I mean, this whole topic goes right into a discussion that was in Brand Man Network, right? Now, for those of y'all who don't know what Brand Man Network is, it's our free space, got courses, you think you like the podcast? If you talk about step-by-step information, they drive you where you need to go, so you can just reference, we have free courses, but we also have this space where people can talk and we give a lot of advice and you talk with our team personally. So the question was, am I draining my audience, right? Am I draining my audience as an artist? And Eddie Harp, shout out to you, said, I know for me personally, I've always been worried that I was draining my audience by putting out content that feels rehashed or not original or varied enough. Remember that it takes more than six to eight exposures to your song or content before someone takes the chance to listen with the way algorithms work, especially with short-term content. Some people might not get to see it until you post the 10th or 20th variation of promo for the same song, be patient and remember the long game, you're creating a world and lore for new fans to step into and immerse themselves in. Man, beautiful, beautiful, beautiful, beautiful. He's touched on so many things here and I wanna just break down the different elements of it, right? So let's start here. At this point, he says, he says, remember that it takes more than six to eight exposure to your song or content before someone takes a chance to listen, right? And remember when I first saw this post, I was like, yeah, it's crazy because that goes along that same statistic that you get for sales calls, making a sales call, six to eight points of contact before you actually have true contact when they'll answer the phone or they give you reply on email so they might see you in an ad, they might see that you tweet them, they might see your first email, they might see your second email in their inbox, right? But they might not click it. So they've been exposed but they haven't clicked to truly consume or you have people literally just missing every single one, right? So there's a reason that you wanna hit people up multiple times and this is no different than hitting people up, right? You're online, yo, I'm posting this, I'm posting this, I'm posting this, I'm posting this and how many times have you seen a video online and you didn't watch it that time? You might have saved it and said, I'm gonna watch it later or sometimes I'll just be like, I'm gonna look it up. So I remember the title, there's so many versions of I'm not watching it now, I do wanna watch it later. But if it doesn't pop up again, it gets distant and more and more distant because I get berated with new content. But if I see that thing again, oh yeah, I did wanna watch that video.  Come on, watch this thing. But you can create that same effect yourself by posting, posting, posting. So that stat alone is something that artists really need to dig into and just finally, just black out, six to eight, that's how much it's gonna take and you might not do it with everything, but like we just saw with Piff and Simone when we were talking about earlier in the episode, if it's something that you know, this is that thing, they should move, give it another try. Yeah, especially if the response to the lower performing pieces overall positive, right? Oh, yes, on that point. Cause it's so many factors that can go into it. Like we already touched on cultural. Sometimes you just post at the wrong time of the day, right? Like you pick the wrong part of it.  Okay, that's the music, you know what I'm saying? But most of the time, no scenarios, it's the content, right? And like, so there'll be artists who will give up at content number three, content piece number three, thinking the song is terrible.  Or like, you know, the headline was off, so it didn't keep people's attention long enough. Like there's so many little pieces that could be the reason of why it didn't take off that like you really do need that many at-bats before. You can truly say, now it was the music, you know what I'm saying? That was this kind of holding people back. And I like acquainted to the sales cause I don't think enough artists think of fan conversion like sales, right? And it really, it truly is a numbers game, right? It's like, you put up a thousand shots, bro, some of them gonna hit, you know? Assuming certain quality things and, you know, entertainment value and things like that. But it really is a numbers game, man.  And there are plenty of artists that I've come across where it took a lot of pieces of content before I finally broke and converted, right? Hey, but you broke. Yeah, I broke, yeah, yeah. And it's like, man, like you said, imagine if it took me post number nine to give them a chance, but it stopped at post number three. You know what I'm saying? I wouldn't even be here. And who knows how many other people wouldn't even have been there in the pipeline. So like, I don't know, it's one of those things that I feel like we have personally been fighting hard for for a very long time. And I'm glad to see the narrative is starting to kind of trickle out there.  It's not enough, but I mean, we have these clear anecdotes. Hopefully this clip, the two clips that we'll probably chop up from this really help people understand, like visually you can see the difference just from posting more than one time. Because Piff also talked about the algorithm, you know, Eddie mentioned the algorithm. So what does the algorithm mean? You talked about the For You page, right? So on TikTok, especially of all platforms, this is extremely meaningful. On TikTok, you can have a thousand people in a bucket, but your content starts in miniature buckets and grows out and shows to more and more people. So let's just say there's a thousand people on the platform of TikTok in your niche. TikTok might show it to 500 people, right? And then it might show another post to 200 people that have zero overlap with those first 500 people. Or half of those people might be overlapped, right? You got like 100 that have already watched and then 100 that didn't watch. So every time you post, it's not even the same people that are seeing it.  So the algorithm works that way. But then that's actually a negative thing when you think about it. Cause it's like, dang, well, if I'm only getting a whole bunch of one-offs, I'm missing out on that consistent content contact that six to eight times people have to see me. So now you really can go hard. Like Simone Talies, where she posted like 40 times. Cause some of these people have never seen this before. And then by the 10th time, I had some people who've seen this once, some people who've seen it three times, some people who've seen it 10 times, right? You're constantly getting this overlap, but it's never 100%. So the way the algorithm works is nowhere near the OG Instagram chronological order way of things where nine times out of 10, only people who follow you are gonna see it, but they're gonna see it on their feed.  That day is far gone. It's not even Instagram anymore, right? So look, the algorithms, the way they are set up, there are good reasons that you will not, that you can post things more than one time and not have anything to worry about, let alone the fact that most people need to see it more than once. The last thing for this that I wanna touch on, though that Eddie mentioned was variation. He used the word variation. And this is like one of the first YouTube videos I remember making like years ago. And the whole concept was the way variation prevents the concept of spam. Like people feel like they're spamming when you're being lazy. And it's the exact same thing, again and again and again and again. But when you create a variation, whether it's a new headline, whether you introduce a slightly different part of the song first, maybe one's vertical, maybe one's horizontal, there's color changes. It's a new video, same song, right? A new meme that you relate to the song. As you change all these different elements and things vary, it creates a new type of entertainment, right? It's like you're entertaining people with the same thing from different directions. How there's like multiple angles to the same joke, right? That creates that concept and people begin to appreciate it because they see that you're continuing to change things up and it becomes a joke because they see what you're doing. Like the graduation also he did this and he did this and he's doing different things for the same thing. So that oftentimes is appreciated versus, oh, he just told me the same thing, the exact same way every single time. I'm gonna tune that out because I already consumed that. There's nothing else new for me. But if I see that new thing, I'm already familiar with the first thing that occurred. So now I now focus on the new thing that you did and that's gonna allow me to appreciate your creativity. So it's just about entertaining people at the end of the day. Yeah, that's such a good point, bro. Because it's like, I think we get so wrapped up on the video content itself and being like, oh, this is the content but the overall package is really the content. So even just changing out the headline technically makes it a new piece of content, right? Like you said, there's a new joke out of the process. There's a new path you're kind of taking me down.  Yeah.  Yeah, man. So look, I mean, I think if y'all don't get what we've said today, we all can't become comfortable of posting the same piece of content multiple times, just changing things to help it perform better or even the same piece of content at different times because maybe it just hit wrong that day, that time and culture, whatever was going on. Look, I don't know what to do. How we could convince y'all any more than what's already been said. Yeah, bro, it's a time saver. It's a budget saver and nothing else. Nothing else.  And this is the perfect way to perfect it, right? Keep trying, keep throwing some at best. And also I think it scratches that itch that artists have of multiple creative ideas where it's like, hey, I have 20 different ideas for this post, which one should I do? All of them. Every single one of them because I can't tell you if you're gonna be right. Well, which one is gonna be right or wrong? Sean, I can't tell you. You can't say, bro, just post all of it. Right. Nobody knows for 100% sure. Yeah. Right? Now.


