Hello everybody Andrea here with dental L. I want to talk to you guys and give you the honest review and why on those like do-it-yourself vibrating sonic electric toothbrush. So if you don't know what I'm talking about I'm going to show you guys a picture right now. I'm getting a lot of people asking me about them including friends and family just people wanting their my opinion on the topic since I'm a dental hygienist I talk about toothbrushing flossing all of this. So what these are they are considered electric toothbrushes that you plug in recharge and you just basically put it in your mouth turn it on and those bristles if you want to call them bristles vibrate and they're supposed to clean the mouth but I'll tell you why I do not like them but I'm also going to tell you why it might be better than nothing okay so I'm doing a couple different things here so I don't like them because how do toothbrushes work to clean the teeth and prevent gum disease prevent cavities are toothbrushes are a mechanical removal of plaque from your teeth so you actually moving that toothbrush is what's removing the plaque from the teeth and the toothpaste is helping apply that protective healthy coating on the teeth afterwards to really prevent cavities prevent gum disease if you're brushing with just water that's still better than nothing but the tooth the toothpaste you do need that to just provide that protective coating and the extra good stuff you need on your teeth so these electric sonic toothbrushes which I'm going to show you my screen again you're putting them in your mouth and it's vibrating but there's not enough mechanical action happening to remove the plaque so you're putting it in your mouth or your child is putting it in their mouth and it's not cleaning anything it's not it might be cleaning that very light plaque that just formed one hour ago but it's not going to clean that thick stuck on plaque so it's not doing a very good job okay but I'm going to go a different way and tell you why it might be better than nothing if you have a child who's you know just doesn't want to brush they don't like it at least you can give them that and it's doing something there are children out there that just simply don't want to brush but they're going to get cavities I tell parents you're going to have to force your children to brush I'm sorry it is what it is it's kind of like when you force your child to go to the doctor to get a needle or whatever it is what it is your child's not always going to like you but if you don't force them to brush they're going to get cavities if they get cavities then you have to force them to get the cavity fixed and that's a lot worse than just brushing the teeth you know we have to give them a needle to put the tooth to sleep we have to spend probably at least a half an hour putting in a filling your child has to stay there with their mouth open perfectly still for half an hour so it's definitely ideal to prevent these things first and prevention means proper toothbrushing so one last time you guys I'm going to show you that picture I do not like the sonic electric toothbrushes it's too good to be true toothbrushing isn't that easy okay I mean it is easy this makes it even easier if you will you just have to put something in your mouth and it's vibrating apparently the plaque away but it's not that easy it's not vibrating much away at all please stick to regular tooth brushing either a manual toothbrush or an electric whichever one you prefer or your child prefers I'm going to talk about in another video manual toothbrushes versus electric toothbrushes and which ones are better depending on if you're a child if you're an adult and kind of what you need for your teeth if you're cold-sensitive if you get a lot of cavities if you never get cavities if your child doesn't like brushing what might work so I'm going to talk about that in another video comment below if you have any questions I'm very happy to help and I look forward to seeing you guys in the next video


Some time ago I showed in a video on my email dump tool handles obfuscated MIME files, where some non-header lines had been added to the beginning of the file. And now I've made some changes to my email dump tool that it can handle different types of obfuscation. So let's run this on the first one here. And if there is some obfuscation now you will get lines here with the warning. So if we look at this first file, you can see a MIME file. And here the first line here contains some random text that is not a field. This is causing a problem for some of the MIME file parsers. And the EML dump is warning you about this. Now in the past I showed you with option.h how you can skip this. This still works, but now I have another option which is more generic. And that is the filter option. And this will filter out all obfuscation that EML dump recognizes. So if we do this on the first one here, now you can see here that it can recognize the file. It recognizes different multiparts inside the MIME type file. So now we can for example select number 4, dump it and pass it on to olidump like this. So that is the first example. Second example, here also warning. It's a bit different if we look at the file. So now the line here with random text is not at the beginning of the file, but it's at the end of the first block. And that is the warning that you get here. So you can do exactly the same. You just instruct EML dump to filter this. Then we select multipart 4 and dump it. And we can pass it on to olidump like this.


Hey traders, this is T Bradley 90 from the My Investing Club chat. As a special gift to every viewer on YouTube, there is a link in the description to apply for a free Breakthrough Trading Strategy session with myself. What does that mean? Alex created a free trading course for beginners and at the end of it we will be selecting a few non-members to get on the phone with myself, Tosh, T Bradley 90 to help with your trading. Click the link in the bio, watch the video and apply today. Now while today is just a preview of the full length video, if you wanna watch the full length or any of our exclusive content, then become a member of MIC. All right, so the webinar tonight is going to be on confidence. Okay, I have to move that over. Yeah, not the, I mean, it could be a lot worse. Definitely be a lot worse. You know, I mean, it's just quick ins, quick outs and it's just like, I give up. Yeah, I do that like sick. Oh yeah, so today's webinar is gonna be on confidence. And I think everybody struggles with this. So I think it's gonna be a good one. All right, so let's get going. And hopefully the bear shows up about halfway through. I think he's doing something right now. But anyway, let's go. All right, so what we're gonna do today is we're gonna talk about confidence. Gonna go over some key traders over the last week. Thankfully more than the last couple of weeks. It's been great. I'm gonna reflect on market sentiment as usual. The top, my topics today, I'm gonna talk about fallacies again, because it's kind of a segment I wanna continue because there's just so many of them that we deal with every single day and it affects almost everybody. So I hope, I'm hoping it's, it'll be beneficial. My favorite, I love talking about trading psychology. It's what I think is the most important part of the entire game. Then we're gonna finish with question and answer with the bear. And go over kind of his process a little bit. And like he's, the bear is just like, I mean, like it's just so amazing to see like he has the same setup every single time it's all he does. And it just, that's it, right? It's just like the ultimate discipline. So all right, let's get to it. So RC was one of these runners. And I think this was on its first day. I think this was its first day running when I wanted to short it. And so like Joe and I were, like Joe talked about in the webinar, I'm sorry, in the seminar at Philly, you know, like the idea that like 1030 is kind of an area where longs don't wanna be entering if it's at highs. And 1030 is an area where shorts don't wanna be entering if the socks are at lows, right? That's kind of based my idea around the, around this 1030 is short for ARCI. Yeah, this was on the 26th, it was like three days ago. And like it started to get like really consolidating really what I felt like was looked tired up here. So I decided to go ahead and start trying to form a position thinking that, thinking that the top had been in. So I just started scaling in around here, around the high day. And I even got this epic nice stuff short, like, and this is kind of what I wanted. I wanted it to pop over high day and stuff really hard. And I ended up time slash price stopping out. Like after it didn't just continue after a while, I just ended up cutting it out. And the one thing I could have done better is, and like the worst part about this is that I know this already. Like in the moment I knew immediately that I probably should have covered sooner, but I didn't because I got a little bit stubborn. But Joe mentioned this in the Philly webinar and it's called edge decay, right? And edge decay is the perfect word for it. Like it's something that I've known for a very long time, like what it is when I feel like I couldn't really put words to it until now, until Joe did. And it's the perfect, like it's the perfect wording, edge decay. So basically when I got this final ad up here on this stuff, I was really like, I was essentially really confident at that moment that like if this grade's gonna work, like here it goes. This is gonna be the time. So FFHL, so this is a sock. I actually messaged Joe about this one. This one was a good one. FFHL, like I almost fell into this trap, dude. I like right at the start when this popped up, I was like, I was digging in my heels, getting ready to, I'm gonna add to this short. I'm gonna, I'm gonna go, go, go, go, go, add, add, add, just I'm going for this win. This is gonna be a solid win if I just keep adding, right? So I was planning on, like I was planning on scaling all the way to 550, you know, like 556. I was getting ready to scale up here, but I don't know, I probably would have canned it here if I did, I would have lost patience the fact that it didn't happen here. And that's just me knowing my patience level, I probably would have got it. But like what's super cool is everybody in the room was like, why short this, why short this?  