Hello everyone, welcome. I'm Tom Dwenger from the Google TV Hacker. We're going to be talking about hacking the Google TV today. It should be interesting and a lot of fun, so let's get this started. First off, why do we do it? For science as you can see. Moving on, the Google, so basically the Google TV Hacker team is consisted of six hackers. We kind of all met up on RSE and got together and started hacking the Google TV. Our primary goal was to bypass the hardware and the software to allow for unsigned kernels and give us more open to the system. Today we have found multiple methods to accomplish this, so we're pretty happy with that. We're going to be dropping some of those today, so you guys should see some new stuff that you haven't seen yet from us. Our first accomplishment was on the revue, which we got a 500 dollar bounty to gain root on that, and Amir is going to be talking about how we managed to do that. Just kind of basically going over our members today. We've got Agent HH who's out in the audience up here in the front. He's not afraid to wear a pink shirt. We got CJ, the destroyer of the words, Gino Fage, Fonster. He's, I don't know if he's here or not. He's, there we go. Yeah. It's kind of a mystery to us. We got MBM who couldn't be here today. Oh, he's on the cardboard over there. He's known for founding the OpenWRT and tossing 251 children in a well. And then we got T-Dwaying. That's me. I'm a software developer turned superhero. And then we have Amir, which is not very good at creating bios, so we don't know what he really does. And then we also have a special guest, Bliss, also known as Dan Rosenberg. He's a Bond and Reality researcher who takes on sick pleasure and exploiting anything with the CPU and he once punched an android in the face. Moving on. So basically, I'll go over just the basics of what the Google TV is. It's a system platform that bridges between the TV and the Android device. It kind of creates a overlay instead of having to switch your source on your TV. So it's a direct input into your TV that you don't have to switch, which is kind of nice because then you don't have to do that. It comes out of the box with, you know, Chrome, and then it also has an IR transmitter that talks to your TV so you can change channels and other fun stuff that you can do with the remote, but you can do with little keyboards and stuff that they give you. The system re-receives the over-the-air updates from the OEM manufacturer, so they're pretty slow about it as we have found out. They say it's coming soon and soon is six months. The platform contains Chrome, as I stated. It's basically a forked version of what you have on your computer. It works pretty well. It contains Flash, but the plugins and extensions are disabled at the moment. We're currently looking into that, see if we can get it on there, which would be nice. So basically, comparing the Android versus the Google TV, there's many differences. Google TV has a Chrome browser box right out of the box with it, so you can browse the web and it's a nice Chrome browser, as most people probably prefer, like me. The Gen 1 devices all use x86 processors, so that was kind of different. It's the first time I've seen anything with Android that had x86, which causes all sorts of problems with the Android market and games and stuff not being able to run. The initial release didn't have the Android market, which was a big let down, because there was no apps that we could install or do anything when they first came out. Eventually that came out and they're still lagging on apps, but we're hoping more and more come out in the next few months or so. Unlike most devices, the ADB is used over Ethernet instead of a USB, so basically there is only one white listed IP address that you can connect to the box at any given time. So if you have multiple computers like me, you have to use the same one to do any hacking or anything on it, which is kind of a pain, but most people probably only use one PC. Just kind of basically the go over the differences between the x86 and the ARM. Most commonly deployed boxes that we have for the Google TV at the moment are x86. The newest devices are all ARM based and from our understanding everything going forward is going to be ARM based, so we expect to see a lot more apps and stuff that actually functions on these boxes, which would make it more useful. So the devices that we currently have out are the Sony boxes, which is a Blu-ray player and the TVs. We got the LG TVs, the Vizio, which is coming soon, and the Logitech review. But we'll talk more on the ARM devices a little bit later in the talk here.  The big issue with the Google TV that we found is the content providers. So basically what they do is when you log into your open up Chrome and you go out to content provider, they're checking the user agent and the flash version, so they're basically looking in, see what you're on, so they're blocking all that to you, which is kind of the big downside at the moment, but we bypass that on numerous systems and future ones we plan on doing the same. So the content providers basically don't want us to do anything with that. So basically just to briefly go over the Gen 1 boxes, the x86 ones, they have the Intel CE4100 processor in it, which is an atom processor running at 1.2 gigahertz with an SOC on it, so basically they can create a chain of trust of which I'll be talking here shortly about of how they lock down the boxes. The review is running a slightly slower processor, which is the CE4100, and the Sony TV and the Blu-ray player are running the 4150, which is slightly faster. Just kind of to go over the boot loader, we have a signed boot loader, which was created using the Intel CFDK or else known as the Consumer Electronics Firmware Development Kit. The boot loader, as I mentioned before, it's signed with the signature and they use a chain of trust to prevent you from loading anything basically onto the device other than their signed software. Intel supplies a stage one and a stage two for their boot loader and the SDK that they have. Logitech utilizes both of these. The Sony however only uses the stage one and then uses their own prior NBL for stage two. Just to go over the chain of trust here we this kind of breaks it down for you guys on how the train of trust works on the Sony boxes and then Logitech box. So the first step of it is the SOC which decrypts, verifies the signature of stage one of the CFDK, which then once the CFDK boots it moves on to check the signature and decrypts stage two. Once we reach stage two that boots into this kernel and verifies the signature on that as well. So it's not as simple as rewriting that so we can run any new kernels. Once the kernel takes over, at least on the Sony box is what it will do. It checks the SHA1 hash checks and ish files and verifies all of them so we can't just go in and replace them to hack the boot order on that and then it all after it does that it checks the RSA verification on the nish.rc and then the nish.eagle slash shura.rc based on which device you have. Just to briefly go over the kernel security. The kernel requires modules to be properly signed so we can't just create a new module and insert into the kernel so that's something that we've found a way to overcome and we'll be talking about that as well. All partitions except for data and cache are read only so that prevents us from changing anything in the system which would be useful if we could. The ADB shell only allows you to read write to folders with the shell permission which is your basic read write of pretty much nothing on the box. There's also an access dev slash mem which is restricted to the normal shell user so you can't just go into memory and mess with stuff either. And we also tried using all the current known Android phone and realties on the Sony and the Logitech review with no avail. They're pretty good about patching everything and they're pretty quick once we release anything so hopefully we release something here today that people can get on it before it gets patched in the next week or so as we've seen. So basically I'm going to pass this off to Amir who's going to talk about the current devices that we've got. All right. Hi everyone. My name is Amir. So we're going to get started with the Logitech review. It was released in October 2010 and has a full size keyboard with a built in touch pad. It was originally priced at about $249, was later reduced to $199 and was later discontinued and priced at around $99 to, I mean I've seen it around $82. The big thing is that even though it's cheap and it's discontinued it's probably one of our favorite devices. The full size keyboard is really nice and it has all the same functionality as all the rest of the boxes. So if you are looking to get in the Google TV and you're looking for a cheap device to get you started it's really nice. This is the Logitech review motherboard. We did our best to take a multimeter and label the pin outs the best we could. There were still a few that we didn't get like the unused switch and J24 which is an unknown header on the board but it also has a UIRT pin out. It doesn't have pins already soldered into it but it's fairly easy to get to. It's not vias or whatnot. There's also an Intel XDP debug header which requires some proprietary software to interface with and there's a unpopulated SATA header which we haven't had very much luck with. The review recovery is a standard Android 2e recovery. It gives you basically four things you can do. Reboot, apply update from USB, wipe data of factory reset and wipe cache partition. All update files provided are RSA verified before the box even attempts an installation. Our first hack was UIRT on the review. We managed to get this done about two months after the box was released and essentially it was just that you take a, well first of all the box does a mandatory update when you first plug it in. It makes you update to the latest version and it basically kills this hack. The reason we found it was we actually got lucky and plugged the box in before even trying an update and noticed that in recovery you get a console shell. So really easy to mistake, they pushed it out, they didn't think anyone was going to plug it in, plug UIRT, header into it and give it a shot but they didn't know that we were going to buy five boxes at 250 bucks. We're not the brightest. So it required a virgin review. It still works on newly purchased reviews since it was pushed out from the manufacturer with this problem and as mentioned earlier it requires soldering to four pads on the board which are really easy to do other than ground and it allowed us to read write the file system which was great because the kernel has some built in functionality that disables us to be able to write to which we can talk about later. So this is essentially my recursive keyboard setup. As you can see I have way too many keyboards plugged in and that's in my kitchen. My wife is very, very patient. That was up there for like two months and she tolerated it and didn't kick me out. So it's nice. What we did was we created a manual update process that didn't check any of the signatures. Since we had that old UIRT hack or the hack that we found the downside was that it only worked on the unupdated version. So what we had to do is we wanted people to have the most recent version with the same vulnerability. So we created the manual update process but didn't do any checks on signatures or anything along those lines but still mirrored the exact same update process. We continued to release the modified updates until they started encrypting them and then we had to jump through some hurdles plus at one point they jumped to 3.2 and we decided to start looking for other vulnerabilities. This was also our first content provider bypass because that's what people really wanted with this. They were tired of the Hulu and content provider battle with Google and we really wanted a way to stream, you know, TV shows and stuff to get us away from work. So the content provider bypass was extremely simple. What it was was essentially we take the flash version and we manipulated by changing one