act to beat, actually. But I'm going to try. So welcome, everyone. My name is Dan Koeper. I'm here with my colleague, Thijs Alkomade. We work for a company called Compitest, which is a full-service security provider in the Netherlands. We do everything from presentation testing to instrument response. But we do run the research facility of Compitest, which means we get to hack school stuff and talk about it at conferences. We did a talk yesterday as well. And tomorrow, we'll be talking about hacking macOS for a local privilege escalation. So if you have any questions after this talk, feel free to get to our tent. It's on the retro square. We have a tent full of arcade games if we're into that. But we can also have a beer, of course. So today, we would like to talk to you about something we did last year. Last year, we participated in Pone to Own. And we won by demonstrating a zero-day attack against the Zoom message clients. So that meant that if somebody had the app installed and running, we could remotely get code execution on your machine. So we want to share all the details. But we have very little time and a lot of ground to cover. So I will give the slides to Thijs. And he will quickly tell you the vulnerability we found. We mainly used in our exploit. And then we'll get in all the nifty details about how we actually exploited that vulnerability. Thijs. Yeah. So the vulnerability we found is in the chat functionality of Zoom. So many people know it for the meetings that they can have and just send a calendar invite. And people can join it. But Zoom actually has a very well-featured chat client built in as well, which many people don't really use that often, I think. And when we started to figuring out what the features are, that Zoom has when we started our research, we noticed that Zoom basically uses a couple of different protocols depending on what you are doing. So there's the XNPP, which is used for that chat, the Out of Meetings Chat. There's an HTTP API for specific operations, like if you're logging in. And they have a custom binary protocol for meetings, which is UDP-based. And pretty early on, we decided that we thought that the XNPP connection would be the most interesting for us.  And often, the server doesn't really care about it. It just forwards it to the other end. So a little enforcement by the server. There's a couple of things they block, but really not that much. And because XNPP is an open standard, it was already quite familiar with it. It took less time to reverse engineer than the meeting protocol, which would have taken weeks to figure out just the basic structure of it, probably. But with XNPP, we directly knew that already. And what we noticed is a very obscure setting. It's the advanced chat encryption. It's a setting that I think barely anybody uses. You can only enable it on the website. You cannot do it in the client. And when you do it, all of your messages are encrypted in the chat. And it only exists for paid accounts. So if you have a free Zoom account, then you cannot enable it. And also, a lot of features in the chat no longer work. I think you can no longer send gifs to somebody if you enable this. And what's even more interesting is that there were two versions of this protocol in the code. There was an older version 1 and a version 2. And if you started a new chat, then it would start version 2. But if you send it a version 1 message, then it would still respond to that. And the protocol was still implemented, even though it was no longer in active use. So if you combine all of this with the fact that it was using OpenSSL, then we thought that this was a good area to focus on for our research. Because it's a conversion between C++. Most of the Zoom custom code is C++. It has to be converted to C for the OpenSSL API. OpenSSL is, of course, open source, so we can easily read the documentation or even the source code for it. It's a relatively hidden feature that many people don't know about, so probably developers don't care about as much either. And then we have an older version, even, of that protocol. So probably nobody really looks at that part of the code. But that means that it's very interesting code for us. Now, the way this chat encryption works is that once you send a message, generates a new encryption key and then encrypts the message with that key, with the symmetric encryption key, and sends it to the other party. And the receiver then sees a new message with a key they haven't seen before. So at that point, they're going to retrieve it from the sender, so they request the key using a request key message. And then the sender of the message replies with the response key message. And in this message, they encrypt the message key using the certificate of the other user. So in the request key, there was this certificate, and then they encrypt it to send it to the other person. And what we found in the code was that they allocated a 1024-byte buffer for this key. And then they had two variants in the code. There's RSA, and then it works perfectly fine. But it has also implemented some elliptic curve option that used some elliptic curve Div Yelman and then some AES. But in this case, they did not properly verify that the length of the decrypted result would fit into that buffer. So what we have here is a typical buffer overflow because they tried to write too much data, arbitrarily long data, into a fixed-size buffer to make it a bit more visual. So we, as an attacker, are sending a message to Zoom. And we like to send an encrypted message. And then Zoom says, well, sure, send me that encryption key, please. And then we send a very long encryption key. But Zoom then tries to put it into a buffer with just a fixed size, which triggers this buffer overflow. Now, this buffer overflow has a couple of pros and cons for writing that exploit. So one thing that's nice about it is that we can just send as much data as we want. There's no practical limit on what we want to override. There may be something in the network traffic or IxMVP packet, but it's a lot of data. So it's all no restrictions on the character set. We're not limited to U2F8 or something like that. And also, very nice for the competition, we can trigger this using only chat messages without the victim having to do something. They don't need to approve anything. They don't need to click anything. As long as they allow us to send them a message, which is one step they had to do it before, or they are part of the same organization, we can just send them this message and the buffer overflow triggers. But there's also a couple of cons which make it harder to exploit this. Now, the allocation size of that buffer is 1,040, which is a little bit more than 1,024 due to some overhead. But it's fixed. So we cannot make it larger or smaller. It's always that size. We're also limited to how long we go because it needs to be multiple of 16 due to certain reasons with the encryption. But the most tricky one here is the last one. So the buffer is created. And then we trigger the buffer overflow all when handling one chat message. So the reason why this is making us work harder for this, normally when you trigger one to exploit a buffer overflow, it's nice to put something in memory and then put something after it and then use the first object to overflow and then overwrite the second object. But you couldn't do that because it was created in an overflow in just one message. So whatever we wanted to override, already had to be there in memory. And this really made the exploit a lot harder. Now, we're going to walk through the various steps of the exploits. And then first down, we'll talk about heap grooming. Sure. Yeah. So there are four steps in every exploit. The first is grooming the heap. I will talk about that in a minute. Then you need to leak some information. We call it an information leak. That's because most things are randomized in memory. So you need to know where stuff is in memory. Then you need to hijack the control flow. You want to determine which function the application calls.  So let's start with the first one, the heap grooming part. So the goal of this step is to make sure that the application doesn't crash and make room for what we need. So we cannot trigger a buffer overflow. So we can override arbitrary data that's on the heap. However, we don't want to override random data. We want to override some very specific data that we put there. So we need to make sure that whatever we overwrite is behind the buffer that will eventually be allocated in an overflow. The tricky part here is making sure that the right object is behind our buffer in the heap. Because if another object is there that we didn't expect or encountered for, then the most likely outcome is that the application will crash due to some memory invalidation. So we need to make sure that the heap is in a predictable state. So for those who are not too familiar with the heap, the heap is something in software which is used for dynamically allocating memory. So if you at compile time don't know the size of certain objects, you typically use the heap for this. Those who know C might know the malloc and free function. Those are used to either request some space on the heap or return the space once you're done with it to give it back to the heap allocator. So how the heap is actually implemented varies by platform or even by any major or minor software update. So we were targeting Windows, and Windows has two implementations for the heap. The first one is the old NT heap, which is still commonly used. And you have a new segment heap, which is only used for, I think, metro applications and some other applications. But almost all applications use the old NT heap, and Zoom was no exception. So how does the NT heap work? Well, free blocks are ordered by size in a linked list. And whenever you request a block, it will walk that free list, and it will take the first block that fits your needs. So if you request 2,024 bytes, it will look for the first block that contains at least 20,004 free bytes. And if you deallocate something using free, it will merge adjacent free blocks.  