Yes, why effing short this, right? Like just, why don't I just wait for something like this to happen before I short it? So that's what I did.  But because I didn't, I was able to actually go for a first bounce grade. And because I knew I did wanna short it, I was innately kind of conservative with the exit. I'm totally fine with that decision because I did, you know, whenever I'm waiting to short something, if I am longing something, I know very well that I'm longing temporarily because I do want to short it eventually. So I'm like, I'll get the first bounce. I'm not gonna expect it to break the high of day of $5 again. So I wanted to take most off before it got up to five. So you can see most of my cells here are under five for the lower high.  I kind of just had it at like 523 and it, you know, popped up and I got it. So there's a beautiful first bounce grade I got on it. And then like here I am, I'm just waiting for it to break down, right? I see this, I see this low and I'm waiting for it to break this low before I start shorting now. Now that this is kind of like the first significant low. So we get up here and I'm just waiting for it. And right here, I remember trying to get in a little better but I didn't get that grade of a fill this time. I normally do better, but I was a little slow. But anyway, I short here, it's good. It's important to know I'm willing to add as it pops back up here. I'm expecting this kind of stuff. So, but we get an immediate tank and I cover, I cover half of it here and I start adding in on the bounce. And this is the good example of when I did realize my edge decay, right? I did realize my edge decay. This kind of trade, the fact that it put everybody, all the chasers over water, underwater over here and it ignites all of the chaser shorts down here. I know that if I'm shorting up here and it's taking a significant amount of time, it's allowing everybody else who was slow. Like my edge on a breakdown trade should be that I short the breakdown and it tanks a lot into where I have kind of like an edge to average. At this point, it's giving everybody else a chance to have the same average as me, right? This kind of tank and immediate bounce trade should be met with selling pressure pretty immediately as all these guys try to sell, right? The next, the other trade I had this week was OSN. And I did a video lesson on this, if I'm gonna go over it again just in case anyone hasn't seen it. But I don't always go long when I do, I go short. So this was, I did make a video lesson. I'll go over fast or I'll try to go fast on this one. But for if you haven't seen it, this is a classic washout long pattern for me. And you know how I talked about in a previous webinar, how I talked about, there's often times there's going to be some variation to setups. This is an example of kind of a variation. I wanted the tank to come in the first couple of minutes of the day. That's normally how they happen. They're gonna happen in the first like one, two, three, four minutes of the day. Like it's gonna happen right here. I'm gonna get my washout, it's gonna come right back. This one did a little bit of a stutter first. So initially what I did actually, I had orders out on this stock to buy in the 40s and 50s down here. If it was gonna tank right away out of the open, that's where I had my orders, right? But when it consolidated a little bit, I actually said that I canceled my orders. I canceled my orders because I felt like it was gonna start grinding down. And I didn't want it to grind down on me. I wanted parabolic emotional downside panic type selling. And I eventually put the orders back when I saw a massive flush. I'm like, okay, that's what I want. I want the massive flush, especially it's right here near my support level. And a lot of people started to, not a lot, but a couple of people messaged me and asked me, like, you bought under the death line. Like, why did you do that, right? Like this being the death line. And to me, this is an example of an empty death line. First of all, at the open, I always expect volatility and I always expect emotional volatility to where, and I don't always place a whole lot of meaning behind the price action at the open because a lot of times it's just literally random clusterfucks candles going up and down, right? So I don't like to put a lot of emphasis or reasoning behind opening candles. Like if a stock breaks high day in the first candle, that doesn't mean like it's a breakout for me. Like, especially in the first candle, the first couple candles, right? So I have that kind of desensitization, what I talked about in Philly. I have that kind of desensitization about the open. And the other part, you know, so that's what makes me feel it's like an empty death line. It's just opening noise. The other reason why I think it's an empty death line is who's long, right? Like think about the way this kind of gapped up and pushed up on low volume, right? Pre-market, there's always low volume in relation to the market. And it kind of fell down. And I would bet that this isn't on, look at the volume. It's not necessarily on high volume, right? It's not like longs or super selling. It's probably like if you've ever seen pre-market action. Pre-market action, there's two ways stocks can go down, right? Bids can get chewed or bids can drop, right? So just because a stock fell harshly from highs doesn't necessarily mean a whole bunch of people are under water. It just means that the bids, the asks could have been elevated and the bids could have dropped where not a whole lot of volume was actually behind the move. And that's kind of most pre-market action. So when we're down here at the lows, it's kind of trading on illiquidity right here. We pop up at the open and so, okay. So those are I think were the key trades that I did this week that were worth talking about. So the market participants were kind of, I think less than last week, but definitely better than the last couple of weeks. And we still have some momentum going on, right? We had some good ones, ARCI, RKDA and LCI. They all carried the momentum forward and they're still kind of chugging, keeping the market alive a little bit. But I think one thing we saw from last week is a little bit decay in the overzealousness in the stocks. Like right, when we come off of a dead market into the bull market, right? Like everything goes absurd, right? But then we start to be used to it and you slowly see it taper off, but I think these are kind of carrying the momentum, still leaving it, still giving buyers the positive enforcement they have to keep buying stocks currently. Not everything is just slamming. Normally, so now what I'm on the lookout is these hints, right? OSN totally failed, right? LEDS totally failed. Oh, the other one, KBSF. KBSF, I forgot to put it in here. KBSF totally failed, DPW totally failed, like NTC had that fail. These are kind of hints that Momo's starting to run out. And I think we'll probably get one that starts to run and it offers or something and that'll probably be the killer, right? That shuts down the overzealous buying market. Oh, give me a second. Echo, Hawaii, man, it gets hot. And I was, you know, DPW and Mara kind of had its thing and I was actually a little disappointed that Bitcoin didn't gain any steam. I think the market does better when there's a fad because then sympathy market, like sympathy runners can tag on and be like, oh yeah, well we're Bitcoin too, like just put out a cryptocurrency, something in their PR. If DPW, if DPW is going nuts, then like Bitcoin is crazy in small cap plan. All any company has to do is like put out, oh yeah, we're thinking about getting into cryptocurrency and like they'll be up 50% if it's a low flow.  Oh gosh, I hope so. I just got to check, yeah, okay. You know, but the good news is in, yeah, blockchain overreaction, right? But some more positive is one thing I'm liking to see is that the market seems to be shaking off Trump tweets, like Trump's tweet, like Trump had a huge tweet, a rant on China the other day. Oh yeah, we are no longer a tea company. We are a long blockchain. Yeah, and SPU, Sky People Fruit Juice went to like a FTFT tech company because of it. But yeah, the market seems to be shaking off Trump tweets, like he just had this big rant on China and it really tanked the market, but the market recovered, right? And like, I feel like the market's starting to get a little desensitized to Trump tweeting, which is really good. Like it's really annoying for large cap traders when you're in a stock and all of a sudden it just tanks because a spy takes a dump. Like it really just messes up your trading and you gotta be like, do I ignore this? Is it gonna recover? Like it's starting to or do I have to sell? Like it's getting really annoying, but I'm starting to see a little bit of less reaction each time. Like the tank, like there was one today a tank, but it quickly recovered, right? No, you don't. No, you don't, like not at all. Like the market, the totally irrelevant, right? Or this is one that I find myself falling for a lot. Like I'm only asking and I still fall for this one. I'm only asking for one pull, 10 cents, which I'm just looking for a little bit of profit. My cover is literally right there. It's literally right there. I'm gonna make eight cents on this trade. Can I just make eight cents? Like that's all I'm asking for. I should be able to get this. Like if a stock is trending, there is zero obligation for the stock to pull and get you out, right? Cause long traders that are keeping the trend aren't gonna sell until that level breaks, right? They're not selling until that level breaks. They don't wanna be forced to sell. Like this is how trends work.  