmont leader and boom for the leader have frequent weather updates by me and local news. That's great to read This has been chief leader of this gen is worth keep looking up


Hello, thank you. Hi, hi, hi. So, a new VUCA, well, many of you here will have heard of the business term VUCA, but for those of you who haven't, it was invented in the 1980s by two leadership theorists and then taken up with the US Army War College to train their recruits on specific external negative issues or problems or threats. To prepare them for combat. So, a VUCA stands for volatility, uncertainty, complexity and ambiguity. Now, when I recently read up about VUCA, I was struck by how it took me straight back to a really dark time in my life, 2011, 2012, 2013. I was extremely upset. I was anxious, I was depressed and crucially I was grieving uniquely for someone who was still alive and that was my mum because she had motor neurone disease. Now, motor neurone disease or MND in the UK is also known as in umbrella terms in the US as ALS. And it's a neurodegenerative disorder.  So, your body becomes a prison, but what you don't lose is your mind. You still hang on to your faculties, you're there all of the way. So, having MND is without a doubt a daily VUCA situation. So, what is VUCA really? VUCA is for volatility. The nature and dynamics of change. MND is change. For three years, none of our family knew what we were going to be waking up to in the morning. Meet Evelyn. In January 2012, in her Victorian terraced house in Nottinghill, my mother had a visitor. So, my dad and I would go downstairs to cook or nip out to the shops and in that time this wild house mouse would come into my mum's office and sit with her on the first floor. Janet was so still that she didn't scare Evelyn at all. Evelyn was just never afraid.  My dad and I rarely saw Evelyn because we were humans, but my mum took on mouse powers. Her notes looked like this because by the end of the year there were so many of them that her best friend who is a British designer called Francis Sorrell decided to illustrate some of them and type them up for her. But this is exactly Janet's text and she would have scrawled them out and we just typed them up. U is for uncertainty. Unpredictability or lack of clarity due to lack of facts. None of us knew what would change for Janet or when mobility, speech, respiration were all up for daily review. Uncertainty was also experienced by the four-legged contingent of the household. C is for complexity. Interconnected factors that create an interdependent set of problems. If one day you're too weak to lift your soup spoon from the bowl of tomato soup to your actual mouth, there's a knock-on effect obviously. I think this really illustrates Evelyn's VUCA world in terms of complexity. Evelyn liked to go into the desk drawer next to where my mum sat. One day my dad shot the desk drawer and Evelyn couldn't open the desk drawer and my mum was too weak to open the desk drawer. So it's complexity in action. Don't worry though because my mum wrote me this note so I opened the desk drawer. A is for ambiguity. We have all the facts but a lack of clarity or direction will create misreads. Our patients needs met truly and correctly if communication is so incredibly hard. I feel like this is a good illustration of ambiguity in Evelyn's world. Across the whole year there was an entire dynasty of mice that would live in this first floor office. It's pretty disgusting but I was on board with it. My mother always chose gender neutral names. First there was Evelyn and then the shock of him having a companion, Leslie. Then we had Hilary and Jude and then Minnie Mouse and Minnie Wei. Then I think Walnut and Fromboise which is French for raspberry just because of the size. They were so tiny. They'd come and sit on her lap. Janet respected ambiguity. So while all this was happening in October 2011 I took up a fun new hobby called improv. However it did mirror my everyday misery and grief and I couldn't help but take it into the rooms with me. I must have been a nightmare to play with. Booker was a daily reality for me and even if I had known about Booker I wouldn't have been able to manage consciously my inner turmoil. It just might have prepared me for what was going on I suppose. But I knew in my heart of hearts that improv was helping and through the pain it was instilling in me a resilience in my daily life. Recently it hit me that Booker, which is this incredibly useful scaffolding that allows us to examine external negative issues, problems, threats, doesn't support the internal resilience that is crucial for our wellbeing in order to be able to handle it. Because resilience is everything. It doesn't matter how brilliantly we prepare for a Booker world if we don't have resilience. But resilience however is created by improv. It's maintained and supported by improv. And by luck or intuition I had found my secret weapon. When I read up about Booker it actually really hurt because knowing about the bump in the road doesn't fix the internal pain. And Booker warnings as I said won't give you the resilience you'll need for Booker situations. So I hit pause on looking outward and I created a VUCA scaffolding that looks inward. It's a scaffolding that champions internal resilience rather than simply flagging up external threats. So, V is for versatility. It's how we're going to prepare for volatility and for change. Versatility means adaptable, it means flexible, it means resourceful. And my dictionary says we admire versatility people because of their wide skill set. So let's be open to change. U is for uniqueness. Uncertainty is inevitable. We really know all the facts. But we can be certain of ourselves. So do say I'm unique, I'm authentic, I'm present, this is me. And interestingly and perversely you'll give yourself permission to fail. Which will mean that you'll find out faster what works for you. C is for clarity and commitment. I replace complexity with clarity and commitment to keep it simple. Just keep it simple. Make a choice. Try not to get internally blocked through big picture overload. And finally, A is for accept and build. Be gone ambiguity, hello, yes and. It's impulse tempo. It's the first and the last and the most complex and the most simple tenet of them all, right? If ambiguity is the enemy then let's accept the facts in front of us, the yes, build on them and. So external negative forces in our lives aren't going to go away. But perhaps if we use this new VUCA to manage our internal equilibrium and enhance our personal resilience, we'll meet the original VUCA circumstances such as a shut desk drawer with positivity, good humour and strength. Thank you very much.