One particular thing is that the NT heap has also a function which is called the low fragmented heap. This is used for allocation size that are very common. Then it uses a whole different heap algorithm. The low fragmented heap is triggered whenever you do 17 allocations of a certain size. So whenever 17 allocations of a certain size are done, all requests of that specific size are handled by the low fragmented heap. There is no going back to the NT heap once a particular size is sent to the low fragmented heap. So the low fragmented heap is used for common allocations sizes, and it is done so that you have less fragmentation, so less free space that you can no longer use on the NT heap. So similar sizes are handled by what we call a bucket. So in a range of 80 bytes, everything between there, so like 1,024 bytes up until 1,080 bytes, are all handled by what we call a bucket. And the thing with the low fragmented heap is that it is not deterministic. The NT heap is deterministic. You know, you can predict how the free list will look like, and it will always pick the same block so you can reason about how the shape of the heap will be at the other end. The low fragmented heap uses randomization, so it has no fixed block that it will return if you request some memory. And this is specifically done for making exploitation more difficult. So if something is in the low fragmented heap, it means that precise grooming, so making sure that the block behind our buffer it contains what we want it to contain, nearly impossible because due to the randomization. I'm going to demonstrate that here. This is the low fragmented heap for a particular size. It now has three buckets, but it's only using bucket one. And if you request something, it will just pick a random block in the first bucket up until the point that the first bucket is full, and it will then allocate randomly in the second bucket. So our original plan was that the buffer we can overflow is 1,040 bytes. And we tried to use the NT heap to shape the heap in a predictable state. But this is very difficult because the Zoom application, it creates hundreds of allocations every second. It talks to API endpoints, et cetera, et cetera. So the heap is really messy. But even if the application didn't do anything else, even sending a single message made it the heap in a very unpredictable state. Because for parsing a message, it would copy every string 10 times, et cetera, et cetera. So shaping the NT heap was proven to be very difficult. But with a second problem, and that was every now and then, the size we used, the 1,040 bytes, was already handled by the low fragment heap. So if that was the case, then all our shaping efforts were useless because it was handled by a completely different heap implementation. So if you read online about memory exploitation on Windows, they always say, OK, make sure that you're on the NT heap. Because once you're on the low fragment heap, exploitation is near impossible due to the randomization. But we couldn't make it work on the NT heap. So we thought, OK, there are people saying that, but we're going to try it anyway. So what we did was we made sure that the buffer size that we could overflow was on the low fragment heap and writer exploits working around the randomness of the low fragment heap. So how we did that was by making sure that we were the only thing that was making allocations in a certain bucket. And by just running our exploit multiple times, it could happen that in one of those attempts, the randomization didn't matter anymore because the allocations were right next to each other. So what we did was the bucket one has some random objects in it already. We don't know about because the application is an unknown state before we start our exploit. We sent a lot of messages from a particular size to make sure that all buckets are full. Then we deallocate most of the last messages we sent. And what that did was it made sure that bucket three was near empty. But the only thing we didn't delete was the last message we sent. So we made sure that the last message was in bucket three or how many buckets there were on the system at that time. But because we didn't delete the last message, bucket three was still the active bucket. So all allocations will now be handled by bucket three. And due to the fact that the buckets we chose, the bucket size we had was relatively quiet, we could run the exploit relatively safely multiple times to try to override the right object. Thais, can you tell us a little bit more about the information leak? Yes. So the next step for the exploit is the information leak. And the reason why we need this is that there's all of these annoying protective mechanisms in operating systems nowadays like ASLR. And this is a protection mechanism, address space, layout, randomization is what it stands for. And what it does is that it places everything in memory at random locations every time you launch the application. So we needed some way to know where certain things are in memory, like certain libraries, to use the code from that library. But it was randomized, so we needed to find some way to leak that information back to us. But this was quite a challenge because the buffer overflow we had was something that can write to memory. And we somehow had to turn something that can write into something that can read, like trying to read a book using a pen. So we had to combine it with another low-impact vulnerability that we found. At some point, we had decided that we wanted to leak an address of libcrypto. This is one of the libraries included in OpenSSL. We'll talk more about why we specifically wanted that library later. And the objects that we wanted to use, they had to fit in the bucket, otherwise our vulnerability doesn't affect them. But we also needed a way to get that data sent back to us. We needed to know what the memory contents are. But XMPP means that it's XML that has to go through the server. And if you send something that's not valid XML, then the server will close the connection, and it will not go to us. So sending that information leak over XMPP wasn't really an option. So instead, we started looking for a way to make a HTTPS request to us, directly to us instead of a Zoom server. Because this would be a channel where the connection is direct instead of to the server, giving us much more control and making it easier for us to send some weird data through it. And eventually, we found some weird way to do that. Now, the Zoom chat functionality has what's called a marketplace, which are basically bots that you can add to your account that you can then interact with through the Zoom client. And whenever you add a new bot to your account, you do that on a website. Then Zoom will start downloading the image of that bot to display it in the client. And what we noticed is that it sends that message to Zoom, but we can also send that message. And then it takes the domain marketplacecontent.zoom.us. And whatever path was sent by the server for the image is put after it. But as you see, what they send starts with a slash. But what if we started with a dot? Well, then it would start downloading that image from marketplacecontent.zoom.us.computs.nl, which is now certainly a domain under our control. So it would download that image from us instead of the marketplace server of Zoom. So by sending that message, it would initiate an HTTPS connection to us. And then the object that we wanted to use for our leak, we found the TLS1-PRFP key context object, which is in OpenSSL. This is an object that's created during the TLS handshake. To hash some data, I think. But one thing about it that's a bit annoying for us is that they create it, they fill it with data, and then once the handshake is done, they delete it again. So it's deallocated immediately after it was used. So that was a bit tricky. But it was a good target for us, because at the first location in that object is a pointer that we could use for our information leak. If we have that pointer, then we can compute every part of LibCrypto, and we know where everything in memory is. And importantly, that first pointer was not erased if the object was deallocated. So if the object was cleared, it erases some memory, but not this specific pointer. So this is the definition of this object. Not really easy to read here, but at the first slot, there's a pointer into LibCrypto. And because this one was not erased, we could leak it back to us. So we formulated the following plan. We used that vulnerability we had to set up two connections to an HTTPS server of us. And on one of these connections, we close it immediately after the handshake to make sure that these objects are in memory somewhere, although they are deallocated. Now, on the second connection, we request a path of 1,025 bytes, which is a size that fits within the same bucket. And then we use the buffer overflow to override everything up to the first null byte after that string.  