That you're entitled to that profit and that's just a fallacy, right? It doesn't, that's not the, like, and if you cling to these, you're going to get like toxic, you're gonna get desperate and it's gonna really affect your mentality, right? Another one, my last three shorts didn't work. So this one's definitely gotta work, right? Like this is the gambler's fallacy, right?  Like, no, each time is each trade is so individual, like no trade matters before your trade. You have to go into every single trade pretending it's the first trade you ever took because the market doesn't care, right? Market doesn't care if it's, if the last three trades were losers because for all the market knows your last three trades could have been winners, right? But we get into this toxic thinking where we feel like we deserve and we're entitled for whatever reason or not. You know, another one, I always pay for chasing. Every time I chase, I lose. This time should be the time where I win, right? This time should be the time where I win by chasing because I see chasing working for everybody else but not me and I always lose. So watch me not trade, watch me not chase this time and have it work.  No, there isn't. Can you guys hear me? Yeah, yeah. Okay, yeah. Okay, cool. Yeah, because I couldn't hear you so I wanted to switch my speakers so, but I didn't want them to overhear it from the mic. Okay. Cool, cool. Yeah, man. So like, and yeah, I wanted to bring you on just cause it just seems like such a good risk or award setup, a good high probability. So can you walk it through one more time? Like what is your, like, what's your favorite thing to see on these gappers short view? Yeah, exactly. So first thing, I look for the daily chart. I want to see like when they gap up like the before like in history when they gap and they fade all day. So I want to see like these big red candles on the daily when there's volume. So when they gap and then they fade all day. And then I have like a checklist. I have a checklist for the criteria. So I'm looking for the flow to be over like three, four million market gap over 10 to 15 million and low institution ownership and the short flow. So yeah, the IO, I prefer to be less than 30% short float less than 20% 30%. And I just wait. I want, I want the gap to be to open like over 30%. So we could have some, if it fades like there's some meat on it. And they do the line same. So same what Joe like explain it for the deadline. That's why I used to do like spin now almost a year. And they wait like when they confirm the breakdown the deadline, I just short man. And if it's close to the view ups they use view up as a guide, as a risk. So yeah. And yeah, man. That's the thing. So I try my best to stick like only for the confirmation like for the backside confirmation. I don't want to short the front side unless like there's a heavy, heavy resistance on that push. Yeah. And so yeah. I think you said something like you trade off five minute candles. Yeah, exactly. I trade five minute. I used to trade the one minute like two years ago when they start trading like now it's been like almost three years. But yeah. And then they change it to the five minute. I found it like I can hold longer. It gives me the more patient like to hold longer because you know the one minute can fake you out. And yeah. Yeah. And even like on these breakdowns like the deadline if you use the five minute it's much clearer than the one minute because in the one minute you can get fake it very easily. So yeah. In the five minutes it's much better in my opinion. Yeah, yeah. And like I noticed that like all of your charts are five minute and like so do you technically do you wait for the candle to close before like you like is that your confirmation? Like. Yeah, exactly. Yeah. I want to see a hard stuff like under for example today ARCI it was a little tricky. I didn't trade it because actually I didn't locate it. The locate was very high like I think 0.17 something. Yeah. So yeah. For example like this one because it and the problem is with the SSR and the low flow. So for example, we have like the support at 580, right? 590 and 18. All right. The ideal, the ideal like the ideal setup for this one is a wait for the open and then it stuffs that level. So but the problem here it happens pretty much it happens around, let me check. It happened around 920, right? 920 Eastern time. And then you can see like after the open it pushed like over that level and then it's stuffed. So that candle like at 945, that's the best. Like if you can see like it closed under and then you can shut all pops using V1. That's basically what I'm doing. So the best case scenario that the breakout happened after 910, not the pretty much. That's the best way. Right, right. Yeah. Cause I'm looking at this chart and I know you'd be right here. You would be right there. Exactly. I just know that's bear's entry. But the thing is, but the problem with the ARCI, the odds gets lower. I mean, because it's the same pattern but there's different winning percentage I think because of the SSR I mean like and the low float it's a nano float, it's changed. You see what I mean? But the ideal setup for this one is the same thing but the float could be like over 4 million, 5 million without the SSR. You see what they mean, right? Right. Yeah. Yeah, like SSR makes my trades better, right? Oh, I forgot to mention that. I don't know, I said the SSR was on. But yeah, like SSR makes logs better. So I mean, it should normally just make shorts crappier. Exactly. Yeah. Yeah. And yeah, so you guys can be free to ask questions if you guys want and we'll just go. Yeah, yeah. And we'll get to them as you go. Or as we were talking. But today, man, I really messed up, man, in LCI. I don't know what happened. I traded day two like on the gap down. I was just gonna get there to be and I don't know what happened, man. I totally lost all the display. Actually, I've been like trading very well the past two weeks. I made only maybe five trades, I think. It's the same exact setup. And today, yeah, man, I just didn't locate ARCI. I found myself trading LCI. Of course, that's always the way it works, man. Yeah, man. Sometimes we pay for it.  I mean, you and Joe got out at like prime times because this could have been bad. Exactly. Just that add, add, add, add, add. Like here's the dip. You're, everyone wants it. And then it just comes in like this. Anyway, so Brandon has a good question. Do you stop looking for deathline plays after 10.30? It depends because after 10.30, it's gonna be a different like setup, okay? Which is, I think you talked about it in one of your webinars, which is the best the one they fade late day after two o'clock, right? Right. So if it starts making new high and then it's consolidating, that's the new deathline. And then you can short it after two p.m. Yeah, it works. Yeah, yeah. That's a different story. Yeah, that's a different story because the best ones, like I mean, if it's gonna be an all day fader, like it fades all day, it's gonna happen before 10.30. Because yeah, yeah, it's gonna happen before 10.30 for sure. Yeah, normally, yeah. After 10.30, it's totally different pattern. I mean, it's the one you like. It's the one they fade late day after two p.m. It works, 100% it works. Yeah. All the time. Yeah, exactly. Yeah. 100% but I mean, yeah, it works. I mean, after two p.m. Yeah. Yeah, and so yeah, I think that's what works. I agree too, like that though. I don't think deathlines really happen much, especially if they do like rip up in the middle of the day. I think the chances of those fading, but I think the chances just dwindle down to like, when they break high a day from the morning and there's a new client, like the all day fade almost goes away and that two p.m. crack is like, I've become kind of like a piker on that crack instead of even looking for the fade there because they just have been holding lately, not even like, like if the deadline doesn't like, totally happen like a volume deathline in the morning, I don't think they're gonna fade. So yeah, yeah. Yeah, you got to wait till two to even attempt it again. So yeah, basically actually for me, like on this specific like setup, if it's gonna break down. I mean, like by 9.30, you can know it's gonna happen. See what they mean, right? The pre-market chart will be like format, like pull, and you can see where the support is, where the deadline is. And then, so I mean for the new guys, if you want to avoid like, to know, and then you can leave like a computer so you don't make anything. You can know like by 9.00 a.m., making 9.30, you can see the pre-market chart. For example, ARCI, it was clear, like it was clear the support was the support, but some of the charts, they're not like really clear. You see what they mean, right? Yeah, exactly.    Exactly. Hey traders, this is Tosh. I go by T Bradley 90 in the My Investing Club Chat. Just wanted to reach out and say if you have any questions about MIC, joining MIC, maybe you're a member already, you have three ways to contact myself personally and through MIC. You can hit our social media. You can hit me through PMs in chat or you can contact us through my email at tosh at myinvestingclub.com. That's T-O-S-H at myinvestingclub.com. I will get back to you in a timely manner and I'm saying this because I'm here to help and I don't want anybody to be afraid to reach out and ask any question that they have. We are here for you guys. All right, see you guys.