My name is Azra to meet and I'm with Cal TV Entertainment today I'm here on Sprout asking students about the final season of Game of Thrones which is premiering on Sunday April 14th. I'll be talking about Game of Thrones today so my first question for you is if you could revive one dead character who would it be okay yes we who do you have for winning the actual throne I think eventually John's gonna come out on top King of the North okay I'm with that like Sansa okay someone like more low-key yeah she's level-headed enough to do it yeah she cries a lot though first off a search he's done right you'll say Jamie Lannister is gonna have to take care of that he's going he's going to he's only he's only he's the only one in position to take care of that John Snow John Snow you understand it's going to be it's going to be a market today it's facts six episodes in I promise you John Snow will be the king between John Snow Daenerys Targaryen and Cersei Lannister who do you think is gonna die first I hope Cersei does I feel like it's probably gonna be one of the other two yeah just because they're good people you know Cersei's like committed to not fighting the Night King so Cersei she got to go oh man I think Daenerys okay yeah I think slim we'll see I don't know we're gonna miss you it has to be the least expected so probably Daenerys okay okay if you could be one character on Game of Thrones who would you be oh man is it one of the dragons count yeah okay I think I would be various okay yeah yeah he makes things happen though okay Jamie just like he started off bad but then you like learn about him yeah most people are sons okay like if I want to be cool I'd be like I'm Arya but like yeah yeah yeah let's be real thank you so much for watching my name is Ajra to me with cow TV entertainment and Oski here is definitely gonna be the one to take the throne


How to make the narcissist panic, how to make them experience sudden, uncontrollable fear and anxiety. The narcissist will drive you insane. They will do everything they can to keep you off balance, to keep you shocked or confused. So you might be looking for a way to make them panic, to make them lose their balance, because you can't deal with their tactics anymore. It's driving you crazy. They deny things that they've said or done. They project their insecurities onto you. They shift the blame onto you.  They engage in double standards and the double bind and they want to make you think that you're crazy. They want to make you think that you're losing your mind. So that they can then manipulate you and get you to do what they want. Sometimes there's no reason for them to lie or manipulate you. They could get what they want just by being fair or honest, but they believe that they cannot achieve anything great by doing good. They believe that they will only get what they want by by doing bad. By lying and manipulating people. They believe that's the only way that they're going to come out on top. They see themselves as being unfairly disadvantaged. So they believe that they have to cheat to get the result that they want. They will persuade you to do what they want by using force or threats. They will intimidate you to keep you in a state of fear so that you remain under their control. You're constantly afraid that they're going to do something undesirable to you. You're afraid that they might try to hurt or expose you. You're afraid that they might try to take something away from you. They're always looking for your weaknesses or vulnerabilities. They're always looking for what you value the most. And that's where they're going to strike first.  Whatever they think will make you panic. They will make you think that your life is going to be miserable if you dare to go against them. They will gossip about you to other people. They will have all of their flying monkeys supporting them, agreeing with everything they say. So that if you dare to go against them, you're going to be the one who looks crazy.  And they're thinking that they're this kind of caring person. So there must be something wrong with you. This is something that all narcissists do. They all want you to think that they're close to all of these people. So that you have no opportunity to say anything bad about them. Because everyone thinks there's nothing wrong with them. So they then think that you're the problem. Narcissists are very weak fragile people. They are very afraid. They feel worthless and insignificant. Which is why they need so much validation, compliment or money from other people to make them feel like they're worth something. But they are very fragile people. They are very afraid. They might act strong. But if you push back against them, they will back down. One thing that really makes the narcissist panic is the truth. Narcissists are pathological liars. They lie about anything and everything. And they expect you to lie too. They don't understand how normal people think. They can't comprehend it.  