And then when it sends that path to the server, it will keep reading on after the URL. And then it will also include that memory in the request it sends to us. So I'll try to make that a bit more visual. So this was the URL that we could make it perform a request to. And the way that C stores strings in memory is that it always puts a 0 byte at the end. So in this case, there would be a 0 there to denote the end of the string. And every function that works at strings just knows that it needs to keep reading up to that 0 byte, which means that you don't need to keep track of the length of the strings that you have. So if you would complete this request, it would go reading and then see that 0 there and stop. But if we trigger our vulnerability at this moment before we do this connection, then we start overwriting that data. And if you go all the way to that 0, but not everything afterwards, and then the connection is continued, then it continues reading after that buffer. So that data that's in memory there is now also sent back to us. And this way, we have read some memory that we needed to compute where the entire libcrypto is in memory. Now, this chain was very unreliable. I tried to do this, and then it worked once, and then it didn't work again for at least a day. And then it worked twice in the same day. And we had to get it to work within five minutes. So we really had to improve this to make it work better. But one of the things you could do is set up multiple connections to both servers to basically increase the chances of the objects being in memory at the right places. You could renegotiate the connection, which is a feature in TLS that you can do a handshake on an existing connection again, which is convenient because it was faster to renegotiate and open a new connection. You could trigger the build flow multiple times to increase the chances that we would randomly overwrite the right thing. And eventually, we got it to working reliably, well, good enough for the competition. But really, we spent a lot of time on getting this to work as reliable as we could. Still wasn't perfect, but good enough to actually make it work. And our next step of the exploit is hijacking the control flow, which Dan will talk about. Yeah. So we can somewhat predict the state of the heap. It's not perfect because it's randomized, but we can at least kind of predict that we won't overflow in anything important. We leaked some information about where our libcrypto is in memory. So now we're up to the third step, and then that is actually hijacking the control flow. So making sure that the application executes code that we wanted to execute rather than just continuing on with its normal execution. So how do you do this? Well, we can't modify any of the application codes because that's a whole different memory reason. We can only change data on the heap. So the goal of this change is overwrite something that determines which function will be called. So we could make it to call the function foo, for example, rather than the function bar it's supposed to be calling. So there are a couple of options for this, but the most likely one is to find a function pointer on the heap that we can overwrite. So sometimes on the heap there will be a pointer to a function, and if we could overwrite that pointer and that function pointer would be used, then we could determine which function will get called. The other option is a vtable pointer. Whenever a vtable is being used. A vtable is something specific for C++, but due to the fact that Zoom is written in C++, overwriting a vtable pointer is a valid option as well. The only constraint is that the allocation must be within the same buckets, of course, because otherwise we couldn't overwrite it. So let's look a little bit closer about what a vtable actually is. It's used in C++ for virtual functions, and basically a vtable is a list of function pointers. And every object in memory in C++ starts with a pointer to a vtable. Let me quickly demonstrate this for you. So suppose you have a class dog in C++ and you initiate an object for this. How this actually is stored in memory is at the first offset you have a pointer to the vtable of the object. So it's just a list of pointers to where it can find, for example, the function sound or walk. And right after the vtable pointer, there are all the instance variables. This is how in C++ an object is stored in memory. So this is all on the heap, or at least the vtable pointer and the instance variables. So suppose we could overwrite a vtable pointer and we could find a way to construct our own vtable somewhere in memory, so just a list of function pointers. We could possibly hijack the control flow because if that pointer gets dereferenced to look for a function pointer and we could determine which function that would be, then we have control over the program counter. So look simple, but that was quite difficult because first we had to find an object of the right size that was in our buckets. Then we needed to override that vtable pointer with a memory address we know about and where we can control the data, which is a whole different problem. And we had to make sure that the vtable was actually used. So the first step was, let's find a vtable pointer we can override that is actually being used by the application. So we spent quite some time on this and eventually we found the solution in this sound. Let's hope the sound works. So I'm so tired of this sound. So we call each other daily the whole day in order to generate that sound. So whenever you can request somebody in a meeting, so you can call somebody and whenever that's done, it will create an object of the right size for loading this sound from disk. It's just a audio file, it's on disk and it will load the file, place it in memory in an object with a vtable pointer and then it will play the sound and then it will use that vtable for the close to determine which function to use to close that sound again. It's a sound of, it's only one ring and it will constantly open the file close to file, open the file close to file, et cetera. This was an ideal target for us. It was of the right size, it was being used and we could override that vtable pointer. One problem was we don't know where our data is in memory. It's somewhere on the heap but we don't know where on the heap that is. We only at this point know a address of Lib Crypto. So we needed to make sure that we had some custom data at a well-known place. So we had a theory about this. Zoom is a 32-bit application and that means that the amount of memory that Zoom can use is very limited on Windows. It's only two gigabytes. So we thought, okay, what if we just take a random address in memory, just something which most likely doesn't contain anything? What if we can find a way to exhaust all memory? So what if we can make Zoom allocate some large space and if we do that often enough, at some point, some data that we control will be at that location because there is no other place to put it. So we were working on this theory and seeing from, okay, where can we find some object that we can control, contains our data, so we can test this theory. So one of the things we tried was sending images to the other party by just creating a very large image of 100 megabytes or 20 megabytes and then send that to the other party because Zoom has to show that image to you, so it has to load it in memory and if we send it multiple times, maybe it will get allocated multiple times in memory as well. So that was the theory. Only Zoom has some protection for this. If you send an image, it will show the image if the image is under, I think one kilobyte or 100 kilobytes or something. At least a very small amount and if the image is larger than this, it will first request the user if it wants to download this image. So that was of no use for us because then we required some user interaction. So for this, we used a third vulnerability and the last vulnerability. Zoom also has the possibility to send GIFI images to each other. Those are stored on the server of Zoom. Those are always downloaded and shown no matter the size because they think it's a GIFI with controlled data but we found some path reversal vulnerability on the server of Zoom. So we could actually upload a very large file and then send that file as a GIFI which would make sure that Zoom would download it and display the image regardless of its size. So we used a GIFI image that actually contained our V-table with list of pointers and we just send that image multiple times. We created an image of 25 megabytes and we send that 20 times. That means that 500 megabytes of the two gigabytes is containing our data. This was enough data so that we could predictably say, okay, this random address that will always contain our vague V-table. So we would first send this GIFI link to the other party and then we would call the other party, request them in the meeting and then we would overwrite the V-table pointer that would point to the close function. This is how we actually could hijack the control flow. So now we can control which code the Zoom application will run. So we can now divert it to different parts of the application but what we really want is to make it run our own code instead of Zoom's code. So we want arbitrary remote code execution. So one thing that you