byte. Literally we could change an aid to an F or whatever and they will just allow it because they strictly have a blacklist type setup. As you can see in the picture we have GTV switch to ATV and just doing that and changing the user agent in Chrome which you can do just by going to settings and typing in anything you want will get you the content provider bypass. So with that we released that and we got a surprise message from Logitech. They essentially removed the recovery menu that I mentioned, the Android 2e recovery menu and they put our names as the menu items and a ROT 13 ciphered message. They removed all the functionality to install manual updates and so they crippled the ability for users to recover their boxes unless they received an OTA update which it was a really bad move because I mean even on the forums, the Logitech forums, which we troll all the time, I assume they troll ours, they were multiple users who probably could have fixed their box if they still had access to this manual USB update mode. Each of the current GTV hackers members' names at the time which it's changed since then but at the time were listed in there which was a little eerie. You know they're watching you but you don't want your name listed in the firmware. So yeah if anyone's here thanks but you know we never got our message back whatever. And this is essentially what it looks like. We had to do some jerry rigging to get this to show up like it did but the message reads A at GTV hackers congratulations if you're reading this please post a note on your forum to let me know. Winky smiley face. So I don't I mean is this a good enough message? We posted it on the forums if anyone here is from Logitech or Google or something please respond back it's been a year and a half. So then we got started and we started working on hardware hacks just different other things that we could do. We got to the flash sabotage. It's just a name we coined. I don't know if there's an actual real name for this but what happened was since they removed the update functionality for manual updates we still wanted a way so that we could update the box if we could get just any update zip file. So we found out that when a an update is done an intent file is placed in slash cache slash recovery slash command when the box is booting it checks this intent file and it will know where the update is and what to do but if only we had a way to write cache that's where the flash sabotage comes in. Essentially cache and chrome are ext partitions stored on NAND flash and it's actually connected the NAND flash is connected to a USB controller which essentially just makes it show up as a flash drive on the device. By simply cutting that line out and adding a USB header to it we could input our own flash drive and take over cache and chrome. So then we had our way to send updates. It allowed us to fix soft bricks and it most of the time if a brick happened it was and we were able to fix it with this it was because they corrupted the boot image. It also allowed us like I said to push OTA updates but it didn't help us fix anything where we really screwed up. So we had to go another route and CJ was brave enough to solder a NAND programmer to his board. As you can see it's a you have to be really brave and have a lot of tape. We have some alternate points if anyone wants to give it a shot that we can pass out but this was an early picture. It allowed us to essentially test all the stuff we wanted to you know to verify the boot loader was actually signed you flash modified one to see if we could get it to boot and just give anything a shot that we really wanted to without a risk of having to go buy another expensive crappy device. But yeah so we had to add that picture. So we wanted a software route on honeycomb builds.  Okay my bad this goes to bliss sorry. Hey I'm Dan he was trying to steal my thunder. So yeah as he was saying we wanted a way of providing a software route for the honeycomb. These guys reached out to me they had previously done the UART hack and gotten root that way but that got fixed and pretty much users were left without a way of having root access on their own devices. So they reached out to me because I like beating up Android and I took a look you know as we said before they're pretty good about patching. They have this device had no unpatched publicly known vulnerabilities on it when I looked at it. And additionally they didn't have any of the sort of trivial vulnerabilities that tend to plague a lot of the OEMs that have to do with you know simple bugs with world writable directories and playing games with symbolic links to write files you shouldn't. You know none of that was there on inspection. But I looked a little bit deeper and found that there are some very suspicious looking world accessible character devices in slash dev. So just a little background traditionally Linux supports a file called slash dev slash mem that originally allowed users to map physical memory into a processes user address space. Since people realize that this was you know fairly dangerous you know you could make root kits this way things like that. There's a configuration option called config strict dev mem that prevents even route from mapping most of RAM using this mechanism. So it's reserved for some you know I think it's some IO related thing now. It's the X server exactly. So you know this wasn't a viable vector for us but I noticed that on the review there was a similar device that Intel was so kind to include called slash dev slash dev mem and I was like what the hell is this? So this device is world accessible so we can interact with it and on inspection it behaves the same as the original dev mem but it doesn't allow mapping addresses lower than the last page frame of physical RAM. So what does that mean? So we are not allowed to map kernel memory as an unprivileged user using this device file. But on X86 Linux supports memory mapped IO so accessing addresses higher than physical RAM actually results in interacting with hardware registers corresponding to device peripherals. So this means that this device is giving us the ability to poke and prod the hardware of the device directly which is a brilliant idea. So this seems like something that we can use to somehow escalate our privileges. So there were several options available you know we have access to the PCI buses we have access to the interrupt controllers maybe we can reprogram them to do something crazy we had access to the E1000 ethernet controller which you know maybe we could do things with DMA with that but after weighing all these options I ended up choosing the Intel CE NAND flash controller as the device that I would leverage to gain root privileges. The first reason being it supports DMA direct memory access which is a mechanism by which hardware can write directly to physical RAM without intervention from the operating system. And secondly because it had an open source driver which really helps in that I didn't have to do any sort of hardware reverse engineering or any risky guess work where I basically just tried plugging things into random hardware registers and hope I didn't turn the device into a brick. So what can we do with this device now that we can play with it? So by using this dev dev mem file to map and write to flash controller hardware registers we can actually cause this controller to DMA directly on top of kernel memory in a page length increment so 4096 bytes. So fortunately for us the address of kernel memory that we can clobber doesn't have to be aligned to a page boundary which could have been a restraint but this device actually supports non-aligned DMA. Unfortunately the data that we're scribbling over using DMA isn't really controllable by us because it's just sort of raw NAND data that's living below the file system layer you know you don't even really have a hope of getting file fragments or anything like that because of ware leveling and all that. So it's basically just garbage that we can clobber a page of kernel memory with. So the question becomes what do we clobber? Like how do we leverage this capability? So we need a target in kernel memory where it's okay to wipe out an entire full page with random garbage so that you know what I would normally go after would be some sort of function pointer or an entry of the system call table where we can somehow trigger invocation of that and it would point into you know our payload and then we could run things with kernel privileges. But the problem was all the targets that I'm aware of we couldn't do it this way because clobbering an entire page of memory from that point on tended to break the kernel and the device immediately crashed. Then I try to be clever and go after something specific to Android which is the Android properties page. So Android has this shared page of memory that represents sort of global system settings and if you overwrite certain properties the Android debugging daemon will actually run as root and give you a root shell. And I actually got this working and then I found out that on this particular device they modified the ADB daemon to never run as root which really sucked. So I was a bit stuck for a little bit and then I remembered that I actually had already solved this problem in a different context. So the technique that I'm using here I actually talked about with John Oberhide like a year and a half ago and it's a technique that we called like stack jacking which we thought was a really funny name. So in this case a processes kernel stack is a great target on Linux by default these kernel stacks are eight kilobytes big so there's plenty of room and most of it is generally unused. So you can wipe out a full page of memory there and it's not going to break anything. And the next thing is at the base of a processes kernel stack on Linux there's a structure called thread info and this has stuff that's particularly useful for us to overwrite using this DMA. And in particular there's one variable called the adder limit that I chose to go after. So the adder limit is basically it represents the boundary between user and kernel memory. So on Linux by default the first three gigabytes of an address space are user memory and the top one gigabyte is kernel memory. On the review it's actually two gigabytes and two gigabytes and I haven't figured out why they did that. And whenever the kernel is copying data from a supposed user land address to a kernel address it checks is this user land address actually below this limit otherwise you know you could read from a file descriptor right into a kernel buffer. So if we can overwrite this particular variable which is at the base of the kernel stack with a high value then that will allow our process to read and write to arbitrary kernel memory because all of these sort of access checks will pass. The way we actually find out where the processes kernel stack is is a little bit complicated. The gist of it is I leverage another vulnerability to leak some uninitialized bytes from the processes kernel stack and then do some fancy statistical hand waving and you know resolve the address. You can just believe me that it works and the code will be public and this is all implemented in a library that I published like a year ago called with KStack. So here's that thread info structure which lives at the base of the kernel stack that we're going to clobber using DMA. You'll notice that I don't know if you can know there's no mouse. Yeah you can see that at our limit variable and it clobbers we're going to clobber everything from that point on. So we're also going to overwrite the restart block function pointer which is it actually gets invoked when system calls have to be restarted for certain reasons and you can manually invoke it as well and then we're also going to clobber this sysenterreturn function pointer which is a real pain in the ass because this is actually a pointer to a userland address where the kernel will return execution to the process when it is returning from a system call that was invoked using the sysenter mechanism. The other syscall mechanism being interrupt 0x80. So by clobbering this we can no longer use like glibc library functions because they all use sysenter by default and when those functions return it'll go to this random address that we've written there instead of where it's supposed to go. So we had to fix that up too. So here's what the whole exploit looks like just summarizing all that into one page. So we use this dev dev mem file to map the NAND flash controllers hardware registers into our address space. We leverage this kernel info leak and do some magic to resolve the address of the current processes kernel stack and now we know that there's that thread info structure at the base of it. We write to specific hardware registers that we sort of learned about by reading the Intel NAND driver to trigger this DMA on top of that offset corresponding to that adder limit variable from the base of the kernel stack and then we pray that the random garbage that we wrote there happens to make this adder limit variable high enough so that we can read and write to arbitrary kernel memory. And using that new capability we fix up that sysenter return thing. We manually invoke all of our system calls using int 80 from then on. Fix the sysenter return function pointer overwrite the restart block function pointer to point to our payload that will escalate privileges and then trigger it. Our payload gets executed we escalate our privileges and we win.  