Superparamagnetic iron oxide nanoparticles, spheons, have found application in magnetic resonance imaging, MRI, magnetic hyperthermia, and advanced drug delivery systems due to their superparamagnetic properties, easy synthesis, biocompatibility, multifunctionality, and possibility of further surface modification. Despite some disadvantages such as high uptake by macrophages, ongoing studies suggest that spheons are very promising in oncological therapy, especially in brain, breast, prostate, and pancreatic tumors. The goal of this paper is to present the basic properties of spheons, discuss their current role in medicine, and review their applications to inspire future developments of new, improved SPON systems. This article was authored by Joanna Dylinska-Lajka, Agni Escalay-Zarchik, for Shemislah Alubiak, and others.


Thank you very much. So probably you see here some message from hidden sector. Actually what is shown here, some simulated event in Miniboon experiment and Miniboon experiment is searching for sterile neutrinos. And if sterile neutrinos exist, then most probably there's something which comes from a hidden sector. Neutrino properties are summarized in this plot and you see very nice and very appealing structure of leptomixing with maximal or close to maximal 2-3 mixing, three maximal mixing of all three flavors in the second state and very small mixing of electroneutrino. Here this is what is called 1-3 mixing and this is of the size of 2%. So this is kind of very appealing scheme which probably tells us that there is some symmetry behind leptomixing. And what is interesting, this very small 1-3 mixing measured quite recently may be the key to explain all this picture. So this is certainly some physics beyond the standard model. However, for time being we have various suggestions which span 20 orders on 28 orders of magnitude to explain neutrinos masses and mixing starting from very low-scale electrovolts, kind of an electroweak scale, a number of mechanisms, radiative mechanisms, etc. This is something new since I see, as cubes see these PV neutrinos, then we immediately jump on this. Maybe IceCube shows some new scale in physics and maybe we should connect our neutrinos with this scale and of course God scale and Plunk scale physics and that what I will focus on mostly in my talk. Speaking about mixing, here the different suggestions span from symmetries and here we have a very complicated model. Some of them contain something like 100 new fields to explain just three parameters up to anarchy and randomness and here not much to say so if the nature is like this then it's okay. In view of this, to add another model maybe it's not a big kind of problem and not a big crime and so what I will show you is another attempt to explain these results with this is the paper which should appear soon with Patrick Loodle and with the following guidelines, the stability with the present facilities is not the problem of nature. This is our problem apparently. So I think that still the best what we have invented in the last 50 years is kind of unification line and it seems that it is new trend to try to explain the problems in visible sector using hidden sector. So this is outline of my talk and the starting point will be the relation between leptin mixing and quark mixing. Then I will discuss implications of this relation. Mostly focus on the framework unfortunately I have no kind of complete model, it's just a framework which probably can produce some interesting results and I will show some realizations which it depends on the time. I have many realizations, I mean 50 maybe, I'll show a few of them and then discuss a little bit the stability of this scenario. The relation between leptin and quark mixing it's quite popular idea is that leptin and quark mixing are related in such a way that the PMNS matrix, leptin mixing matrix is given by, I have written here, U C K M dagger and some matrix U X where this U C K M something which is close to V C K M matrix, the mixing matrix in quark sector. So it has the same expansion parameter which is capable angle but may still slightly be different. Now U X is something new and probably has some special form and fixed by symmetry. It can be determined from experimental results and if this is matrix of the other one then this matrix U X should be something like try by maximum mixing matrix. So important thing that this relation which looks like very generally can always write something like this leads to certain prediction for one-three mixing. It led because it was actually done even before discovery of one-three mixing. So this is again the same relation and suppose this matrix U X is given by two-three rotation by nearly maximum mixing and this we need anyway because the mixing in leptons sector is maximal and in V C K M two-three mixing is very small, this is V C B. The value of one-three mixing is irrelevant but what is important that there is no one-three mixing, one-three mixing is zero. From here you immediately get the following, the mixing matrix of leptons is written like here, just inserting here U X and in the simplest way just take here K-beaver rotation and then what you need to do to reduce this matrix to the standard parameterization form this is how we define mixing angles you need to make this permutation and immediately get this relation between one-three mixing and K-beaver angle. Sine theta one-three is one over squared of two sine theta K-beaver. That was predicted ten years ago or so and it seems that data are in very good agreement with these numbers. So whatever I want to update with the recent measurements of especially one-three mixing it is just to show you that how series are now experimental results. So here you see the diabetes result of measurements of one-three mixing which actually dominates in determination of this angle and here you see the spectrum of neutrinos from anti-neutrinos from atomic reactor this energy spectrum and blue histogram is what is expected and red one what is observed and you see nice very precise measurements which show the deficit of the signal this is the residual and you see again very nice agreement and this is due to oscillations due to one-three mixing and even here you see really measured oscillation curve in the scale L over E. Now from this global feed of all oscillation data I want to just to stress here that actually two-three mixing also probably deviates from maximal and the situation is uncertain and it depends on actually type of mass hierarchy. Now what is the present-day situation? Here you see this sine squared t to one-three multiplied by hundred and so this is one over two sine squared t to Kb this what is supposed to be sine squared t to one-three if you believe in this relation but now experimental points are somehow more than three-sigma of so this is a diabetes out here and so this is this point with prediction so now we have this difference but what is interesting that the relative difference is of the order of lambda squared Kb squared so this tell you the accuracy of the present-day determination so now even say small elements like Vcb in this game become important so this is kind of the strengths of accuracy of present-day measurements there are different ways how one can reconcile the framework I have formulated with experimental data so one can take CKM corrections not only Kb by angle but also small mixing angles in CKM matrix then one can actually explore deviation of two-three mixing from maximal because this factor one half is just precisely sine squared t to three that's consequence of maximal two-three mixing and one can do of course boss so in this so what we did with Patrick we just used more general form of this UX matrix admitting here some phase matrix some deviation of two-three from maximal and this angle again is irrelevant so for this more general form of UX matrix the relation between one-three mixing and t to Kb is like here so here you have sine squared t to three x angle of rotation in this UX matrix and these are corrections when you take into account complete CKM matrix corrections of the order if you take the form using Wolfenstein parameterization precisely of lambda squared with something so excluding from these two relations sine squared t to x you can immediately get something which connects one-three mixing square and two-three mixing angles and you see these relations in the plot so here you see physical angle one three and this is sine squared t to three and here you see the predictions depending on the phase alpha in the matrix gamma I have shown and here are experimental regions so you see you have very good agreement but of course one should keep in mind that here we use exactly VCKM matrix and of course one can expect some deviations of VCKM and UCKM some difference and therefore you can hit even central valley but what is important by the order of magnitude you really have very non-trivial agreement of the framework which I have formulated of form of the PMNS matrix with experimental results now what are implications what does it mean if not accidental still it may be accidental this means that quarks and leptons know about each other of course right this means that probably there is kind of quark lepton unification or maybe grant unification or at least some common flavor symmetry which leads to such a relation on the other hand some additional physics is involved in lepton sector which produces this UX matrix which is related to smallest explanation of smallness of netrina mass and that produces the difference between quark and lepton mixing so it looks like there are two different new physics involved one is which explains CKM type mixing both lepton and quark sectors and something new which produces the smallest of netrina mass and this difference the matrix UX and of course the most kind of complete unification is provided by SL10 now this is again kind of repetition of what I just said and so this form just to reiterate can be produced that this matrix come from Dirac matrices which is general for quarks and leptons and this is something which is related to mechanism of smallness of netrina mass another point which follows from this consideration that relation between quark and lepton mixing in the easiest form can be obtained using CISO type 1 mechanism so here you see the mass matrix of netrinos according to the CISO this is the mass matrix of right handed netrinos inverted and if you take into account that Md can be parameterized in such a way this is left