might be able to do is to construct a ROP chain but that needs to be on the stack and we have a buffer overflow on the heap. So first let's talk a bit about a ROP chain. So a ROP chain is a way to create a sort of a fake stack to make sure that whenever the application returns it calls another bit of the application. So in this way you can basically string together very small bits of code of the application that already exists to make it do something you want to do. So I cannot introduce new code yet but I can just combine different parts of the code to make it do something that I wanted to do. But we cannot do that yet because we don't control the stack, we only control the heap. So that's why we needed to find something that's known as a stack pivot and what this basically means is that we can replace the location of the stack pointer. So instead of overwriting a stack we just redefine the stack to be somewhere else in memory. But something else that we needed to keep in mind here is that there's a relatively new protection mechanism known as control flow guard. This is yet another protection mechanism against this type of vulnerability because it aims to prevent return-oriented programming. Because whenever you try to call a function pointer the compiler will insert a check that will look at that function pointer and it will try to determine if that's a valid start address of a function. So the reason why that's annoying is that in a rope chain you often just use some very small bits of an existing function but this is no longer possible because you can only start at the start of a function. You cannot just jump in halfway. So there's basically two ways that we could bypass control flow guard. First of all, we could call one function and that's basically it. But we really couldn't find anything that was usable for that. Or we could look at the library that's not compiled at control flow guard. And one thing we noticed is that that libCrypto library that we've been talking about for the information leak did not have control flow guard enabled. Apparently OpenSSL as a weird built system where control flow guard doesn't work for something like that. So that means basically two things. Any function pointer being called within OpenSSL does not have that check. That's not what we wanted to use. It also means that valid start addresses are not known for libCrypto. So we can just jump into any function at any location. So that's what we used here. We found a stack pivot gadget. So basically something that we could use to redefine the stack to be somewhere else which meant that we could execute more by using a rope chain. Then we used the rope chain to make some part of the GIFI image that we sent executable. So it was now data that we sent that was now also allowed to be executed. Though we could also only use the gadgets from libCrypto, of course. Then we could jump to the code included in the GIFI and then it would execute some shell code that we uploaded. Yeah, there was also a bit of difficulty with that because we didn't have the function that we needed. But luckily, we had a function that we could use to look up dynamically the address of that function. So we had to get module handle. We could look where kernel 32 was in memory. We could store that and then get the address of virtual protect. This is the function that we could use to make our code executable. And then we could call it to make the GIFI executable and then Jim do it to start executing it. Now we have a demonstration of the attack. What you see here on the left is a Windows VM and it will show that it's the latest version at this time. On the right you see the output of our exploit and we start by sending all of those messages for the heap grooming. So if you look very carefully at the top, you'll see that the counter is going up. It should go up to about 90, I think. And then after this, we start deleting some of those but keeping that last one to keep that bucket active to have the room that we needed for the rest of our exploit. There's a couple of other steps in here that we didn't talk about to basically make the memory optimal for our exploit. And now it's deleting those messages by deleting the, yeah, to revoke those blocks. Now we start the information leak. We make it connect to our HTTP server and in this case, we were pretty lucky. This needs to run in certain loops but in this case, we were already in the second loop. I think it succeeded. Yes, at the bottom there, it now shows the information leak obtained and it has devised with the addresses of LibCrypto. Now it's sending those GIFs to load the fake fee table and now it should send a call request. I think in this case it sounds only played twice. We don't have it in the recording, sadly. But we're also very lucky that it worked. Oh, thank you. And as a customary, we start the calculator. Many people wonder why is there suddenly a calculator running but it's basically to demonstrate that we can now run any application. It could be anything else. You could install some ransomware, whatever we wanted on this machine. As you can see, we can just also use other commands to basically take over that computer. Now we skipped over a lot of the details. There's quite a lot of work more involved here. But we have a more complete write-up on our website, so if you want to read that, you can visit that link. Or if you have any other questions, then please let us know or come visit us at our tent. Brilliant. Awesome. So if there are any questions, please line up behind the two mics here. Do we have any questions from the internet at all? No questions from the internet. Okay, I have a question. How long did it take you to do the whole process basically? Two months about. Two months. Yeah, it took about two weeks to find the vulnerability and that's basically starting from scratch because we hadn't used Zoom very much. So we basically had to go through all of the functions first. And in two weeks, we had the vulnerability. And then one and a half months to develop the exploit that you used eventually for the competition. And then we were out of time.  The two one and a half months was also because we have never done memory corruption on Windows. We've done a lot of it on macOS and Linux, but this was the first on Windows, so we had to learn all the Windows internals as well. So yeah, that's part of this. Yeah, awesome. So I think we've got one here. Go ahead. Okay, so first of all, congratulations. The work is amazing. Thank you. My question is about the path traversal actually. How did you know that the image that you uploaded on Zoom and the GIFs are on the same place? It was on the same host name. So, okay. Same domain name. Yeah, it was false.zoom.us. And because we were intercepting all traffic, we could easily see that it was very similar, but it was on a different path. I don't really remember the full path. But by sending something with some dotted flashes, it would think it's a GIFy, but then still download it and show it. Okay. And my second question is, how did you know that you will have enough, let's say, data after that null byte from the link, if you remember? So if the right data would be behind the null byte? Yeah. So basically, because you can meet another null byte just after a little bit of data. So how did you know that would be enough? Yeah, it would only work if they were right next to each other. Yeah. Which is also why it took a long time. So we had to retry quite often. So yeah, it might be that there's something else in memory, then it doesn't work. But if we're lucky, and basically the two things are, or basically there need to be three things in memory adjacent to each other. So if we get lucky and that's the case, then it worked and we got the information. But because we did all of the heap grooming, we could safely retry a couple of times until it would work. The heap grooming took anywhere between 30 seconds or five minutes, depending if we got lucky early in the stage or we have to retry multiple times. Yeah. And a funny question. Holden, there's a question at the back. Can we ask the question at the back? Yeah. Will this exploit continue to work if you have a different language, a movie language, or a locale, let's say? I don't think so. I don't see anything that is locale specific in the exploit. We haven't tried, but I think it will work. So we're not safe in Europe when we're not using English? No, no. And another question here as well. First of all, this exploit is amazing, so thank you for explaining it to us. Second of all, it took you guys two months to work this all out. For me, I'm a very novice hacker, I would say. And where would you say to start learning about this sort of exploitation? So just come work as a pentester with us and we'll teach you everything. And in a couple of years, you can do this. I'm working as a pentester elsewhere, so. But there are some documentation online about memory corruption, so like the basics, some challenge websites that offer some playground to do this kind of stuff. And one thing that I often suggest is to look at IoT devices because often exploitation is simpler there because you don't have all of these security mechanisms. Or maybe you just have a couple of them making it easier to get started with something. Okay, thank you. Thanks for the question. One last, anything been zoomed in from the Internet? Okay, great. Thank you very much. So that was the talk. Let's thank our speakers again. Thank you.