The gist of it is poking and prodding hardware registers like this is never a good idea and in this particular case it conflicts with what the driver's usage of this hardware. So when you trigger the DMA the hardware sends off an IRQ saying oh I'm done doing DMA and the driver receives it and goes why did you just tell me that I didn't ask you to do that. So and then on Linux the default response to a spurious IRQ is actually to ignore that from then on. So at that point your NAND flash controller can no longer perform DMA and your primary storage goes down and the box is totally useless until you reboot. So you know I have to, that was a weird phone sound, so you have to I toggle an IRQ bit on the actual in the appropriate hardware register to prevent it from firing that off when the DMA is complete but it's essentially a race condition and you know that really lowers the reliability of the exploit. And the other problem is when we're doing our DMA we basically just have to pray that the random data that overwrites this variable is something favorable to us. So this only works like I don't know 20% of the time if that but it's good enough for homebrew and it'll get people's devices rooted. So lastly as these guys mentioned the review, review, review, review, the review has code signing on all of its kernel modules so you can't load arbitrary kernel code into memory. So the way they implement this is they actually add a new elf section to all the kernel modules called dot signature and then when you, when you load a module it validates that signature against public keys that are stored in the kernel. But now that we have root it's actually really easy to shut this off because it turns out that that same dev mem device if you're root allows you to map RAM just like an unrestricted original slash dev slash mem device would. So we just map the RSA verify function which I actually just guessed you know it seemed like it was probably important and and replaced the first bytes of that function with an x or eax eax return which is just a return zero. So now the verification function will always return success and you can load arbitrary kernel modules. So next CJ is going to talk about Sony. So hello everyone I'm, there we go. I'm CJ Hayes going to talk to you about the Sony Google TV devices. My first question anyone from Google or Sony around here? Audience if so I'm sorry about getting busy next week. So the generation one Sony Google TV devices include a Blu-ray player which is the GT1 on the left and the televisions including a 24, 32, 40 and 46 inch GT1 on the right. I'm sorry that should be a GX1. The hardware is identical apart from the obvious differences of the fact that one's a TV, one's a Blu-ray player. You can tell by the GT1's motherboard that it is considerably bulkier than that of the largest check review but it is built like a Sony. I mean it's very heavy and it's populated with debug ports which is very great. At least three Uarts on board and it contains a CE 4150 processor at 1.7 GHz. Now our very first attempt was SATA sabotage. We noticed that the box had an internal SSD. It's connected over an SATA bus. Use the TDK GB driver RS2. However that featured AES encryption on the flash. So we couldn't just pull the flash, dump it, modify it, stick it back. Instead we just tapped into the SATA bus. Our very first attempt was to tap into the bus, hook it into a computer but we got no way since there was an ATA lock on well the SSD. And since the cable and the cable was kind of I guess cheaply soldered in by myself, it wasn't very sturdy. So instead of doing that, soldered a new cable and hooked it up to an external hard drive which allowed us to access the entire file system, read to it, write to it and also downgrade. Since the cash politician stored a flag on the box that kept track of what version the software should be at. So we use that to look for flaws. We initially downgraded to the very first version and started looking there. So the recovery system of the Google TV is far more interesting than that of the Logitech review. But like the review it also has the update from USB features and it also has a few more other interesting features such as service mode that lets you set certain IDs for ACS and what not. However the entire series of the recovery script is done through pretty much a large script. Runs a shell script, probably not the safest thing to do, we'll get to that in a moment. And it outputs logging to the UART which we will use in a moment. And it's worth mentioning that Sony updates RRC4 encrypted well it's an RRC4 and it's all. And they are also RSA signed. Of course. So we saw this in the logs, the first line, can anybody see the obvious problem? If nobody gets it, which I'm sure some people do, but they're being quiet, the very first thing returns a wild card that's directly passed to another shell script. It's a big flaw, it was never validated. So using that we could craft, yes, a package name. If as long as we had, we put some semi-colons in, it matched the wild card, passed it to the SH and we're able to get local command execution. Which is pretty awesome since they never checked it. We initially started with a script called t.sh which would pretty much spawn a shell over UART and also telnet and from there we were able to dump out the entire recovery file system and really examine it for more flaws. However this exploit was patched in the 7 2011 update. We were checking around with it, patched. We still had the hardware exploit talked about but to quote the tech blog and gadget they stated about our review exploit. It's not exactly what we call an easy jailbreak. It's how it requires a soldering iron, an end-fault procedure and a logic check review that's never been powered on. But it looks like it's possible to route a Google TV after wrong. That was four rather large pads. The Sony would have, you'd have to remove four surface mount capacitors and solder them in. I'm sure some of you could do it, most people couldn't. So that was not a viable option to release to the public. Getting back to the UART, there was an active UART line, output only for logging. And after our initial hack with the replacement of the SSD, we were able to achieve a root console in Linux. And using that root console we dumped out the system memory which showed the existence of NBL which was Sony's second stage boot loader that Tom talked about earlier. And looking forward a bit we saw that there was the existence of a shell and after some memory reversing we found out that if we hit the escape key repeatedly when the box boots up, actually MBM did but he's not here, it would bring us to a password prompt. And after more reversing on his part the magic password to bring up a shell was console underscore on. So the console comes on. NBL had options including loading files into memory and executing from internal flash or network via TFTP. That'd be great but we couldn't just stick an unsigned kernel and have it boot. The kernels were of course signed. And the insecure booting features were disabled on production units. And since NBL used signature and hash checks similar to the normal startup mode we couldn't do anything. But do happen to run that recovery version I spoke about that was patched in 7 2011 we could reload it. So this picture shows the initial boot up, shows us entering a password and then we boot over the network to a TFTP server the exploitable recovery version and initial RAM disk. It takes a few minutes but then it will drop us to a root shell which is perfect for what we needed. And it gets even better since the system when you boot via TFTP the system doesn't unlock the ATA the SSD on board. The kernel panics in drops to a shell. We don't even have to do anything past that which is awesome. So the end the exploitable recovery the system boot binaries are stored not on the SSD but on a separate flash located at devglob underscore spectra A2. And since I mentioned the ATA was locked but the flash wasn't we could write to it. So we replaced the new recovery version that was signed with our old exploitable but signed recovery version. Since now we had an exploitable recovery there was no need for you out and thought was we could either wait till the rumored 3.2 release to release the exploit last September 2011. Google and Sony took until December unfortunately. So come to 3.2 release in December we don't really want to give up a boot loader password being found. It was great fixing boxes and it was a pretty cool exploit. So we spent about 2 weeks looking for bugs. We found plenty of bugs including leveraging sim links and zips and unzips and creating files and removing files but we could never get one to execute but we rarely got to know the update process. So the next one shows the update process pretty much recovery mounts USB to temp mount disk B1. It looks for the package list wildcard then it passes it to package update.sh which then copies the file to cache and then the package update unzips the build dot prop and displays it to the user before verification mind you. If the update is accepted it's copied again to cache then it's verified but when they copied it to cache they never checked if there was already an existing file in cache. So this is essentially what we did. Since the Sony recovery mounted EXT2 and EXT3 partitions with no mount parameters we could use a block device on our USB drive to write to a device note as root. So we started with three flash drives USB1, USB2, USB3. USB1 just had a build dot prop it didn't have to be signed it just prompted the user one to switch. USB2 contained the block device that we would write to the box and USB3 contained a full image of the flash stored on the system. So we'd first do we'd insert USB1 it prompted us if we wanted to update this was before the verification but after the initial copy I'm sorry to take that back it was before the verification and before the initial copy. So we'd swap it out with USB2 which held our block device that we labeled package underscore list underscore gtv hackadodzip we'd hit okay it would copy package list gtv hackadodzip as a block device to the cache partition then it would error out since it wasn't validated but that's perfect that's what we wanted it then instead of rebooting or deleting the files it would drop us back to the main menu. From the main menu we repeat the process insert USB1 which would get us past that first prompt and then we'd swap it out with USB3 which contained our image of the flash file system. When we hit okay it copied our new modified image with an exploitable recovery of the flash file system right over to the block device and doing that we were able to rewrite the internal flash only using software which was great. So now assuming all that went correctly which every now and then