rotation, this is right rotation this is diagonal elements of this matrix then in grant unification you can get immediately that the matrix of left rotation here is just coincided with CKM matrix so this is how CKM enters in the game now then UX matrix is something which diagonalizes the rest of the structure and more precisely of this form so that's Md, this is right rotation this is inverse of right netrina mass matrix etc so from here you can get also what is the structure of right handed netrina mass matrix and the key point is that it's very hierarchical because this Md is like a mass matrix of U quarks that may testify that actually even right handed netrinos their masses are produced by the CISO mechanism and nice relation is that you can cook this scale of right handed netrina masses from the gut scale squared or some new scale MS which is close to Planck scale or String scale so what is this double CISO mechanism and the double CISO mechanism introduce another singlets of standard model symmetry group and also singlets of S10 in our examples and you can get the following complete mass matrix these are light neutrinos these are right handed neutrinos and this is this S and so this is symmetric matrix it's more complicated of course than just a single CISO and diagonalization leads to the following form of the mass matrix of light neutrinos so it's Md, this one, inverse of this one then just linear proportional to this MS and it's a transparent part, symmetric part so this is double CISO and right handed a neutrino mass matrix is given by the formula which I have shown you before so now important feature which I will use in what follows is that if Md here is somehow proportional to this big Md then you have consolation here and the light mass matrix is just proportional to this mass matrix of new singlets so this what we called a screening of the Dirac structures and we know that the structures of neutrino mass matrix are not very hierarchical so one needs to get rid once you do unification of these very hierarchical Dirac mass matrices so complete screening if just Md is proportional to Md big and that can be a consequence of certain symmetries and then you have such an expression for masses of light neutrinos and you have complete freedom because now your mass matrix of light neutrinos is just related to this MS very heavy mass matrix and you can do what you want to do with this singlet mass matrix it could be also partial screening actually what I am using here that this Md is just gives VCKM but that can produce also some certain structures now what is framework and of course the first element is hidden sector and you cannot see anything here of course but most probably it consists of a lot of stuff some singlets of some fermions some bosons and maybe gauge interactions yukawa interactions and some special symmetries in this sector and maybe some symmetries which are common with our usual sector now there are a few signatures a few hints that such a sector exists and that comes from of course dark universe and presumably dark matter, dark energy body and asymmetry generation are somehow related to this hidden sector the hidden sector may be related to anomalies like LS&D reactor anomaly, gallium anomaly this 3.5 kV line observation and why not neutrino masses so maybe neutrino masses and mixing come from this hidden sector so this is the framework and I will show you this type of the diagrams without kind of showing formulas many times so what you see here we took SO10 so this is 16th plate of fermions actually there are three of course and this is usual coupling with 10th plate of hexes so this produces the masses of usual dark masses of fermions now we have a hidden sector and singlets, a number of singlets and also singlet of bosons which produce here Yukawa couplings and then we need to connect these two sectors and since we have 16th plate of fermions we need to introduce 16th plate of hexes in this SO10 model so things arranged in the following way CKM mixing comes from this part actually it should be of course more complicated than it's written here but for time being I will elaborate on this later now due to this screening effect no mixing is produced here and here apart from the CKM which I will discuss later and then all the mixing comes from this part and this type of the interactions should produce the matrix MS which I have discussed before of such a form approximately gives me kind of try by maximum mixing so screening matrix will be just one in examples which I will discuss but due to symmetry we will get this proportionality of Dirac small and big to kind of diagonal matrix so it's just one that doesn't produce any mixing and all mixing comes from here so these are just written explicitly interactions this is what is producing invisible sector Yukawa and produces MD this is what we call portal interaction it's fashionable, it's a portal for this kind of sound nice, you know this is interaction of 16th plate of fermions with hexes and with these singlets and this is hidden sector interactions couplings between singlets of fermions and singlets of standard model and SO10 of scalar fields so no mixing is generated here because everybody is sitting in one multiplet it's nice so this is the way you can decouple CKM physics from the rest from the hidden sector physics and even if it's not diagonal everything is rotated in the same way but masses are generated so the key point or the key element ingredient of this framework is so-called basis fixing symmetry and the point is that information about mass states of 16th plate should be somehow communicated to hidden sector so they still should chat with each other because otherwise it's just two traces and you produce just one mass state and nothing more, you cannot transfer information so information about mixing in the hidden sector should be transferred somehow to the visible one so for this the symmetry of this basis symmetry should be introduced which distinguishes three 16th plates and makes this FF interactions in a visible sector to be diagonal so what's interesting that the smallest group and here we use also the SO10 features of the model is this Z2 process 2 which can do this job and with charge assignment like here so I put one if it is transformed it's just like EI pi and zero if it is just like one you get this type of the matrix of the charges with respect to Z2 cross Z2 and you see you have zeros here in diagonal and all other are off diagonal which tells you that you have a diagonal mass matrix so you have also distinguished in such a way all three generations so interesting example if you make some other prescription you have the same result but in this way you can argue that that gives you three generations because three non-trivial combinations make a response to three generations of fermions so now mediator another important component in this framework is that you need to introduce some fields which are charged with respect to G basis and also hidden symmetry so this guy will actually communicate information and looking at this portal term and you see that as a mediator it can be one S this is the singlet of fermions it can be 16 plate of hexes another line or you can introduce some new flower ones and then you need to complicate your this portal interaction so these are new flower ones but then you need to have non-trivializable couplings here so they can actually be carriers of this basis symmetry and you see kind of connection how you transform information from 16 plates of fermions to a hidden sector here so here is connection immediately you just have immediately connection of the 16 plate with this one this is kind of summary of setup so we have CKM physics here which are associated with this S10 and 16 plates this is neutrino new physics which the logic stand comes from this new fermions in the hidden sector and new bosons and there is some hidden symmetry here but what is important you have here portal and portal symmetry is very important because the information which you want to send from here depends on the symmetry of your portal and now you see you you have now many games now you can play with symmetry here with symmetry here everything and what is important to a large extent separate the CKM physics here with this setup and the physics which is responsible for try by maximal mixing and of course dealing with singlets is much easier than just to build a model which is going to explain everything it could be bang now let me show you some realisation how much time do I have 7 minutes so this is one example I will show you just this type of the diagrams which repeat to some extent the first explanatory with some details and with the charges for instance this is the simplest example here these the singlets of fermions themselves are the mediators here you see the charges with respect to basis groups and one needs to introduce some auxiliary group to forbid some couplings which you don't want to have for instance just the usual mass terms simple mass terms for these singlets here we see we also describe some basis charges for these singlet hexes and it is this structure which produces the mixing so no mixing is generated here at least at this level now these are expressions for small Dirac mass matrices there are different Yukawa couplings apparently screening matrix is diagonal so everything is diagonal so it doesn't produce mixing for this reason and so this is explicit expression for this D matrix and now one needs to have just to obtain this unit matrix to have this relation between Yukawa couplings in the portal interactions and in visible sector so this equality either you introduce some additional symmetry or it may just come from the fact that your 16 plaid and singlets come or some kind of remember some further unification into E6 for instance when they are originating from the same 27 plaid now with kind of complete set of charges for singlet hexes here you can get any matrix MS and you can just say we are at very high scale so this is the scale which is close to string scale or plank scale there is no big hierarchy between couplings so all this kind of hierarchy is just result when you go down to lower energies but if you want to do better job so you need to make kind of more structured features for the hidden sector for instance you can introduce just two flower ones which couple with the singlets of this charge and then the matrix which you are producing is like this which is close to what you want to have so these elements