What is going on guys welcome back to the channel critical overload here some about scream sickness video here again today So we'll be talking about what you see in the thumbnail scream six without Sydney Prescott Now the short answer to the question of whether or not it could work is yes This could work because you would need to have a well-rounded script with great characters with a great narrative with a great get a great killer reveal of Great motivation, of course Doesn't have to be great like oh my gosh Wow Just something that's effective to still get your audience invested in the narrative without Sydney being present This is something I think they've done a great job at making making possible for themselves by giving us a great set of characters in Scream 5 while Tara's friends might not have been them Might not have been as developed as I thought they would have been when they were on screen They all still got to highlight their own personal traits make themselves stand out and they were all characters that I feel a lot of people were Growing fan showing favoritism towards in the sense that I want to see more of these people if they come back for more Which with Chad and Mindy who seemed of course at this point seem to be only ones out of Tara's friend group coming back along with her own sister I Think you have a chance to explore them a bit more since people already find them likable not everyone likes Mindy I can't admit that I've seen some people not not like that character That's that's that's you for whatever reason but go off the other thing you could do is again Introduce new characters like they always do and just spend time with Tara and her life in college her friends They're trauma from Scream 5 and now this this new ghost face that's gonna be out there And you can introduce Gail Weathers in a way by having them go to school in New York This will be an easy easy way to just have them go to Gail for help Sam isn't gonna get involved Gail gets involved of course Not only because she wants to help them but because of her own career Benefits and she'll get a chance to cover this story for her show and This would just be a way for her to have some conversations on her show of course talking about the things She's probably talked about already about the fact that she's helped survive or helped solve rather Five ghost face killing sprees now. There's a sixth one You know, it's just something that Gail could of course benefit from as well But mostly this could be someone who just wants to genuinely help these people We could learn more about Gail see a little bit more of how her life has been We could learn it if she's written that written that book about Dewey and kind of give her a focus the same way Dewey was a focus in five and then there could even be a bit of a bit of dialogue in the film Whereas disclosed that Sydney is not in town. Actually, she's she could be out of town. She could be on vacation And she's just not available to come come out here and help us They don't even bother them. They don't even bother to Reach out to her at that point Gail could be the one to shoot that idea down. No, don't bother Sydney She's she's out of town with her husband. They went on vacation with the kids We don't need to bother Sydney and what I think you could also do is explore this through a killer And a post mask reveal where they're explaining to the fact that they intentionally Themselves waited for Sydney to not be able to come help because they could be someone who idolizes Sydney They think she's the ultimate final girl because they themselves are a stab fan They're a fan of the real-life individual from that character. They love from the stab films And they just don't think that Sydney deserves to be harmed in any way shape or form They think her they think her narrative is done and they want to protect her as a final girl They don't want to kill off the best final girl that ever exists to them That could just be one kill this won't be their motive I think that you just be a bit of a bit of humor to kind of kind of shove in there While also poking fun at the fact that you guys didn't bring Neve Campbell back for the first-ever screen movie But you have a killer mouthing to your audience Why it might have been best for business and kind of selling you on why she's not here This killer thinks she's the ultimate final girl. They think her story is done They think she deserves some peace in her life and they would never want to take Sydney out, but They got some problems with Sam. They don't have problems with Sydney but they got problems with Sam and Tara and whoever else's their accomplices would probably not be as big of a Sydney fan as they are So they purposely could have gone out of the way to stalk Sydney before before they launched this new Ghost Fist killer spree and They're trying to just figure out. Okay. Well, how can I how can I get this going? Without getting Sydney involved because I don't want to hurt Sydney But I know that if I do start this one of her friends are inevitably going to reach out to her And cause her to come here and I don't want to hurt Sydney. I think she's the ultimate final girl This could just be something from one of the Ghost Fist killers that are involved with it this time around But they don't want to hurt Sydney and they purposely went out of the way to wait for her to go out of town Because they stalked her they waited to learn when she would be out of town and then they launched the killing spree um But yeah, giving us well-rounded characters exploring that friend dynamic between Tara chat and many a bit more Because there's already people who like them exploring the new characters all of that stuff would be something I think could make a scream six without sydney prescott work I'm not saying sydney wouldn't necessarily not appear in it because like I like you've seen the thumbnail What if she appears in the very very very last scene to set up a scream seven and I'll get to that in the second um When considering kevin's original ideas for five and six when he was going to do them sydney wasn't going to be involved in them Or even more so she wasn't going to be the focus once again Which we ended up getting in screen five a movie where sydney wasn't the focus and I think kevin's original idea for six Was sounding like it was going to be about gale weathers So if they do a more gale-centric narrative here They would kind of be following the template of what kevin originally was going to do anyway while while it's not His idea all the way since he didn't get to flesh those out uh sydney's sydney's lack of involvement and lack of being the focus was Showing signs of that from her Positioning in four where they were trying to shift the narrative from her already beginning there Uh, there was already things that kevin wanted to do as it pertains to taking the narrative away from her We know Ultimately, he did not finish finish. They did not finish filming the movie with his version They had I think erin krueger come in and finish it up and then they shot whatever they shot And we got still a a solid movie overall But with scream six sydney could still appear at the end You could have the ghost face killing spree get wrapped solved Bada bing bada boom sydney never showed up for that But sydney comes back in town And we could have a scene that flashes over to her coming back in town entering her house with with uh, Patrick dempsy's character of mark that'll be his cameo plus sydney's cameo They go inside the kids are going inside And we see from behind them as the doors closing of There's a killer outside or at least not even a killer Someone is standing there watching watching them But we don't see who it is the movie just ends all we don't see if it's a man or a woman even We just see someone standing there and then the movie shuts off I don't know how many people will feel about that, but it's setting up the seventh movie Let me know what you think about that down in the comment section below if you haven't already, of course Make sure you subscribe turn on post location in this video in the description I've linked some social media accounts on facebook twitter and instagram You can message me there, of course If there's any movies or reviews you'd like me to cover in the future with all that in mind guys I will see you in the next video