if somebody copied a file wrong it could go go pull up but then you could use the boot loader to fix it. Assuming that went correctly we used the local yeah the local executable not executable local code execution recovery exploit and our exploit we had a large script that one ran would repartition the internal SSD because we needed a little more room it would copy boot to our new a new partition it edit the initial boot to include kexec files and hijack the initial boot process to call kexec. Now if anybody doesn't know according to Wikipedia kexec is a mechanism of a Linux kernel that allows live booting of a new kernel over the currently running kernel. Now kexec can be built into the kernel but most people don't especially not if you don't want people running unsigned kernels. It wasn't so we built it as a kernel module took a little bit but we got it in there. kexec allowed us to boot the system have it kick over in less than one second and load our new unsigned kernel. But as Tom mentioned the Sony box after checking checking the boot loader checking the signing of the kernel the kernel's the kernel arguments also had a hash an SHA1 hash on the init and the init RSA verified the init scripts. So we've had to find a place to jam something in there the chain of trust needed to be broken. And we could break it a little further on the process but the issue was the platform security firmware would kick in and panic the kernel so we couldn't do that. So we looked for an attack vector and we found e2fsck now if anybody doesn't know it does a file system check it's one of the first things ran before anything is mounted. So we were able to attack that and that was stored in in e2fsck which is mounted from devsdea1 on the SSD that we could now write to in our exploitable recovery. So we replaced e2fsck with a script that mounted system inserted our kexec modules and kexec loaded a new kernel. A new kernel apart from having no hashes, no signatures had a few other tweaks including not signing the init.rc the init.eagle or serr.rc it also modified the init.rc to read write everything set our secure to zero our debugable to one and we had Xenofet sorry, a may have made a script that would mutate the flash plugin totally randomly. So no two boxes would have the same flash plugin and it would also wouldn't randomly mutate it to GTV which would defeat the point made sure to check for that. So you could watch Hulu or whatever else was blocked on the Sony Google TV. So now I'm gonna pass it back off to a man to talk a little off topic about the boxy. All right, so this is a little off topic portion but what happened was that we were looking to port the boxy to the Google TV devices. Now boxy runs a C4100 just like the Google TV so we thought it'd be fairly easy and we actually did get it working Downside was we were lacking certificates and whatnot to get Netflix working to get the box to where everyone would want it. We also discovered that we hate the boxy because it is counterintuitive to everything you'd want it to do. If you have a boxy we have a route for it we're about to drop so enjoy. Yeah, and the boxy hacking community wasn't very friendly to us as it's mentioned at the bottom. So this is about Google TV so we're gonna make this pretty quick. Essentially, there's a software local command execution exploit that's as simple as dropping a semicolon into a certain field in the settings menu and throwing whatever command you want afterwards and owning the box. It's perfect. I don't know how it was missed. I don't know why there's still people looking for this route that we'd been talking with them about for like two or three months but it was incredibly easy to find. I literally just went through and put semicolon reboot in every field. There's also a hardware exploit which is a little more difficult which involves, there's two vias on the board that are kind of hidden and you just scrape away at them a little bit but if you solder a UIRT adapter to it it'll just drop you into a route shell which they also didn't fix. So between those two you can route a boxy very simply in two different methods. Essentially at the bottom we have this example which is semicolon sh mount label custom.sh so you can run so you can run more than one script. Let's get to, okay, do it real quick. We're gonna make this just real quick because we're running low on time. Essentially we go to menu showing that it's up to date. Go to network, SMB client which is our service which is the settings menu. And I, in this example I entered in a semicolon reboot in the share password which is a required field. I just felt like throwing it in there but the actual effective field is share work group which there's a semicolon reboot, semicolon and exit off and reboot. Just that easy. So, so that's that. Now we're gonna let Tom do future devices. So I'm gonna go through the future devices here fairly quickly for you guys if you need more information. There's Google. So basically the last few months Sony has released a new box. Unreleased is their Blu-ray player that's coming out we think in what October or something. We're not quite sure yet. They got the Vizio that's on pre-order.  It's only 99 bucks. We highly recommend that. It's pretty cheap. There's LG TV that we don't have too expensive for us. This slide just kind of goes over the basically the specs on all the new devices. This just tells you more about the Vizio specs and what's kind of out there. There's supposed to be a Blu-ray player by them coming out in the future. There's just kind of a brief overview of the LG TVs. We don't have, like I said, we don't have these. We don't have $1,200 lying around just to mess with the TV to break it. So, Amir is going to talk about the timeline now. Actually, I'm going to skip the timeline because we're running low on time. So, yeah, look at it. Everyone good? Cool. Good. Next one. So now we're going to talk about the Sony NSZ GS7 which is the newest line of Google TV devices in the first release device. It was released this month. We have the teardown posted at GTV Hacker and there's a CN2000 adapter on it which is the same that's in the NSZ GT1. You can buy it at MicroArch C-Cars websites. We'll have a link posted on our website for where you can get it. It costs about $2 and it can help you have a solder-free solution to root the NSZ GT1, but unfortunately not this device yet. Yeah, timeline, we rooted it the next day. We were pretty proud of that because we got it from a few guys at Google I.O. They went, they got the box. One guy met up with CJ here in Boston and sold it to him for 200 bucks, which was awesome. And another guy from Rootswiki donated a box to myself. Unsigned Colonel's still in work in progress and we're here so we didn't have a whole lot of time to try to finish that. Hopefully soon we'll have it. We're not going to release this one yet until we have it because we want the best for the community. Let's go to the demo. Essentially we've, to not give away exactly what we did, this is just showing the fact that it is rooted and we have ADB set up right there. We dropped a sue binary on the system, gave it the correct permission so that we could just sue up and install SuperUser.APK. And so you can see CJ showing the build number, has his laptop open, he's going, logs in through ADB, types ID so you can just see that we're still shell. Check sue, you can see that SuperUser APK just prompted the device to say that we had root and we're all done. So we need on that one. And yes, we have questions in track two. If anyone wants to drop by, we love questions. We also have our wiki, our forums, our blogs. We're on free note, IRC channel, GTV Hacker. Stop by, we're friendly, we don't bite. And yeah, thank you guys, we love you. Woo!


hallmark card when you carry enough to send the very best tonight from Hollywood the makers of hallmark cards bring you the first in their exciting new series of broadcasts on the hallmark hall of fame each week hallmark will bring you true to life stories of actual persons who in their own way have contributed to a better world for all of us to live in presented on the hallmark hall of fame by our distinguished host mr. Lionel Barrymore and welcome to the hallmark hall of fame let us know the Bible says but to praise the famous we must know them truly you do know the heroes of bronze and marble and monument and song but too many heroes men and women alike have gone unsung without applause they earned fame without receiving it those people who service sacrifice and devotion achieve great things too little known to us hallmark respectfully dedicates this hall fame and tonight hallmark honors Henry Miller Shreve as we tell the true and exciting story of the man who fought in superboards to bring steamboat to the Mississippi and push the frontier back and now here is Frank Goss from the makers of hallmark cars when you want to remember your friends there's one way to be sure the card you send receives an extra welcome look for that identifying hallmark on the back when you select it for words to express your feelings and designs to express your good taste let the hallmark on the back be your guide for that hallmark tells your friends you cared enough to send the very best Lionel Barrymore appears by arrangement with Metro Golden mayor producers of the bad and the beautiful starring Lana Turner Kirk Douglas Walter pigeon and Dick Powell and now here is Lionel Barrymore with your hallmark hall of fame river steamboats their pilots skippers the ledsman eternally taking soundings in the tricky waters Mississippi where the Robert E. Lee raced the natures while America waited on the livery waited for the Robert E. Lee mocking rips mortars all energy and tearing an American right down to their kills and how many of us know about the man who was responsible for steamboats and their mighty commerce on the father of waters listen to the war can do the bar post above St. Louis 1810 how many right now but dad wants the walnut gun stock he was looking at and the neat foot oil and I believe excuse me one river pilot can you help me sir well excuse me oh I beg your pardon miss barge men will bar a load of first down the river from the Ohio you're what I need a pilot from here to New Orleans you'll need more than that I never heard a trade coming down this far from that far first gonna carry trade from New Orleans the Great Lakes and back he's my father would you like to speak to him yes I wouldn't his name Alonzo Blair I'm Henry Miller Shreve come with me Henry Miller Shreve is many things in 1810 the river was a yellow noose to trap ships and men and he guides an immense 95 tons this time he has a wife with him Mary be near the shore and that's what we are and I'm proud of Fulton thought so New Orleans just handsome as tub that ever drew fresh water shows and snags and and currents and flood and sunken wrecks and shifting channels and all yes the reefs and we can't avoid them or break a boat to match wood don't you believe in a merry I just say let's do it now we're young and tough and can swim timber topples in the stillness of the new world timber for a new ship Fulton had his folly but Henry Miller Shreve had his tub of steam at last the steamboat enterprise they kindly to steam or steamboats I'm not a bit worried you know not a bit I'm embarrassed is me I'm worried Mr. Henry Miller Shreve that's right Sergeant orders from General Andrew Jackson sir General Jack you're not under military orders let me read it Mary powerful British fleet has landed an army near New Orleans ma'am General Jackson has been attacked Chomet below here on the river guns and ammunition down the river to show men unload your cargo for Louis I'm afraid Louisville have to wait you may find some British guns commanding the river above your destination sir one pass gun for an unarmed steamboat at night of course ma'am Henry you'll wreck the enterprise on our first trip that case we build another enterprise wouldn't we marry somehow for General Jackson Sergeant puts about in the swirling treacherous river beats cautiously towards Chomet few miles below New Orleans dark not a sound from the steel engines not a light