are zero but you can generate them by different ways either in additional flower ones or due to interactions with other hidden fermions or as a high order effects now I haven't introduced even any hidden specific hidden symmetry and I have already produced mixing which is kind of reasonable just using this basis fixing symmetry now you can introduce some additional symmetries in the hidden sector for instance ZM and it is easy to do when it is a billion symmetry so now we are playing with a billion symmetries here and you can always add something more like for instance you can introduce ZM symmetry but what you need to do also you need to compensate to have a symmetric theory since your S1S transforms now according to this ZN in a portal term you need to introduce some other parts so this is additional flower ones which with the charges introduced in such a way that you have here invariant combination okay using this the model becomes like here now we have this additional hexes which are coupled with this 16 plate and they participate in the coupling between 16 fermions and the singlets with certain charges and here I use this additional hidden symmetry Z3 for instance so also you see the three charges for singlets and here for singlets of hexes and let me just tell you one can get easily matrix like this with dominant 2,3 block and again the couplings are of the same model you introduce immediately large 2,3 mixing and here is 0,1,3 mixing which you want to have and so you can play many many exercises here introducing different groups in the hidden sector structure however with a billion groups the only what you are getting is texture zeros texture zeros and you cannot have kind of non-trivial relations between elements for this you need to introduce by the way this is another example with another prescription you might get the mass matrix of this type which actually immediately give you a maximal 2,3 mixing and 0,1,3 mixing this is what you need to get the mass matrix but here you at best should have quasi-degenerate spectrum of neutrinos so this is another example with another hidden symmetry it's another kind of structure with different charges and you can get matrices like in the previous case also here now let me speak about introduction of non-abillion symmetries and here is kind of interesting thing close still since you have many singlets in your hidden sector it may happen that you can produce approximate or effective non-abillion structures just because you have many contributions to your mass matrix and so you may have equality or approximate equality of different elements in the matrix MS because there are many contributions from different singlets to this and so even though different contributions kind of have some spread the sum will be quite close to equality another way is to introduce explicitly some non-abillion structures in hidden sector the problem here is that all your three fermion families have different charges and therefore either you are breaking the symmetry when you introduce this non-abillion structure or you need to have kind of semi-direct products and therefore you can embed this in a bigger group and this is an example of what you can do so you may start with some flavor symmetry which is broken differently in the hidden sector in the portal interactions and we explore different kind of unifications and then in this case you can get almost like this try by maximum the important point of course breaking the symmetry somewhere here you will get some corrections so you can easily get such a matrix in the lowest order however corrections appear due to the fact that you are breaking the symmetry in the portal interaction and the portal interactions are at gut scale and you introduce the symmetry somewhere close to Planck scale so there's a difference of the scales and therefore corrections are quite small at the level of 10 to the minus 4 now give me 3 minutes more so very briefly this is kind of scheme how can you introduce some more these singlets in the hidden sector which are coupled with singlets which I have discussed but you should avoid coupling immediately here in the portal otherwise you will destroy this screening effect so this can be done and actually due to the effect of these singlets you may produce some interesting additional structures for the MS matrix in particular close to 2-3 permutations symmetry CKM physics just let me summarize and show you because we haven't elaborated so we separated CKM physics from the physics responsible for large mixing in the left hand sector so let me show you one of the examples the mass hierarchy can be produced in the way that the first generation gets the masses through high order operators like this the second one like this and the third generation is just at 3 level so for this unit introduce some another field scalar field which also comes from this hidden sector and to introduce this Yukawa symmetry and then describing different charges you can realize such a situation and for CKM mixing of course you need to have at least two templates and then to have different charges the mixing basically comes from down quark sector and then you need to introduce something more to explain difference of masses of muon and strange quark for instance so I have two slides with two explanation signs so how to test this scenario you may think but the most important prediction that nothing should be seen at LHC which is associated to neutrino mass generation of course it's important to make further precise measurements of 1, 3 and 2, 3 mixings then some special CP phases may indicate say something discovery of proton decay would be important then light sterile neutrinos dark matter inflation leptogenesis could be connected to this and I will not read what is in my summaries essentially what I was telling you already so we elaborated framework which explains this type of relation between quark and lepton mixing matrices thank you question the extra 16 representations 16 higgs doesn't affect the unification look you haven't even asked if it's supersymmetric or not so we put apart all these questions of symmetry breaking yes it should affect it depends on the masses so you can use these 16 plate also to break got symmetry so we just focus we don't want to produce even model I'm not saying this is the model how you can explain lepton mixing which can be embedded but one is to work on this and can't you write also the higher dimensional representation operator which is like 16 16 fermions 16 fermions 16 higgs 16 higgs which will give you which will generate for you neutrino masses so in the versions we have some auxiliary symmetries we actually forbidden this type of the most of these non-renormalizable terms are with singlets because it's easy if you introduce this kind of you know multiply 16 plates or so that is not so it becomes not easy but it's just non-renormalizable interactions are due to singlets and they are probably produced at plank scales so just you can actually have also renormalizable made them out of the coupling of some degrees of freedom at plank scale we just check that this is possible in your framework do you like myranna neutrino or this is optional so in this framework it is myranna neutrino and actually lepton number violation comes from this ms matrix so would you predict something for double beta decay look this is as usual because we have some parameters in principle yes it should be double beta decay but precise values of that one needs to do model building already actually we haven't discussed your masses the values of mass we actually discuss mostly mixing it's interesting in this framework you make to some extent decoupled mixing and masses depending on masses then you may get different predictions for neutrino as double beta decay okay so let's thank the speaker again


And I ask for applause for our speakers Bruns fx and Greg who are gonna well We might see Google and Apple go down today Thank you So sorry for the delay. I'm not used to have co-speakers. So we had synchronization problems If you ever did parallel programming, then you know what I'm talking about So what's the motivation here? If you look at modern client platforms that many of you carry around and I'm not talking about your mobile phones But the bigger ones Then you see fundamentally different like they're not the general computing device anymore that you used to have like a PC Could be used for anything, but now we see things that have different general ideas different architectures different software sources and clouds and rain and everything so We will talk about two different devices One of them is like if you ever get spam Look at look at the ones that come from Apple because like the iPad is the actual only penis enlargement device You can buy on the internet that actually works Which you can you know, you can enlarge it So Alternatively if you're if you're more old-style and you actually want a keyboard you want to open this You can buy something like this. This is a Chromebook from Samsung and it allows you to actually type so What do we not cover in this presentation? We're not covering iPhones iPad to anything jail-breaking or sim unlocking and I promise that was the only penis you saw in the entire presentation So let's get a bit serious We had the question before about the fanboys I had this idea of having the Apple fanboys with turtleneck on one side and then the Google fanboys with bright colors on the other Any time you buy a device or you decide to use a certain device Keep in mind that they're not doing this for fun or Because they want to be nice to you or anything There is very solid reasons behind it In this case, it's 29 billion US dollars reasons Which essentially comes from 32 million devices sold only in last year and that makes 20 billion US dollars just income On top of that 30% of every sale in App Store goes to Apple That's another 6 billion and then 30% of the revenue that your mobile carrier does With your iPad actually goes to Apple which ends up being two dot eight billion dollars Which goes to 28,000 shareholders and that's the entire reason they make the iPad so Accordingly the design goals of a device like an iPad are centered around this idea of revenue So what Apple wants is a consistent fluent user interface that you all jerk off to They want integrity protection of the operating system and upgrades Simply because they want to keep control over them and they want to restrict everything third-party Where you get the software what this software can do what the content is what content you can see And what payment models there are Protecting your data is actually not part of the business model so You get your software from the app store which essentially is your only source for software if it's not any app store It doesn't exist like if Google doesn't find it. It doesn't exist, right? You have an Apple ID. You have a very restrictive and fairly intransparent Sign-up process for development We went through that ourselves and got rejected several times for Don't know You're supposed to pay like a hundred or ninety nine dollars a year If if you're a lawyer or aspiring lawyer, I highly recommend reading the Apple contracts that come with the app store They're extremely entertaining. So essentially Pretty much every right that you would like to have goes to Apple But the entire damage is limited to fifty dollars So whatever they fuck up the maximum damage they have is fifty dollars Which is half of the damage that a credit card Puts on you So the same actually holds true for the for the review process for apps when you submit apps for the app store Essentially, nobody knows what happens.   