Hey, what's up guys, welcome to our training reviews. So pretty excited. I've got this new gimbal today. It's called the ISDEDI Mobile Plus. It's from a company called Hohehm. Now this comes at 89 pounds on Amazon. I'll leave a link in the description below. But today I'm gonna give you an unboxing of everything that comes with it and also a review of all the smooth footage that you can take with this gimbal so you get an idea of all the different things you can do with it. So let's just get straight into it. We will turn it high but now we're ready. Okay, let's go ahead and open this box. So here you can see it's got a nice silicone and fabric carry case. You have the Hohehm logo on there. There you have it. It's pretty straightforward. You have yourself a user guide. I've got yourself the micro USB cable. A little tripod. It's plastic, not heavy duty, but that's fine. And then you have the actual gimbal itself. So there's not a whole load of accessories. So it's very simple and straightforward. But sometimes I like that minimal kind of packaging so that you can get up and running straight away. So let's go ahead and review this gimbal. Right, so just to give you an overview of the buttons on here as well. So you have the joystick here. You have the Bluetooth indicator light there. You have the mode indicator light there which flashes in various different amounts based on which mode you're in. You also have the wide and telephoto zoom control there which goes up and down. Then you have this mode button here. So as you can see here, there's four different modes that's written down on there. Let me just come a little bit closer for you guys. So the first one it says PF which is pan follow. Then you have PTF which is pan tilt follow. Then you have all locked which is the third one and the last one is all following. So to get to each of these you can see that there's some dots there. So four dots for the last one, a single dot for the first one. So what you have to do is basically press this and depending on the number of dots that's what mode it will go in. So if I wanted all locks mode, I'll have to press this three times and it'll give you an indicator there on the mode light. And likewise you have to press this for the camera or the video recording button as well. Hold this down to turn this on and off as well. On the left hand side, you have a little screw port here. So in case you wanted to mount something like a external light or a microphone or anything like that, you can add your own accessories through there. Now it doesn't come with any additional accessories so you'll have to buy that yourself. Then inside here you have two ports. You have the micro USB charging port and then you have the actual traditional USB port to actually charge your smartphone using the gimbal. So I think that's pretty convenient. So on the back here, you have the actual gimbal control button to stabilize this back into central position. And then along the bottom as well, you have another screw to mount the tripod. So along the side of the mounting plate, you have another screw port here. So in case you wanted to add another light or a tiny microphone on top of your smartphone, then you can also do that by screwing it onto there. Then inside here, you have the lock screw to actually change the height or the width of the actual gimbal. So you can move this in and out and lock it into position. One thing I really like as well, as you can see from the design, it can actually rotate into portrait mode. So if you're doing some filming and it's on landscape, you can actually just twist this round like so. And then you'll be able to shoot this in portrait mode. So you'd have to adjust the phone a little bit just so that it doesn't hit the side of the axis here. But it's pretty solid. It doesn't feel like it's going to actually cause any damage or anything like that. So that's pretty convenient to have. And then this opens up both ways. So depending on the width and size of your phone, this should be able to fit most smartphones nowadays. Okay, so let me go ahead and turn this on. You can see on the right-hand side, you have four LED lights there, each of them indicating 25% of battery life. So as you can see, this is currently at 100% because I've just fully charged it. Now the gimbal itself is actually 3,600 milliamp hours. So that gives you 12 hours of working time and it gives you a full charge in about three and a half hours. If for any reason you have some problem using the gimbal and the axes are maybe drifting and they're not maybe smooth as you'd like it to, you can actually go into calibration mode. So if you hold down the mode button for a very long time and then you lay the gimbal down flat, then it'll go into calibration mode as so. So as you can see, the mode light is a solid green and this has gone into calibration mode. So I had to hold that down for about six seconds and it went into that mode immediately. Now that the mode light is off, it's now completed and I can start using this again by turning it on. Now I'm ready to connect this to my phone. I've got the Hohem iSteady Mobile Plus app. It's very simple to set up as long as the gimbal is on, you just go through the settings. Now I've paired this already, so I'm going to reconnect it. It's up and running. So I'm using an Android, but this is also compatible with iOS. I'll leave a link in the description of where you can download the apps. So there's various functionalities. I would definitely recommend using their app because you'll get all of the different functionalities and the modes to get the best video recording. So you have modes like Inception mode, 360 degree panorama, motion time lapse, hyper lapse, slow motion and tons more. So in the actual app itself, there's plenty of options. You have a little filter icon there on the bottom right. You can actually change the video and see in live view a different filter. I can go and cycle through all the different ones. It's very similar to Instagram. Some of them have actually the same name as the Instagram filters as well. So that's pretty convenient. I've not seen much features like this in other gimbal apps. So I'll leave it on original for now. On the bottom right, you have the video icon in here. You'll be able to go through all the other different modes like motion lapse, light rail, which gives you at night time, if you do some light streaks, it slows things down and gives you a long exposure of that. You also have time lapse mode, a very long exposure and then the standard video recording. In terms of the panorama options, you have panorama 180 and then a complete 360 as well. So if you wanted to get a complete view of everything around you, you can do that. There's also a phase tracking mode.  On the left-hand side, you have some filter settings if you wanted to change the focus, the white balance, the EV on there and also the ISO, you can do that from there. You can turn flash on and off, switch between the front camera and the back camera and then go into other phone settings to change the video resolution, camera resolution, photo sizes, noises and all this kind of stuff. So plenty of options to play around with. Okay, so that was the unboxing. Now let's go ahead and I've got this set up with my phone. So I'm gonna go out, start doing some filming and hopefully you guys will like the footage. So let me know what you guys think. I never thought breakups were pretty.  Started the words that I completed. But that was then so long ago. I told you then like I say now that we were golden.  Oh how I wish I didn't care that we were okay. That I could just erase rewind, let it roll me back in next year. And I'll be fine by then, girl she's quite funny. I'm fine by then, the fresh air back at the spot where you first kissed me last year. And now I'm fine again. My point of view, this has probably been the easiest gimbal that I've set up. It's just straight out of the box, put your phone in, turn it on and you're ready to go. Obviously you need to download the app and I connected that immediately, didn't have much problems with that. So all of the links of how you can download the app and all of the information of where you can buy this gimbal is in the description below. If there's anything specific you'd like to know about this version of this gimbal, then do drop a comment. Otherwise I hope that was useful. I'm gonna have a lot more gimbals I'm gonna test in the future. So make sure you subscribe so you don't miss those ones. Otherwise thanks for watching guys and I hope you liked this video and I will catch you at the next one. Take care.


Hi everyone, Joe for jasperjasecasewrakes.com coming at you with 2019-2020 Panini Chronicles basketball fat pack rake number 7-5-5. At the end of the break, we're going to give away these seven teams right here. So at the end, we'll re-randomize your names and name on top gets the king, second name gets the Celtics, so on and so forth, so the top seven will be guaranteed a team and pick a team number four, which is coming up in a separate video, but the break itself first. Big thanks to everyone here for getting into the action. All 30 teams are in. Let's roll it. Let's randomize it. Six into two, eight times for names and teams. Different dice roll for the giveaway. One, two, three. Add them down to Nicholas after eight. Six into two, eight times for the teams, one, two. And eighth and final time, we got the wizards down to the Charlotte Hornets. All right, so here's the first half of the list right here, and there's the second half of the list right here. All right, let's just print and rip. Here's the final printout right here. Thanks everyone for getting in. Nice Giannis right there. Giannis is in LA tonight, I believe. Hawaii and LeBron facing. LeBron James, well not tonight, LeBron James still out with that high ankle injury. Anthony Davis still out with that calf injury, but Andre Drummond should make his debut tonight. All right, there you go. All right, so nothing too crazy there. Let's flip back. Lakers, that was Brian, you'll get the LeBron and Sean Maddock, you'll get the Giannis. All right, now, from Brian Croft down to Adam Cupperman, let's grab everybody's names. Let's pop them into this list here. New dice roll, let's roll it. Let's randomize it four and a five, nine times, and it's going to be the top, let's go back here, it's going to be the top seven after nine. So we're just only randomizing names, not the list of teams right there. So good luck, one, two, three, four, five, six, seven, eight, and ninth and final time after nine. All right, sorry Danny, just a little short, but I appreciate you and everybody right here for giving this a shot. Congrats to the top seven, you have teams, and pick your team forward coming up in a separate video. It's Martin, Martin, Adam, Martin, Brian, Sean, and Marty. Make sub, nice, nice run for you here, you got a few teams in the next break right there. So we'll put little rooftops next to everyone's names so you know you won those spots, but Marty you have the Kings, Sean with the Celtics, Brian with the Pistons, Martin with the Heat, Adam with the Magic, Martin with the Raptors, and the Pacers. And there you have it. I'm Joe for JasperJasperCaseRakes.com, we'll see you for that prism in another video. Thank you. Bye. Bye.