They don't realize that there are genuine authentic people out there. If you are completely honest with the narcissist in a direct way that does not attempt to disguise unpleasantness. It shocks them. It leaves them temporarily unable to react. They don't know what to say or do. COVID narcissists always play the victim. They're always sick. There's always a reason why they can't do something. They've got it worse than anyone. They can't work. Everyone's against them. Everyone's causing problems for them. There's always some reason to feel sorry for the COVID narcissist. They have to be the victim in every situation. And if you call them out on it. If you just point out the facts. If you just say there always seems to be something going wrong for you. They don't know how to respond. They panic. The narcissist always has to get what they want from you. And if you've been around them long enough. They will have trained you into giving them what they want. But when you push back. If you say no. They will be really shocked. They will panic. Because they thought they had you under their thumb.  But when you stop doing everything that they tell you to do. When you stop agreeing with everything they say. It causes them to panic. Because they begin to realize that you're no longer under their control. It makes them feel like their pet is escaping. One of the greatest ways to make a narcissist panic. Is to expose them. To reveal the truth. To reveal the truth. To reveal their true objectionable nature. There is a side of the narcissist that they don't want anyone to see. And if you expose that side of them. It will make them panic. There are a lot of things that they don't want people to know. They want people to think that they're perfect. That they don't do anything wrong. And they go through great effort to present this false image. So when you expose what's underneath the mask. It makes them panic. Narcissists have to have control over everything. They have to have influence and authority over you. So that they can make you do what they want. They are very weak, fragile people. They are very insecure. So they have to bully you into submission. And when you try to push back against them. Their behavior might get worse. They might become even more controlling. They might lie even more. They might become even more rageful and intimidating. They think that by doing this.  When the narcissist loses control over you. They will panic. And this fear of losing control. It's the reason why they do what they do. It's the reason why they deny something they've said or done.  They want to maintain their influence and authority over you. Because they're very insecure. So to make them panic. You can take away some of their control. The narcissist is like an emotionally immature toddler. They might try being nice first. If they think it will get them what they want. But if that doesn't work. They will throw a tantrum. They will shout and scream. And if that still doesn't work. They will get even louder. They will even measure it by past experiences. What it took to get you to give in. And give them what they want. They will assume that all they have to do is shout and scream a little longer and louder. And at some point you will finally give in. The narcissist is just trying to figure out what they have to do.  And then they will be that much more mean and aggressive the next time. To get you to do what they want. Because that's what makes them panic. When they feel like they don't have control over you. When they feel like they can't get you to do what they want. Thank you for watching. I hope this video has it with you. Please like, comment, share and subscribe. Click the bell icon to receive notifications for my future videos. Check out the new Narc Survival website. At www.narcsurvival.co.uk Where you can read my blog posts, book coaching sessions and join a support forum. If you are delighted to donate. My PayPal link is in the video description. Coaching inquiries. You can email me at coaching at narcsurvival.co.uk Thank you for watching and I'll talk to you soon.