warn the men not to stir their fires spark from the stacks we may be dead men I said tiptoe on the yellow water Henry Miller Shreve your ship and your dream may die by gunfire tonight all by Mississippi mud tread lightly enterprise go softly softly softly I do think so beyond any possible enemy gunfire this blind drifting is dangerous a bit longer mr. Gillis a bit longer but the river is notorious here some day I mean to prove that steam can tame the Mississippi I'll need my boat for that what if we lose her to the show and I lose her to the shows not to gunfire very well nowadays it seems to be a common complaint among parents that there aren't enough constructive pastimes to keep the children busy during their free hours as one mother put it they dance and sing and paint and school but once they're home they try to annihilate each other with space guns well that may not be the case at your house but you know there is one easy way to teach the youngsters to use their hands and to be thoughtful of others at the same time just supply them with hallmark make your own Valentine kits each of these colorful kits contain several Valentine's the youngsters can make with ease you can choose from simple punch-out designs or Valentine's that actually move after they're put together or Lacey hallmark Valentine's with little figures and pop out springs best of all they cost just 29 cents 59 cents or 79 cents a kit including mailing envelopes you'll recognize hallmark make your own Valentine kits by the familiar hallmark and crown on the package the symbol you always look for when you carry enough to send the very best in enemy guns and the treacherous river in dead darkness Henry Miller Shreve's enterprise brought the badly needed arms to Jackson's army then with a war over and cargo is loaded onto the idle enterprise excited preparations for the long anticipated attempt to reach Louisville by steamboat to rubble bursts again ready to cast off again that tragedy may hold progress in the river for a fatal generation Fulton's New Orleans failed Mary who shall succeed you Henry America has no time to lose were a small new nation in a society of giants we must grow strong quickly or fall again into the yoke of powerful I believe that Mary but this is Mrs. Shreve madam sir I am here in the interest of Mr. Robert Fulton inventor of the steamboat who also holds the exclusive franchise to operate his steamboats on the Mississippi River I hadn't heard of that if you persist in your attempt to reach Louisville Mr. Fulton will bring legal action but if I succeed it will be to his advantage so far your steamboat has killed a number of its crew it also supplies to our troops Mr. Fulton is convinced that your present project can only end in failure that will cast discredit on the steamboat well then perhaps I have more faith in the steamboat than it's inventor Mr. Shreve you will be enjoying from moving your boat from this war to Louisville you will be arrested a working toward the same goal each according to his own conscience if I were in Mr. Fulton's place I might do just as he is doing and he would do just as I propose to do we're that close in spirit and just what do you propose to do for the present good evening cargo along the river it's now a never shuddering its way northward yellow Mississippi great war slithering over the plains Memphis Henry you hear what everybody said flood waters at Louisville it's been getting worse and worse fighting the current in the high water that's your boat to marry medicines blankets lots of things and they all can be used up there Mary Louisville's cut off if we do the river will have started to fall disease and hardship at their worst you get lost in those waters there won't be a true channel anywhere blind allies and dead ends everywhere you will hang the boat up on a reef and and break in to and rod in the river it's your boat to then the mighty oh I water slick and featureless and deadly night the widening flood waters are a shoreless sea unearthly and desolate then just around the bend wherever the bed may be in that waste of water Louisville head and the worst to come why aren't we getting faster soundings from that lightsman Mr. Gillis keeps fouling his line and submerged trees and fences we can't founder now the people of Louisville have heard our whistle they're counting on us I know that for myself Mr. Gillis selfie no time to reverse it now Andrew Jackson himself Robert Fulton is a very powerful man Mary couldn't arrest us up in flooded Louisville but he came back here to open in the Mississippi River to the steamboat and an immeasurable commerce on the river you're further charged with bringing aid and comfort to the United States forces at New Orleans as though sir this was not enough you then committed the offense of turning your vessel about to bring relief and life to the stricken people of Louisville but that's how I read it station and humanity to an American frontier you were sure the progress and prosperity of America on both shores of the Mississippi perhaps as far as both will be among the first to applaud your service to America and future of America on the Mississippi excuse me a moment general certainly sir mr. Gillis had to calm us and the building of America he did more he invented a snag boat to clear the rivers of sunken logs and other obstacles with this boat he cleared the tremendous log jam that had blocked the Red River of Louisiana for hundreds of years during that time he camped at parents bluff where today stands the thriving city of Shreveport a city named for the man who we honor tonight on the hallmark I'll be back in just a minute to give you a little preview of next week's story but first here's a word from Frank gosh who's been reading some love poems that's right mr. Barrymore the other night as I browse through my family books I came across a volume of love poems by James Whitcomb Riley it was an old volume long on a print and nestled between the pages was a handmade Valentine someone had written on it in a round childish hand to the only girl in the world from your devoted Jimmy now I assume Jimmy was one of my grandmother's young Swains because in those days all Valentine's were made by hand and sent only to the object of one's affection today of course our habits have changed most of us like to remember our relatives and close friends as well as our husband or wife or sweetheart on February 14 and it's such an easy thing to do when you can choose from the big collection of hallmark Valentine's at your favorite store you'll find there's a hallmark Valentine that seems custom made for everyone dear to you gay amusing ones to bring a smile to the lips and a tug of happiness to the heart and you can be sure of it the hallmark on the back of every Valentine you may or will carry an extra message for it means you carry enough to send the very best and now here again as mr. Barrymore you know as I was listening to Frank I was reminded of one of my very favorite quotations Leibniz once said to love is to place one's happiness in the happiness of others yeah and I suppose that's the one main purpose of Valentine's Day just to stop a moment and let our friends and relatives know we love them just one little gesture in a busy day in this troubled world that sure needs a lot of the spirit of love yep Valentine's Day is a day to place our happiness and happiness brother mr. Barrymore whose story are we presenting on the hallmark Hall of Fame next week oh oh you've got me philosophizing about the spirit of love in my neighbor and all that stuff well I almost forgot well next week we have another true-to-life story this time about a woman a remarkable woman whose courage and bravery were dedicated to the saving of lives at sea her name was Ida Lewis and her inspiring story is an exciting one which we'll call woman against the sea hope you'll all be here listening our hallmark Hall of Fame is every Sunday our producer director as William Gaye our music was composed and conducted by David Rose and our script tonight was adapted by Milton Geiger until next Sunday then this is Lionel Barrymore saying good night that are sold only in stores that have been carefully selected to give you expert and friendly service remember a hallmark card when you'll carry enough to send the very best Henry Miller Sree was portrayed by Lamont Johnson with Barbara Eiler as Mary Polly Bear as the storekeeper Tom Tully as the sergeant James McCallion as the sheriff Ted DeCorsia as Andrew Jackson and her Butterfield as Mr. Gillis every Sunday hallmark cards presents two great programs for the whole family's enjoyment the hallmark Hall of Fame on radio with host Lionel Barrymore and on television with Miss Sarah Churchill consult your paper for time and station this is Frank Goss saying good night to you all until next week at the same time when we present another true-to-life story of actual persons who in their own way have contributed to a better world for all of us to live in next Sunday we honor Ida Lewis on the hallmark Hall of Fame


Good morning. Welcome to morning prayer this morning.  What an awesome day it is to draw near to the Lord, draw near to His presence, worship Him. Just remind us that the Bible talks about from the rising of the sun to the setting of the same, the name of the Lord is to be praised. The highest calling that all of us have is to minister to the Lord and the minister with the Lord. So worship is our ministry to the Lord. Intercession is our ministry with the Lord. It's where we join with heaven as those who stand on the earth in intercession. But we're going to begin most of our prayer times by going directly in the ministry of worship and praise. But over the next couple of weeks from May 7th to May 28th, we've been taking the very first part of our prayer meetings and joining with millions of intercessors around the globe and praying for and interceding on behalf of the nation of Israel. So this is called the Isaiah 62 fast. For those of you who maybe are new to this initiative, you can look it up. It's online. Isaiah62fast.com where there's lots of resources where literally there's millions of people on every continent, nation of the earth that is interceding all at once for three weeks for the people of Israel, for the Jewish people, the nation of Israel. So we're going to continue that today this morning. And then we're going to go into a time of worship and then prayer as well. We're so glad you're joining us this morning. But let's turn our attention to Psalm 122. David writes this. He said, I was glad when they said to me, let us go to the house of the Lord. Our feet have been standing within your gates, O Jerusalem. Jerusalem built as a city that is bound firmly together to which the tribes go up, the tribes of the Lord as he decreed for Israel to give thanks to the name of the Lord. Their thrones for judgment were set, the thrones of the house of David. And then verse six says, pray for the peace of Jerusalem. May they be secure who love you. Peace be within your walls and security within your towers. So this morning we're going to join in and we're going to pray over the city of Jerusalem, this ancient thousands and thousands of years old, but a city that the Lord loves. So would you join me this morning?  