So those are the things that actually if the Dexcom does not give you a tandem pump a signal for 20 minutes or more, which can happen sometimes after a shower, some people say that the water gets in there, there's some lip of a signal loss, you may be kicked out. But from my experience, it is not that easy to be kicked out as Metronik. So I think tandem has advantage here in terms of getting kicked out.  But if you're sick, your ketones are high, don't expect the pump to take care of you. That is not designed for that purpose. There's an important clinical pearl for you.  So now we are going to talk about the different feature which, again, educational parts out of all these differences.  So if you're on a Metronik pump, here are some educational points for you. Now, if you're treating hyperglycemia, try to treat these low blood sugars with more caution.  If you're eating 20-30 grams of carbs normally to fix it, just eat 10-15 grams. It's just going to be a lot easier to correct those relatively mild low blood sugars. On the other hand, that's true for both Metronik and the tandem, but for Metronik, it is also very important to enter your blood sugar calibrations or when it says blood sugar required or BG required. Not every time the pump asks you, BG required doesn't mean that you have to calibrate the sensor, so it is just sometimes a requirement that the pump company came up with for the safety feature. So if you do not enter the BG, you're just not going to be able to stay in the Oda mode, and once you're in the outside Oda mode, you're not as safe in terms of keeping your blood sugars under control. And you guys really should also remember that you cannot really put a temporary basal, so when you're in the Oda mode, the pump is in charge, you cannot really modify much of anything. You can always, for both pumps, you always have to enter your carbs so you can get a bolus. Again, you know, this feature is valid. It has to be done for both pumps. But if you want to do a dual bolus or a square wave bolus, that is not going to be possible when you're in the Oda mode.  But in crazy situations like that, like in a sickness or in a super crazy vacation or something like that, you may not be able to rely on your pump. So you know, let's say you're in a party, you're not going to be able to do a dual wave or a square wave, but if you're not in the Oda mode, you should be able to do that. And you can adjust your basal rates when you're not in a regular situation. Let's say you go out on a vacation where you're super physically active, you may just want to reduce your basal dose quite a bit in consultation with your diabetes specialist or a necronologist. On the other hand, with the tandem, there are a couple things that are different from an educational standpoint. When you have tandem, you can actually do an extended bolus, but that's only up to two hours, so be mindful of that. It's still possible, but it is not as free. On the other hand, with the tandem insulin pumps, you should not be overriding your boluses because remember, tandem insulin pump will give you a bolus already. If you are going to hit 180, if it is predicted to be 180, you will get a 60% of calculated bolus. So if you are trying to overdo it, it may cause a stacking and that may not be to your best advantage. On the other hand, the pump parameters can be adjusted with the tandem pump, so if you need to adjust your insulin carb settings, you can do that, but sensitivity in terms of the active insulin time, I'm sorry, in terms of the active insulin time, you're basically stuck with the five hours. So if you need to make an adjustment there, you should in consultation with your necronologist. Again, giving a bolus is a requirement without overdoing. Again, treating low blood sugar with tandem also, you'd have to be less aggressive and just keep those all in mind. Also remember with the tandem insulin pump, if you're exercising, you can put it in an exercise mode or if you're on a vacation where you are actually physically much more active then you can set your exercise mode frequently and the sleep mode also can help you to keep a tighter blood sugar control and wake up with a nicer blood sugar bag. Lastly, let's talk about the sensor differences. So that is important because DEXCOM is really a good sensor. It allows you to make clinical decisions, so you can basically go with the numbers of the DEXCOM. The only time, because you don't really follow the DEXCOM is if you feel different. If you feel low, but DEXCOM is saying that, oh, you're 100, these devices are not perfect.  DEXCOM will allow you to do calibrations if you want to improve the sensitivity factor. If you just started the DEXCOM, you may want to give a couple of hours for it to warm up. So in the first couple of hours of starting your sensor, you also need to do a finger stick if you need to check your blood sugars during the warm up period. Again, the DEXCOM can be remotely monitored. It's usable for both Android and the iPhone on the cell phone. The sensor for the Metronik, unfortunately, cannot be used on an Android right now, so you have to have an iPhone. But if you have a pump which uses the closed-loop system, then you actually see the blood sugar number with the shield sign on the pump, so you don't necessarily have to use actually a phone. On the other hand, for a guardian sensor to keep going and to help with the closed-loop systems, you have to do two to four calibrations at least a day. And you cannot really make clinical decisions in terms of your calculating your correction insulin. You have to do a finger stick and enter to the pump in order to get a correction insulin. So you cannot just take the sensor value and put in the pump and then just use that. The pump will not just allow you to do that. And if you do not do that, then you will be kicked out of the OTA mode. So it's very important to do your calibrations to stay in the OTA mode. For Metronik, if you stay in the OTA mode 80-90% of the time, you will be very, very successful. It just takes a little bit more effort and we just talk about differences. So it is up to you how you want to proceed between the different two pumps. With a tandem, ALAK DEXCOM has a sensor a little bit more. Bottom line though, it's not always the car, it's most of the time the driver. So as a patient, you are in the driver's seat and you are operating these pumps. So if you are not a very adherent or motivated to get things done and keep your sugar under control, these pumps are not really miraculous, so it's not going to really help you much. It helps mostly to motivated individuals. On the other hand, I will also applaud Metronik for their clinical support team. Their educators, their nurses are very supportive, they are very available. So as a result, Metronik wins the clinical part of it. And tandem and DEXCOM, they are great companies technologically. They have a few features that I like more than Metronik. But when it comes to the clinical service, providing educators, being very helpful on the phone, etc. I think they have a long way to go. They are newer companies, they are doing great things for the patients. But again, I think in my practice what I typically end up doing is if they are asking my opinion between the two pumps, if you are a young individual, tech savvy, you don't really need a lot of support from the educators or from the technical people, then I think you are good to go with tandem and DEXCOM. I have a lot of elderly patients who are really good technologically, but overall speaking, my older patients tend to need more help with the education, understanding the carbohydrate counting, how the pumps work, and the technical parts. And I'm glad that the Metronik nurses are really helpful. They are very genuine and sincere, help patients all the time, anytime we need them. So for those patients, I tell them, hey, you know, you may have to do a few more finger sticks, but I think it's worth it because you have a great educator and you have to really understand that you need a lot of support. Somebody who is 25-year-old, they just don't want to deal with the finger sticks. They are too busy and they just know how to download things on the computer and they can set things up themselves technically and they are quick learners in terms of how to operate the machine and how to count carbs. For those patients, I think in my practice I prefer tandem and DEXCOM combination. Another important fact that guys live in a real world, the tandem and DEXCOM together is right now covered by Medicare. Metronik, on the other hand, could not get their sensor covered by Medicare. So if you're a Medicare patient, you're not going to be able to get that closed loop system at least for a while. And they're working to get their system going. They're coming with a new sensor that will not require finger sticks or maybe require just one or two finger sticks at the beginning and nothing after. And they're getting there. So the competition is good. But as I said guys, if you are as of February, we are actually in March now, as of March 2020, Metronik and DEXCOM together will be more covered by Medicare versus Metronik, not as of this time. So if you have any questions guys, if you want to be seen by us remotely, again, we are not a typical diabetes practice. We basically see patients remotely. So we can see your DEXCOM data remotely. We can see your POM data remotely. We can help you 24-7. Every week you can send us your data.   You're not going to suffer from the consequences or complications of diabetes. So again, I'm Dr. Ergin. I'm an endocrinologist from sugarmds.com. If you have any questions, concerns, please let us know. You can email me at ahmet at sugarmds.com. Or you can just call us, text us at 1-800-644-3963. I hope that helped you and have a wonderful day.