A new poll says that 7 out of 10 Asian Americans believe the United States is headed in the wrong direction. Let's talk about if that's high or low and also why. We moved here because America was the greatest video game map I've ever seen in my whole life. But then lately, there seemed like there's so much bugs in the program and nobody is there to do the firmware update. They don't want to do the firmware update. What's going on? Andrew, some troubling studies just came out. 7 out of 10 APIs believe the US is headed in the wrong direction and only 1 out of 10 believe that democracy is working extremely or very well according to a new poll from AAPI data. What are we talking about right now, man? We're talking about something very big picture, right? Yeah. Yeah. I mean, I think what we want to delve into, first of all, because a lot of Americans feel like America is in the wrong direction and a lot of Americans are losing trust in democracy of what we know as democracy and also losing trust in like news and information and misinformation. Just all systems, man. But we got to talk about the Asians, right? Because the Asians, maybe their reasoning is different or Asians oftentimes as a group in generalities have different values or have a certain set of values. So I guess we're going to talk about that. So yeah, please hit that like button. Check out other episodes of the Hop Hop Boys. But one thing that everybody can agree on that is headed in the right direction is Smala Sauce, our very own chili oil. And of all groups in America, Asians have the lowest voting rate. I think that generally I'm not saying there aren't some legacy people in there, but I feel like they're less likely to be tied to something their grandfather or their great grandfather taught them, right? Because typically religions, political affiliations, they are handed down through just like what your family programs you did like. Okay. So Asians tend to be very moderate, right? Like that. Moderate, not moderate, not moderate, right? I'm just saying like moderate people. Right. Anyway, let's just get into what the article says. Somebody says, of AAPIs, half say they disapprove of President Joe Biden. So literally, you got the half, half 50, 50 split there. What's surprising about that, Andrew? More lean toward the Democratic Party than the Republicans. However, it shows that Asian Americans are more likely to trust Democrats over Republicans to handle issues such as the spread of information, election administration, student debt and climate change, but more likely to trust Republicans on handling the economy and split on which one is better suited to handle immigration. Yo, that is so interesting. They trust Republicans more when it comes to the economy and they're 50-50 on how they handle immigration, but they want Democrats to handle student debt, climate change, and election administration. So basically, they're just picking like the pros and cons of like comparing two players, right? They're like, Oh yeah, Jordan or LeBron. Well, LeBron's better at passing, but Jordan more. Well, let me tell you this. Asian Americans generally really hate crime. So if you're being indicted or being convicted or charged for some type of crime, like election fraud, Asians really don't like that and they don't like criminals. That's one thing Asians really don't like. Oh my gosh. They really don't like people who go to jail, man. Right. Right. And Asians actually have unbelievably low crime statistics in America in terms of violent crime. But yeah, I do think that they agree with the general electorate, Andrew, that right now America is faced with a uniquely horrible choice. This is actually the title of a really viral article and this is a national poll. Yeah. I mean, basically, if it comes up to be Biden and Trump again, rematch in 2024, a lot of people are going to just be out. They're just like, Yo, I don't even want to think about this election. I don't care. Nobody's happy, right? The majority of people are not happy. Yeah. I mean, for me, I would say when Asians kind of feel like that America is set in the wrong direction, I think what it is is I don't think it's necessarily fully democratic values or Republican values because I don't think a lot of Asians actually strongly identify with those two labels. I just think Asians, most Asians have a set of values that they care about, the top three, four things that they care about, and they feel kind of moderate about that. So like, you know, a lot of people would say like generally a lot of Asians have like conservative, like moral values, but they also do not feel super emotional about them either. Right. You know what I mean? Like they're just like, yeah, I've like that. I've like, okay, this identity politics, cool, whatever, but just give me safety in the economy. It kind of goes to like Ronnie Chang's first special, he's like Asians just want things to work. They don't care about all this other stuff that it seems like other people care about. It's not that they don't care in the sense that they hate any of it. I literally think Asians are like, okay, this is not my priority. So whatever works, but my priority is safety, education, and economy. Give me that. And then everything else is like, I just don't feel strongly about. Right, right, right. The article goes on to say Cassie Villicent, I believe a Filipino, she says, she believes the country has gotten worse in recent years, but it doesn't necessarily mean it was all Joe Biden's fault. I think that it was already going downhill prior to his election. Yeah, I think that's true. Yeah, like agreeing that things are going downhill, but the blame game pie distribution is different. Right, right. And I think a lot of people want to blame each president. Let's be honest. Every president is only in there for four years.  