And I just want to encourage you that as we pray for this, you might feel like, I'm not an intercessor, but yes, you are. So you standing on the earth with God's Word in your mind and in your hands declaring it in agreement. It's not just you praying, your voice is joining in with a symphony of thousands and millions of others going up before the Lord this morning on this behalf and God responds to that. So Father, today we come before you. And as we always do, Lord, we don't come in our own strength or own qualifications. The Lord, we come because we are those who've been qualified by the blood of Jesus. We come with our conscience and our mind and our soul sprinkled with the blood of Jesus, our Passover lamb that speaks of better things, the blood that declares us righteous, the blood that has made a new and living way, the blood that was sprinkled on the altar by our great intercessor, Jesus, Yeshua, the Messiah. We stand on earth agreeing with heaven today over the city of Jerusalem, the city out of all the cities on the face of the earth. You declared this city is the city I will rule and reign over all the universe from. This is the city I will establish my throne upon. This is the city that I will put my son, God in the flesh, on a throne of David in which he will rule and reign over all the nations of the earth. It's the city of Jerusalem that your son redeemed us back to yourself. It's the city of Jerusalem that Abraham willingly put his son, Isaac, on the altar. It's the city of Jerusalem that David won. It's the city of Jerusalem that he said, I will give no rest in my eyes and I will not crawl into my bed until I have established a resting place for the Lord in this city on Mount Zion. And so Lord, today we turn our hearts and we turn our eyes to the city of Jerusalem, the most contested city on the face of the earth and the history of the world. And it's a city that you are not done with. It's a city that Jesus, when you return, that is the city you're returning to. Your feet are going to step onto Mount of Olives and it's going to split into and all of your enemies are going to be defeated. You've marked it out and said, this is the city of the great king. So Jerusalem, Jerusalem, Jerusalem, who persecuted the prophets? Jerusalem, who even at times missed the day of your visitation. Jesus wept over you. Today our heart weeps over you. We join in and we say, Lord, surround Jerusalem. Find it up with your presence that every promise that you have made around the city of Jerusalem would come to pass. Lord, that your presence would be poured out on the city of Jerusalem just as it was in Acts chapter two. You said that there's coming a day when there's going to be a Joel chapter two outpouring of the Holy Spirit as Zechariah 12 pouring out of the spirit of grace and supplication of all your people in the city of Jerusalem. So today we join our hearts with the heart of the one who sits on the throne. The blood of the lamb was poured out on the rocks of the city of Jerusalem and forever and ever and ever that city is going to resonate with redemption, with covenant, with promises, with expectation, with prayer. We cry out for the city of Jerusalem today. The city surrounded by walls, a city at times surrounded by nations, the desire of nations. All of your enemies look at this city and say, we can destroy the purposes of God by destroying this city. But we say, Lord, it's the city of the great king. We pray for peace over the city of Jerusalem today. Peace be within your walls. Peace be upon your people. Peace be upon the city of Jerusalem today. In Jesus' day, the city of Jerusalem, extermination and eradication of them off the face of the earth and Israel as a nation. Lord, today we pray and we ask, hold back the tidal wave of terrorism, threats of the surrounding nations and their evil regimes, Lord, and that you would hold back the hand of the enemy in every plot and every strategy that he has. We're trying to raise up a bit of terrorism to terrorize the people, to get their eyes off of who you are. And God, we're praying right now that in the nation of Israel, we believe and we know, Lord, that your hand is staying every attack of the enemy against them until your purposes are established in the earth and in Jerusalem. Lord, we're not content to say, oh, Lord, just protect Jerusalem the way that it is. But we're praying today that your purposes that you have over that great city would be fulfilled. Even as we approach the return of our Lord, God, we know that difficult times are coming to that city.  So we just declare prophetic promises over this city, Jerusalem, the city of the great King, the throne of God, the presence of God, will be firmly established within your city limits.  It would be canceled. Lord, we pray for you to set angelic watchmen, Michael, and angelic legions around Jerusalem and around Israel to defend and to defeat every satanic strategy against your people so that the gospel may flourish in the nation of Israel once again. Establish the walls both in the spirit and in the natural to defend the city of Jerusalem today and in the city limits of Jerusalem and Israel in the surrounding area. We pray even in this hour prayer would not just be raised up for Jerusalem, but from within Jerusalem. We pray, Lord, that worship and adoration and intercession would ascend out of the holy city before you day and night, God, that it would be a first fruits of what is coming, that the same spirit that was poured out on 120 in an upper room in Jerusalem would once again be poured out upon those whose hearts have been turned towards you. Lord, we pray today from within the city of Jerusalem, even the Palestinian believers would pray for Israel and those messianic believers would worship you in the spirit of truth and holiness and that, Lord, you are worthy to receive praise from within the city that you've marked out and said, this is my city. You've not given up on it. It's still your footstool. And so, Lord, let incense arise. Let incense arise. Lord, let praise, let intercession literally raise up prophets and prophetic intercessors to this day in the spirit of Simeon and Anna, who know how to pray, seeing and interpreting the times and the epochs in which they find themselves in. Lord, that there would be thousands that are praying together and by themselves for the purposes of God to be established over this most loved and most desired city. Let Zion be a praise. Let it be true when it says praise is waiting for you in Zion. So, we're praying for that, Lord, that it would not be a dry city, a city that just is a relic of a time when God moved there, but you'd begin to pour out the rains of refreshing, the rains of refreshing of your presence there, just as you are in other places on the face of the earth today, that your agenda and your purposes would be fulfilled. Again, Lord, we join our hearts and we say, fill the bowls of heaven over your purposes for the Jewish people. May they cry out to their Messiah in this season and see and recognize Jesus as Messiah and to these things this morning. We join our hearts and we say, amen. We say, amen. Wherever you're at, I want to encourage you. Let's just minister to the heart of the Lord. We're going to go into a time of worship and I want us to engage our hearts and I want us to lift up and adore the name of the Lord Jesus. Psalm 102-12, you, O Lord, are enthroned forever. You're remembered throughout all generations. We enthrone you with our praise that you will be lifted high. You're above all. God, we thank you that you're authority. We thank you that it rests on your shoulders. God, we ask right now that there will be an enthroning of Jesus, a magnification of Jesus, a glorification of Jesus, all worth, all power, all glory, unto the Lamb, who is slain for the redemption of all. God, we ask, Lord, right now that there will be an enthroning of Jesus, specifically over the nation of Israel. God, we ask, Lord, enthroning of Jesus, a glorification of Jesus, a magnification of Jesus that you will be enthroned by your people. We ask, Lord, in this day and in this hour that there will be an activation and opening of eyes and ears unto Jesus, that there would be the revealing of the Lamb of God. Just as John the Baptist pointed out, behold the Lamb of God, that there will be the revealing because of the glory of Jesus being revealed. We ask right now that there's an enthroning of your saints, that there will be a revealing of Jesus in the name of Jesus. We ask and we pray, magnify, or said mercy on Zion. It is time to favor her. The appointed time has come. God, we believe that the hour is now. There's an urgency in this hour and an appointed time. There's a gathering across the globe and a raising up of a call to Zion, that the mercy and the favor of the Lord, that your eye is on your city of Jerusalem and on your people. And we ask, Lord, that the time is now. And we pray, Lord, that you would hear and have pity, yet have mercy, God. We ask, Lord, and we plead for mercy on the people of Israel. We ask, Lord, that judgment and mercy would come to your people. It is the time of favor upon Zion. So we ask right now that mercy would be released. We ask, Lord, that favor would be released and that this is your appointed time and hour. We pray, Lord, release mercy. We ask, Lord, that you would release your pity. And we release God, judgment. And we ask, Lord, come and move through the prayers of your saints across the globe. This is the time. This is the hour. This is the appointed time. God, come, favor of God, mercy of God in the name of Jesus. And favor. We ask, Lord, that surrounding the nations will that encircle Israel, that in verse 15, nations will fear the name of the Lord. And all the kings of the earth will fear your glory for the Lord. Build up Zion. He appears in glory. God, we ask, Lord, that your glory would be revealed. And we ask, Lord, that the kings, those that have raised up against an army against Israel, God, that you would defend and build up Jerusalem, build up Israel in this hour, the appointed time to strengthen your people. God, surround. God, encircle and strengthen and build up Zion. Build up Israel. We pray that the glory of the Lord would be revealed in this hour and in this day, God. Reveal yourself to the kings that have tried to oppose you, oppose your land and oppose your people. God, reveal yourself. The glory of the Lord be revealed in the name of Jesus. Verse 17, if you have your Bible, I'd love for you to read this passage with me in Psalm 102 and 17, this chunk right here. It says, he regards the prayer of the destitute and does not despise their prayer. Let this be recorded for a generation to come so that a people yet to be created may praise the Lord. That he looked down from his holy height from heaven, the Lord looked at the earth to hear the groans of the prisoners to set free. Those were doomed to die that they may declare in Zion the name of the Lord and Jerusalem his praise when people's gathered together and kingdoms to worship the Lord. There was a prophetic word spoken here at radiant within Kalamazoo that when there is prayer in his house that there would be praise in the streets and you see this reality taking place. When there is prayers heard from the holy height of heaven, God looks down, hears the groans of the people and releases praise in Jerusalem. So we pray that this reality would be prophetic over Jerusalem. We ask, Lord, that you would raise up the messianic believers that there would be prayer in Zion, prayer in Jerusalem and it would shift the reality that what's happening on the streets of Jerusalem would shift to praise. God, we ask, Lord, raise up a holy people that would consecrate themselves unto prayer in this hour, this appointed time and God that there would be a shift towards praise. God, we ask, Lord, that prayer be in the house of Israel and in Zion and there would be a releasing of praise in the streets of Jerusalem. God, we ask for this. We ask for this prophetic promise in the people and in the streets. God, do it in the name of Jesus, we pray. It would be that there would be a declaration in Zion, the name of the Lord and in Jerusalem his praise and we thank you for the promise that you record every prayer. God, that you record it and you lock it and God, you seal it. So today we ask, Lord, that these prayers, the prophetic promises, pray, God, that they would be not just spoken in fall, but they're recorded in heaven and God, that you would release it in the name of Jesus. God, we thank you for these promises and we thank you that you remember Zion and that your name will be declared and it will be the name of victory and it will be released over your people in the name of Jesus. We pray, God, we thank you and we bless, we bless Zion and we bless the holy name of our Lord in Jesus' name. Amen. Thank you for partnering in this hour long prayer meeting. We've joined in a 21 day of prayer and fasting for the nation of Israel. So let's continue to pray today at noon at 6.30 as we continue on. Bless you as you go today.