So That leaves them with about 8 billion dollars profit They're not really paying that much taxes actually Which is to 67% voting power or 91% of the financial power goes to the two founders and the now former CEO so For that to happen for the user to actually supply all the data that they can Burn into profiles and then sell for this large amount of money The user actually has to trust Google that Google will do the right thing And if you ever wondered why Google comes out with like free operating systems for mobile phones This is what Warren Buffett calls a economic mode So you have a car so which is Google's money-making machine for ads and you don't want other companies to get close to the car So so you're providing free products in spaces where other companies actually need to pay and and actually Need to make revenue of the product and so you prevent other people from getting into your market And from this the design goals for the Chromebook Actually are derived and are a lot more a lot different So essentially what Google wants is exclusively running the web browser. You can't actually run anything else It really really doesn't want to have third-party software on the Chromebook For actual security reasons because here the protection of the user data is a design goal Because they want the user data to be safe. So the user is happy to use the Chromebook and sends the data over to Google Also, they want multiple users to be able to share the same device so universities can buy like, you know 500 Chromebooks and then Everyone uses them and they're all they're all safe and also Google understood very very early that winning the hearts of the nerds is most important.  This is so cool And well forgotten are all the privacy concerns and they understood that so Google also has a app store or in this case a web store and it follows the same principles They wanted to be open. You only pay like five dollars for Publishing you can only Publish Chrome extensions everything is HTML JavaScript Chrome extensions for the Chromebook cannot have NPA PI which is the old Netscape plug-in API Binaries because they don't want binaries on a Chromebook and the contractual relationship is actually fairly light compared to Apple's But then compared to Apple's everything is light So Let's go into details. I'm Greg here. We'll walk you through the iPad All right. Good evening everyone So for the iPad details First of all, we were going to have a quick look Over how Apple actually Implemented the iPad to achieve the design goals that fx already provided details on so The operating system on the iPad is basically the standard X and U system that you might already know from desktop OS X or you might not which is Mach microkernel plus a free BSD or BSD Subsystem based on that microkernel It's like the usual unique system like having a kernel and user processes and one non-route user named mobile Which is actually the user that runs all the apps on your iDevice There's a little bit of extra security on the system for instance a kernel module called seatbelt and it's Used to assign profiles to applications for instance this application is not allowed to use internet or it's not allowed to I Don't know make use of Location services and whatnot There is a signature scheme for binary files that is implemented Right from the bootloader on up to the kernel And this is what we were going to detail in the next slides Also, there is a system-wide secure storage for credentials like for your Mail passwords wireless LAN passwords, but this is not like a disk encryption system itself So all the data you put on the device is like actually not encrypted So like all the dirty images that might be on your iDevice All this is not encrypted and There is actually at least to our knowledge no app that performs like full disk encryption for the device Also, there is like in any decent operating system you'd expect there is a SLR and DEP at least in most recent iOS versions and that's basically it so The integrity protection scheme that is implemented on the iPad Which does all the signature verification stuff Is based right from the bootloader on so the bootloader resides in ROM, which is like real ROM It's not writable. You can only read it and within this ROM. There is the like first level bootloader Mmm Also, there is a apple public key in that ROM and the bootloader uses this public key to Subsequently verify all the bootloader stages that are loaded afterwards So the ROM bootloader loads the LLB from flash and Verifies its signature using the apple public key stored in the ROM Right so the LLB will then load the next bootloader stage from flash again Verifies the signature and the next bootloader stage can then load the kernel also verify the kernel signature And then the kernel starts and all the fancy user processes can can be kickstart and all that And that's that's basically it the kernel then makes use of the of a special Binary signature scheme to verify the applications on the actual device All right, that's at least a fancy theory behind it when they implemented it they Might have realized You know bootloader stages in flash can be corrupted So it wouldn't be very nice if the device was bricked just because the bootloader stages in flash get corrupted All right, no problem So they added support to the bootloader to support USB like USB based file upload So the bootloader says, yeah, you know, there is this special recovery mode, which is called DFU mode You can enter it by pressing a button combination during boot process and once you enter DFU mode the bootloader will actually allow Subsequent bootloader stages to be uploaded using USB. Still signature verification will be done. So this is not like Not like a very obvious backdoor that you could use still signature verification is done, but of course The bootloader Say implements an additional feature So basically there's a buffer overflow in the USB handling code and when you upload a bootloader image or yeah a subsequent bootloader image then You can overwrite memory exploit it to execute arbitrary code from the bootloader on and that you can use to break the whole chain of trust and this is interesting because Apple cannot fix it Because the bug actually resides in the ROM bootloader code and this cannot be replaced without removing the trip So this is the first fail here there is Some way to overcome the code signature scheme right from the bootloader on and it's not even patchable So that's that's for the first fail right but this bug is already known and So we were interested In how Apple actually implements all the rest of it so to do the code verification apple uses x509 x509 is like a Standard and so Apple probably thought it's good to stick with it So they use certificate planes to actually provide signatures for their code and Typical plane would be like there is a app root CA some intermediate CA's and finally an end entity CA Or and entity certificate which is used to sign the code When we disassembled the bootloader code, we found that for some reason it would not verify the x509 basic constraints So for those of you who don't know what basic constraints is X509 is usually Usually used to build planes of trust that is one certificate follows another and the first one signs the second one And so on and so on until you reach the end entity certificate And the end entity certificate is then not allowed to sign any more certificates Right because otherwise the end entity could just extend the trust of the root CA to some arbitrary other guys Which was not intended to do So the fact if a Certificate is actually a CA certificate and may sign further certificates is encoded in the basic constraints field And this is what Apple does not track in the bootloader So that basically means When we have a valid and entity certificate and the private keys that that belong to it then we can sign further Certificates more and more certificates are like with arbitrary content saying arbitrary things saying, you know This colonel is valid. Please load it And actually Ios Ios supplies us or Apple supplies us with a valid Sign certificate including public keys which they use for Authenticating against the post notification server and this certificate resides on your very iDevice along with the private keys So what you do is take off the certificate take off the private keys Use it to sign another certificate and then you have your arbitrary certificate that you can sign Right it all sounds too good to be true and it somehow is because the bootloader restricts the length of the certificate train so that We cannot actually use this hack to make the bootloader run arbitrary kernels because the train is just too long the train Including the post notification certificate is just not short enough for the bootloader. So um If you guys want your encouraged to find maybe more or shorter of certificate path that could be used to trick The bootloader into a loading arbitrary code. We haven't found one But still Such kind of buck is such kind of buck is Already interesting enough and so we decided to have a look at the user land at the user land x549 implementation Right, so that is actually the x549 implementation that your browser relies on And interestingly we found that also the user land x549 implementation but also not verify the x549 basic constraints and This will then allow