So really they have three years to make an impact. So it couldn't possibly be all of Joe Biden's fault, right? Even if you go two terms, you're like only effective for like six or five. Joe Biden is just one man that stepped in there. There was a whole system at work that was already going. So it is true that whatever the upcoming president will adopt and inherit also was a big deal, whether that's Trump inherited stuff or Biden inherited stuff. It's really not just the president. Let's be honest. So the article also goes on to say, Andrew, that whether an Asian is like maybe more Democrat or Republican, they're still able to point out the problems with their own party. So, so even when they are, they're like not the most fervent extremists. Like we said, whether they're left or right, they tend to be moderate left or moderate right, where they're still able to self reflect and be like, yeah, my party's messing up too. Right, right. Because this guy was a Republican, but Joe still said that misinformation is a major problem for both parties. Right, right. So it kind of goes to show you, I mean, Andrew, what are your quick thoughts on this article? I mean, I just feel like any, obviously, nobody's happy, right? That's a national poll. That's an internal AAPI granular, like a statistical thing. I just feel like right now, in my opinion, there's a lot of uncalibrated pendulum swinging for, for example, from police over profiling to zero policing. What a, what a horrible pendulum swing because that's over here bad swings over here, also bad, right? So I just feel like a lot of people are questioning the internal watch mechanisms and sort of like the way things are supposed to read and react to things. You know what I mean? But I mean, I guess to your point, Andrew, but do just a lot of countries have problems or? I think, I mean, I think every country has problems and I think everybody's problems are kind of like put out there on the internet, on the worldwide news. You say more than ever. Yeah, more than ever. More than ever, a citizen in America is aware of all the problems going across, going on around the world and we're getting our own information and our own perspective, whether it's, whether it's even true or not or sort of true, half true, exaggerated, downplayed, dismissed. Honestly, nobody knows. You don't know. You don't get the right information. To be honest, I hardly get the right information. Like, who knows? And this is, there's a stat that says 83% of Asian Americans believe that misinformation is a huge problem. 75% of the general Americans believe misinformation is a huge problem. So Asians kind of believe it just a little bit more. I think that Asians are, we know what it's like to be outside, but also feel culturally a little bit outside of the mainstream in America. Whereas other groups, they may feel more bought into entrenched in different sides, you know, whether it's historically or whatever, just emotionally. I think Asians are more, it plays into a stereotype, but I'm saying Asians are less emotional when it comes to political issues for sure. It just feels like whoever's driving America, Andrew, if America is a Gran Turismo F1 forza motorsport cruise in USA to put it plainly like car Andrew doesn't feel like everybody who was driving it when all the Asians were like trying to come in. I know that a lot of Asians are still trying to come. They were just driving it so good. There were still some hiccups. They were hitting the wall occasionally a little bit, but like they were generally driving it good. And now people feel like whoever's driving America, whatever forces are driving the car of America is just hitting the wall a lot more. Yeah, yeah, yeah. You know what I mean?  Look at this chart, Andrew. Here are the actual causes of death in America. It goes heart disease, cancer, everything else less than 40%. Look at the news. The news reports everything else at like a 75% tier and heart disease is reported on 2% of the time. Heart disease, which is mostly caused by like sugar and like refined carbohydrates and not exercising and stuff causes 30% and it only receives 2% of the coverage. Yeah. Is it possibly because people advertising certain products Andrew during the news might be selling sugary products or carb refined carbohydrates? Wow, that's crazy that homicide actually is really low, but the news homicide makes the news. So there's actually a devil's advocate Andrew. I'm going to play that here where people say actually all the macro stats are saying right now is better than ever, but the news is worse than ever because theoretically medical tech and there's less war, even though wars are starting to flare up for the longest time, like there was like a 20, 30 year peace because obviously once we go back to World War two, that was in shambles shambles, the whole world. So anyway, guys, let's just get into the comment section. Somebody said people are just fed up with a two party system, man. We're in trouble no matter who wins this year. Nobody cares. Both sides don't care that everybody's just trying to get rich or they get co-op maybe they go in with good intentions and they become co-opted by the system. People like belief and corruption as an all time high. Right, right, right. Republicans will always put out profit and their own selfish agendas over the people. That is one thing that is always guaranteed.  That stereotype has been around for a hundred years. Andrew, I had to look it up.  