Might have a potential long coming in Tesla Tesla coming down near the lows of day Volume is going to get there. Oh here comes Tesla. All right, Tesla. I'm gonna go long Tesla here 475 calls $18 and 25 cents filled to 1825 Big push broke the lows of the day higher volume. Let's see if this thing bounces Yeah, David. I'm long Tesla 475 calls put an order to close out half of that at $21 That's more than 10%. Let's see if this thing bounces quick. I'm gonna lower my Order in Tesla down to $19.50 I mean Tesla is pretty weak on the day and I'm long so I don't want to try to overshoot it See if we can take the chips off the table at about six seven percent profit on the first one One more little tick higher in Tesla and I should get filled on half that I'm long Tesla long Netflix. So I'm gonna give it a little bit more time before I jump into another long Just need a little push higher in Tesla to get out of half. There we go hit and Tesla So I still got my other half left. See if it wants to keep pushing So Tesla pushing it actually is getting a higher volume bar here. So I'm gonna Booked the booked my 560 calls still have the 560 calls in Tesla, I'm gonna go ahead and put an order to close those at $20 and 20 cents Now we're starting to get some higher volume bars on the green side but Those I don't look at those as mighty 90 setups. We're kind of in this chop here I mean if you get a big push up and then it flushed down with higher volume I like that, but then if it bounces again with higher volume, I'm not looking to get short here It's kind of back in that Kind of wide swing consolidation mode and plus it's coming up close to 9 30 a.m All right, so that bar closed. I'm gonna go ahead and close out of both my Tesla and my Netflix here So booked booked nice profits in Tesla and Netflix Plus it's kind of this is now we're coming on kind of the third swing. So one two three I'm not saying it's it's not gonna work and it is a nice little higher volume But it's just it's kind of back in the middle of the range here So it's it's not as a high quality. It's not as a high probability setup


You are about to witness an epic Tarot Magnus reaction. Oh, and they're cooking bacon. So apparently, there's a part two to bacon, and it's called, it's called bacon and bill collectors, part two. God damn. You know, I'm thinking about, when I listened to it last time, if it was me that called, I would have thought that he was retarded, slow, or old as fuck, and senile like that. You know what I mean? That's what I would have thought. And he had me dying. I'll post the link below to the last reaction I did. I can't wait to watch this and make sure that all the volume is up. Look at this. That's a black girl this time, I think. What's that? So what, man? She black.  They're cooking some bacon. This is a count. Mary on your couch. Mary on your couch. All right. She want to do. I've been sitting there. I've been in there cooking bacon all night long. You tell them and give them. They put something in the curry. See?  That's what it sounded like, where he talking. See them done something else. Wait a minute. Barbershop, by the way. See them done something else. Wait a minute. Barbershop, by the way. See them done something else. Wait a minute. Barbershop, by the way. See them done something else. See them done something else. Barbershop, by the way. See them done something else. He sounded legit, too. See them done something else. Get some bacon. You know it's all recorded, too. Go.  You keep playing around. Know what you look like, Nelga. We go see your name. You in face with a wanted sign.  Oh, my God. Let me know what y'all thought about that. Actually, press the like button. If you didn't, press the like button. I was in there cooking bacon. What million subscribers would a 100,000 subscribers plaque on the way? Woo. Subscribe.


So the other side of thinking about data is what do consumers think? Yes, some consumers are going to go and look at all that documentation, but that is not all consumers. Many consumers are just going to judge your product based on the experience and make a decision. I'm one of those people and I'm going to show you an example. So my birthday is October 5th. Last year I got this message from my dentist who I had not seen in 15 years and I'm not sure why they're messaging me. Maybe they want me to come back, but I'm definitely not going back because I don't live in Philadelphia anymore. I lived 3,000 miles away on the other side of the United States in San Francisco and I wanted them to stop messaging me. Please delete my records. Don't contact me. But I can't do that. Actually, if I want to delete my record, I'm gonna have to go and contact them and it's a whole thing. So I'm already a little bit upset. I will definitely not recommend this dentist to my friends in Philadelphia. Now I keep getting this message. So this Saturday I was in Kolkata, many more miles away from this dentist in Philadelphia, and I'm paying for this because they're text messaging me while I'm here in India. So this is just an example that consumers make split-second decisions and to talk about the consumer experience and how that impacts your product and your operations and your costs. I'm going to bring to the stage Stan Myung. He's our vice president and general manager of our emerging markets group. He's based in Taiwan and please welcome me in joining the stage. Hey everyone, I'm glad to be here. This is I think my least 15 times that I've been to Bangalore. So prior to joining Mozilla, I joined Mozilla this year. But I spent 15 years at Hewlett Packard, Hewlett Packard Enterprise. So we were always always in India, always in Bangalore, electronic city, all over Bangalore, we know. So I had spent a lot of time here. I had so many great colleagues and friends here. So I'm happy to be back here. Tonight after the event, we're gonna go to the Paul and have my favorite Kerala restaurant, have a Poms and enjoy our dinner. But let me talk to you about business impact, business outcomes and how lean data really should be thought of as a competitive advantage. It shouldn't be thought of as an overhead and definitely not an afterthought, right? And so we all work for companies. Companies have a brand. They spend a lot and lots of money developing a brand. Very simple quote from Warren Buffett. It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently. That applies to many things including very infamous, famous data breaches and or misuses of user private data. These are just a few of the big headlines. I think you hear of data breaches in companies all the time. The reason I bring this up is because data breaches are when we all become aware of, oh my gosh, some company was breached with user and user data was there and all of a sudden it highlights what kind of user data did they have. And that's when everyone realizes that we have a problem, right? Case in point, Facebook and Cambridge Analytica. What is that? A five billion dollar penalty that Facebook was fined this year by the US government. Equifax, I'm sorry, and going back to that, that's regarding how Cambridge Analytica, if you weren't paying attention, regarding how they use data in a way where it would be used to for political ads and to potentially even change votes that were cast by people in the US, right? So very, very serious offense. Major issue. Equifax, very, very large credit agency in the US. 145 million users were affected. Believe the CIO went to prison over this not only not because of the data breach, but because of other issues regarding, I believe, insider trading, knowing about this in advance of it being public, but still, there are consequences to these type of things, right? Marriots, largest hotel chain. Five years of data were breached by hackers. 500 million users in their reservation system. And probably, I believe it's like 120 million in fines. But most importantly, the brand of these companies have been tarnished, which really is, I think, a huge detriment. Their stock price, billions in market capitalization were affected negatively. So all these have very, very big consequences, right? And it's when we have these big data breaches and it's in the news, that's when people realize that we've got a problem and soon you have government regulators getting involved. And what we want to talk about is, look, it's not a technology problem. It really is a people process problem. It's a people problem. Users are impacted because their data gets breached without their knowledge that it was even collected sometimes, but also the employees of the companies, it's their custodial responsibility to take care of company and user data, right? And so when we don't take it seriously, there are consequences, both, you know, business and to people, to consumers. So what happened? Well, 2018 was kind of a wake up call for the IT industry. I know so because I was in IT at the time. And I remember working in my last job where I would say one-third to one-half of the IT innovation spend was pretty much canceled out because all of a sudden every project had to be delayed because we were all working on various kinds of GDPR compliance projects. And so it was something that caught us by surprise and having to refactor, modify your applications, then realizing that, you know, it's not as easy as it sounds and you have hundreds and hundreds of applications that we're dealing with. But when governments get involved in regulatory actions take place, you know, you think about the law, I mean this GDPR regulation, it's, if you look into the details, yes, there's a compliance aspect, but it is very wide reaching. Technically, if a U.S. citizen is flying over a European EU country and they happen to be signing up for a service on the plane, technically they're covered by GDPR regulations. It's it's that broad and reaching. And it doesn't matter what kind of data. Any kind of data, no matter how small it is, that can identify a person is covered by this regulation. And users need the right to be able to erase their data. So I remember developing products, apps thinking, wow, I've never thought about how to easily erase a user's data, right? It wasn't something we thought about. We just thought about collecting as much data as we could and storing it in a place and then, you know, and it would start there. So I think this really was a wake-up call and there are penalties that are associated with GDPR, but as any company that's doing business around the world, you know what, something that the EU does, it's going to impact every company that does business globally or is thinking about doing business globally or thinking about doing business with anybody in the EU. There's more regulations that are probably coming. California is coming out with a 2020 data privacy act as well. So there's more of these coming. So instead of being reactive, and this is when Rebecca's point about Ed Mozilla, they actually didn't have to do a whole lot because they were already, it was already part of their culture, philosophy, and data governance was key to developing any product or feature inside Mozilla. And so this is what we want to share with you today, how you can actually build good products this way. So we also know that in India, there's a PDP, Personal Data Protection, Bill that's in draft form. It's there as a way to be on a similar level as GDPR. It will do actually quite a lot of things. It will hopefully create more business