Will Rogers Andrew said in the 1920s, I am not the member of any organized political party. I am a Democrat. Wow. So Andrew, these stereotypes that they've been holding true for a hundred years, you know, when stereotypes last a long time and this goes for any stereotype out there that has kind of stood the test of time, you gotta ask yourself, why? Like why do I, why am I stereotypical? Why does that stereotype still exist? Are people just wrong and people have it in their hearts and they want these harmful stereotypes to be true or is there some reason for that? Right. I always felt like a two-party system sucked. And you know what is weird about a two-party system, Andrew? Is it just boils down to which side you were born onto, right? Like if the two parties have different ideologies, maybe your family is more, a pocketbook is more impacted by this ideology, your pocketbook or your emotional pocketbook nowadays is more impacted by one ideology or another. And then you just have to pick it. Somebody said, if you haven't figured out Democrats' agenda is to destroy the working middle class, turning them into the working poor while all the wealthy elites live in a different America. Interestingly enough, Andrew, both sides say this about the other side, that they're trying to destroy the middle class. Right. So who's right or wrong? Andrew, both sides are saying the other side's policy destroys the middle class. Right. Democrats are saying Republicans are destroying the middle class. Republicans are saying that Democrats are destroying the middle class. Maybe both sides are. Yeah. In their own different way, huh? Andrew, the only side guy that I saw question the corporatocracy in corporatocracy, I'll just pop up that definition right here, Andrew, was Bernie Sanders? Like Bernie Sanders was a true, I guess what, more like socialist, right? I had socialist ideas, I guess. Yeah. And then I guess on the right, Vivek Ramaswamy says that he is more of like questioning the whole entire system, but like he's from big pharma or was was pharmaceutical company himself, but he is very smart, too. I'm not saying I agree with him. Yeah. Ultimately, Andrew, what about the citizens? Do the citizens have to take some blame right now for basically like why everybody is unhappy with the direction? Because obviously if citizens comprise a democracy and there's this old adage, the citizens get the democracy that they deserve. Yeah. Yeah. Yeah. I mean, I think people are not doing enough. I think people people got caught up in in a way like they got so selfish with like social media and just like maybe I don't know what you mean enjoying their own dopamine, enjoying their own that they got out of local politics.  Those people end up becoming US senators. US senators have a lot to do with what happens in America. You mean saying that's a trickle up system? Yeah, like it does matter. Like if we don't vote for who we want locally, then almost our I feel like our leadership up at the top is never going to like represent us. Yeah. Ultimately, Andrew, we could get into this for hours. Like I said, some of these articles on the national polls, I was looking at 10,000, 12,000 internet comments on the Asian polls. There's still comments.  Do you think Asians are more like detached from it? Because we're still more considered outsiders and maybe to the political systems of America, we are still more outsiders where like a lot of Asians are just like, man, I don't got my emotions put into this, but I just see what I see. Yeah, I do think that Asians are a little bit like, I don't know how to say it looks so pragmatic, like a Lee, I'm not saying all, but like my and we know a lot of people in our family, they really like Lee Kuan Yew a lot. Right. Like you Lee, you want to talk about a hardcore pragmatist that's not really like you couldn't really place them on a political spectrum. You know what I mean? Like in a Western American sense, at least I think you would have to like make the you mean and make it more of a heptagon and then chart each like geographic like shape on there.  All right. Well, that's like being an Asian parent to be honest. Anyway, guys, let us maybe Asian voters just want like a good Asian parent as the president. But then the kids would have to listen. You know, I can be the parent, but I raised you since you are zero years old. I know you're going to listen, but the American people that's a rowdy kid, even if I'm the father now, who will listen to me? Yeah, the kids are losing trust in the parents and the parents aren't any good. So anyways, you guys let us know in the comments down below, what do you think about all this seven out of 10 Asian Americans feel like the country is headed in the wrong direction? Should that number be higher? Should Asians know better or or are Asians overrating how bad the country is? Let me know in the comments down below. I think a lot of valid arguments on all sides. Let us know. We encourage the debate until next time. We're going to hop on boys. We out. Peace.


And this actually comes from an interesting question that I got from one of our coaching students, Gabs, who's basically saying, after one week of working together, I'm no longer stressed about my exams. Is that a good thing? It definitely makes you chuckle because first you got to get your ego aside and say, okay, the coaching program is working. But secondly, if you're in a situation where you're not feeling stressed for your upcoming quiz or test, before you actually go in there and walk out with a grade that you're disappointed with, you have to ask yourself, am I being overconfident or are the study techniques actually work and what can you do to actually prove that to yourself? Now, the two things that I found that lead to high grades consistently is repetition as well as understanding the overall picture. Having a study strategy that designs both of those and being able to test yourself is a good way to see, are you ready, or are you just overconfident and full of BS, and use techniques such as free recall practice questions and overview of your learning objectives before your quiz.  But hopefully that's not the case.