opportunities for India and IT companies at providing services to work on applications that are GDPR compliant, obviously, but also works for the country of India and its citizens. But if you think about it, if you're developing an IT solution, you should really understand the requirements that are going in it. Why? And so I believe that users in India actually have an increasingly higher awareness of data privacy, personal data privacy. And I'm responsible in my day job of launching products inside this Asia, Southeast Asia, India included. And we really want to understand what the users are doing, what are they thinking. And so we asked, we started asking our users who use our Firefox products, our Firefox Lite. It's a mobile Android browser that we've launched in India and also Southeast Asia. We asked our users, we interviewed them across Southeast Asia, why do you use VPN? What's your opinion of personal data? And why do you use a browser's private mode or you may also know it as incognito mode? Why do you use that? And we're trying to understand our users' insights in these studies. And so we'll go into detail on each one of these. But for example, VPN, why VPN? Well, they want to free content. They want to explore different content around the world. They want to break the bubble. And that's a very interesting one I'll talk about in a second. About personal data. Well, people believe, our respondents believe that personal data is their data that they own. You own your own personal data. Your digital footprint is you, right? The world is increasingly becoming digital. And so you have your medical records, you have a physical health that you're taking care of. Well, your digital health, I think, is just as important. You have a footprint in the internet. And why browser mode? Why browser private mode? Well, it's really to seek protection, to be more anonymous, to be able to engage and browse the internet at your leisure in privacy. So let's deep dive into each one of these. So freeing the content and breaking the bubble. So we found in our interviews with our Firefox Lite users that the access to content is a core aspect of the right to freedom of expression. So users in India believe that they have the right to explore content from anywhere around the globe. They shouldn't have restrictions. One of the most quote, funniest quotes that I'll remember or long lasting quotes is one of our users said, you know, I'm just tired of receiving Bollywood music suggestions from my streaming music app, because it's not my favorite kind of music, right? But that's called, you know, being in a bubble because you're in this location, the app company assumes that you just like this one genre. So you're going to get keep getting these recommendations, right? We find that our users will go obviously use VPNs to go outside the borders, use VPN or private mode to go to again break this bubble or stereotype. And even use cases of searching for airline tickets, using a VPN in another country to verify that the price could not be, you know, may be lower and understanding that because I think users in India are very tech savvy, right? You know, you understand that airline companies may change prices. And so you want to verify that by having a VPN to check prices. So that happens. It's a use case. Around personal data, it's definitely considered a personal asset. So companies should not use my personal data before asking me. So they need to ask my permission. So this is a typical insight that we get. And here's a quote, what I am worried about most about is not only the giants like Facebook and Google taking my personal data, but the third party companies that I have no idea about, I don't know how they will take advantage of my data, right? So, you know, we see users checking the app permissions, making sure that that, you know, apps have particular permissions that they're not overextending their permissions. At Mozilla, we have a concept that the browser being a user agent. So we consider their browser to be your entry point or portal into the internet. And we want to build a browser that's going to protect you and provide that security and as you browse into the internet, right? And we believe that Firefox does a lot better job than Chrome, right? Things like tracking protection, for example. All right. And the third part asking about why users use incognito mode or private mode in a browser. Well, the insight here is that, well, I have to take my own action to ensure that I get real protection online, right? Here's a quote, I have blank political views. If the government knew this, they might hurt me or they may hurt me and my family. So people are concerned about maybe trust with government or maybe not government, but other agencies or other groups. And so people want to be able to, you know, that's a fear that came up. But people want to be able to browse on their own. People will use separate or different search engines as a common use case.  These are all things that users, I believe, who are aware of privacy use and they take their own action. That's the point. These are actions that people take on their own, right? So it all comes down to this, you know, building a product and having customers trust in your product, your brand and your company. And it is an invisible currency that people don't talk about in terms of privacy being part of this customer trust. And I think that's important because just this year, I think you may have heard the Apple keynote speech about, I think, around May. There was a big, you know, product launch that Apple normally does twice a year. But they spent 10 minutes talking about privacy, 10 minutes, and how, you know, Apple was a champion for privacy. And I think Google followed suit. I think the CEO of Google responded back in the media that said, well, privacy should not be a luxury. It should be for, I think, for everyone. And I think Facebook also had Zuckerberg who said in his, one of his keynotes for a developer conference said that the future is privacy, right? So we are seeing this, hey, which, you know, whose privacy is better than whose, right, in this rhetoric in these large tech companies. I guess my job here is to make you ask the question, where was this five years ago? You know, what in the business model and in the data that companies are using and collecting, how is that open? How is that giving users more choice? And how is that lean, right? And so it's up for you to decide. But it's clear that user sentiment, customers, consumer sentiments about privacy is definitely on the rise. That's why you hear this in a lot of the marketing and the branding in many tech companies today, right? So here, you know, Mozilla, we're here to help. We're here to talk about how we believe is the right way to approach this in our company philosophy. And I think this idea of data governance, this idea of building data privacy and policies around protection of data, into a company's product development, into even the company's culture and philosophy. I think it's important, as I think Rebecca mentioned, everyone's trying to get into, everyone's trying to get to AI, right? And there's a lot of tools, open source tools around machine learning. And everybody's moving towards it. Everyone's collecting data. But I think they're doing it in a way and that I think our position is that you should really have a lean approach, a smart, intelligent way of doing that. Otherwise, you're wasting resources. You're making life difficult for data scientists. And if the norm of the future is AI and you have data collected, big data and you're doing machine learning models, well, the differentiator is the quality of your data. And so by starting at the beginning on understanding why you want your product to have certain types of data and why is it valuable in your product and mapping everything back to that, then you're going to have, I think, a much cleaner data set to work with, which can be a better competitive advantage. If there's regulations and regulatory changes that happen, you're going to be in a much better position down the road, right? And that case in point is GDPR, right? So we're to go from here. So lean data practices, that's what we're here to talk about and why we think it's so important to come here and talk to you all about it. I believe that companies have the responsibility to protect user data and company data as well, of course, right? So stay lean. Decide if all your data collected actually has value, right? And learn how to protect customer data. Engage your users. Keep them informed. Give them a choice. Make them empowered. It's more engaging. Make your products more engaging. So we'll go in these three areas a little bit more in detail. So how to stay lean? Decide if all your data collection delivers value. Do I need this data to provide the value that I'm trying to deliver? What data do I have? Do we have? How do you collect your data? Why are you collecting this data? What for? What's the purpose? What business value is there? And when do you delete the data and how do you empower the user? And what's that user journey look like, right? Around building security in your product. So you got to learn how to protect customer data. It has to be core in your company's philosophy and data governance plans. So how are you protecting customer data? Who has access to this data? How is this data being handled? Whom in the company has access to this data? What security measures are there? We're talking about things like security groups, right? And how do you know when you have a problem and what will you do? What's the operating procedure to handle some sort of data breach even at an internal level?  Keep your users informed, empowered. Do your customers know of your data practices? Are you being open about it? And what kind of context are you collecting the data? Can you provide more choice and control for users to give them more empowerment? And can you make your privacy policy more accessible, right? Front and center even, right? And perhaps you could have a transparency report on how your company handles user data. So going back to this great pyramid that Rebecca had shown, right? So we're all, you know, I think a lot of companies are moving towards, you know, trying to harness big data, collecting as much data as they can and trying to reach the pinnacle. I think there's a lot of waste. There's a lot of environmental waste around electricity, cost of cloud, maybe in the cloud, but it's still taking electricity somewhere. So saving the environment. This is all, you know, if you think of it, practicing linked data is going to save the planet, because you're saving electricity as well. That's the way I think about it. But, you know, how are we all, you know, as companies and as engineers moving towards the top, but doing it in a way where we don't have a plan? And our goal tonight is to empower you guys to think about how can we do this in an intelligent way? And by doing it in an intelligent way, you're going to be helping your future self. And it's clear in the past few years, and it's going to be clear very, you know, very soon in the future. All right? So here is a QR code about where you can learn more about Lean Data Practices. You can also go to leandatepractices.com, and you can also scan this QR code. And we're going to leave this up here. And I'm going to invite Mika back up to take us to the next session for Q&A.