you to impersonate like any website create certificates for Yeah, basically everything on the internet that uses x549 certificates, which particularly includes HTTPS Like all the TLS connections you make to your bank or to the Apple App Store I think we're going to get more details on that later on But also the all the all the encrypted mail communication that you use like the IMAPS and pop3s That's that's that you can all man in the middle We have set up a test website for it So if you're in the lucky unlucky position to have a still vulnerable device You can just navigate to this URL and if it says yeah, it's all right. You see the little lock icon then you're in trouble We Yeah, we're going to see a screen for later on We would have loved to save this book and to like keep it OD till now But it was a bit too severe to just let it Rot on our computers and so we already reported it to Apple and it's already fixed at least for those persons who don't own Too old hardware like on the iPhone 3d I think it's just not fixed because it just doesn't support any recent iOS operating systems And so much for like Apple cares about your security, right? Yeah, so that's that's the screenshot you see the fancy lock icon here It says yeah, it's all right, but it actually isn't because I've never in my whole life purchased a real certificate Okay. Um, the next thing we're going to see is the signature scheme they use in the in the binary files and this is also full of fail because Actually that that looks like very very intelligent idea to make use of binary signatures so that the kernel can verify the applications and all that but For some reason the signatures that are embedded in the binary files Do not contain Signature information about the whole binary file. It was about some Selected pages with which includes executable program pages and some other stuff But quite a bunch of meta information in the binary is not signed So this signature scheme has actually a long tradition of being broken in jail breaks This is what the jail breaking guys do exploit also and I don't know for at least three iOS versions I know of exploits for for this signature scheme. So this also can be considered fail the general General approach to break it is to make use of the unsigned parts of the binary to redirect the control flow of the program Which probably you'd expect so Up to iOS 4.0.1 You can use the library into position feature which is kind of like debugging functionality to make you or to enable you to redirect Library calls to your own code so that you can intercept it and debug it As you cannot directly supply your own code because you would have to sign that You just redirect the control flow Into some already signed binary and just do return-oriented programming. So that's a pretty straightforward way to get code execution there on iOS 4.1 They fixed the bug above But still there is of course still other unsigned meta information Which is called the initializer section that's similar to the constructor section in an elf binary Which allows you to specify an address of a function that has to be called when the binary is loaded and That's pretty straightforward to redirect to control flow to any part of the program that is already signed so again, you do return-oriented programming and that's it and Basically in more recent other versions like for the 2.1 You basically do the same but you have to pay some attention to overcome a SLR and do some fancy tricks to overcome some range Tracks, but basically that the the bug is the same that you exploit you still exploit the fact that not the whole binary is signed So also the signature scheme is considered a big fail at least from our point of view So just a short word about the update process on iOS the update process is actually pretty straightforward Operating system updates are covered by the integrity protection of the operating system So if you update the operating system, then you basically reinstall it using iTunes at least for Ios for older Ios versions The Ios 5 supports over-the-air updates, which we haven't analyzed yet So I can't make any claims here, but for older Ios versions. That's exactly the situation that the integrity protection scheme already covers it Application updates like all the stuff that you receive from the app store are also covered by the app store And this is what Bruins is getting to detail on So I won't won't Get too much into detail here There is one thing if you have a radio trip a GSM radio trip in your iDevice, then the carrier can actually push Say profiles to your device and those profiles include APN settings for the for the PPP connection all that stuff Also include proxy settings, but we haven't had a deep look into it So again, you're encouraged are to look into those profiles and see if there is anything Useful or interesting we can make of it All right, I think that's it So I'm going to hand over to Bruins Hi, so I'm going to talk a bit about the app store architecture the app store is mostly like a standard online store So you have content in HTML and JavaScript which is rendered by a browser and is transported via HTTP and For things like login and authentication and check out you switch to HTTP HTTPS So the client is mostly a web kit which only talks to Right-listed hosts and which has some special API which is implemented a native code So there are several problems with this if you want to profit from Browser security features then you need a browser's user interface because Well without an address bar HTTPS does not make so much sense and if you do not indicate the source of pop-ups Then the user does not know whether pop-up asking you for your password is actually supplied by a secure page Or by an insecure page Furthermore the JavaScript library kind of co-convents the same origin policy so well standard web security does not cut the cake for Apple and This is why men in the middle attacks are really really bad You can inject JavaScript into some harmless page and we dress the entire user interface and fish for passwords or you can install and Make the victim even pay for your historian by just calling this API API function iTunes dot by action and Things like CSIF tokens do not really apply because the native code will happily inject all the correct tokens for you This is really hard to fix for Apple Because the only thing that could do is switch the entire store over to HTTPS only So here we have a screenshot of how the login screen looks like You see no indication of the source of it It's designed to look like a native app and not like a web page the entire app store And here's the code how to render a fake login screen So however not even vanilla web security was done correct in the app store There were many things like insecure cookies allowing to take over accounts missing or well really missing CSIF tokens and Well, if you had an XSS bug anywhere, then you would get really really Trouble because you would get drive-by downloads And we had a we had an XSS in the search field actually so you would exploit exploit such a thing by redirecting from the Safari to An URL of the the special URL scheme which Yeah, which then starts up the app stock lines which visits the vulnerable page so In the search field, yeah It was this bug was a little bit hard to exploit because the red kid XSS auditor prevents The direct execution of scripts which are already present in the URL But you can inject an iframe with a data source in In decent browsers. This is completely harmless because Java script which executes in the data Origin in the context of the data origin can't do really anything. However, it can use the API so this got us a drive-by purchase download install attack and Here's the pock It's fixed by now, but maybe you can use it and find a different XSS bug like Anywhere in the whitelist of domains. So have fun with that so essentially bottom line for for the Apple story is They weren't essentially control your content, which you know bottom line means to control your reality and of course Apple could send you via Arbitrary means to the app store and push you an arbitrary app But now luckily we can do that, too If someone has physical access they can simply jailbreak your device and install additional stuff And remotely the app store vulnerabilities and that doesn't only hold true for Apple but for everyone with the app store concept Will be will be there and there will be high value bucks that people use to you know extend the functionality of your fancy penis enlargement devices So Is that me? Yeah So now let's look at a device that was built in order to be Secure in order so you use it so you put all your data into the Google cloud the Chrome OS is A Linux based device it has the regular linux security features Kind of user land process you have one uid running the user land processes You have a SLR and EP however like whatever they're good for in Linux You have a pretty strong prevention of native code execution So one of the evil things that they did which makes exploitation a bitch is There is no fire system that is writable and executable at the same time you can think of it as a fire system DEP You have a personal firewall after we mentioned it they added IPv6 support and You actually have like with the Chrome browser you have automatic forced updates So it will actually update no matter whether you want it or not The only thing that you can actually run on the device is the Chrome browser There's a few other things, but essentially it comes down to a very fancy piece of hardware that runs the Chrome browser Which by itself has a pretty solid security story it has a suid sandbox every process runs on a different user ID and You're not executing binary plugins It actually hides the file system from you. So when you're trying to save a file It will only show you the locations that you are supposed to see Funnily enough, of course the flash plug in coming from Adobe just you know completely endorse this idea and shows you the entire file system But this is not a security boundary this is just you know to not confuse the user Well, we found really funny as remember like 2008 when Alex Soteroff and and the people had this MD5 collision certificate for SSL so Firefox went that way that they added the certificate in order to set the block bit Well chrome did that too, but they left out to setting the block bit so It is in your certificate store Explicitly installed, but it's not set invalid Doesn't get you anywhere because that certificate is you know back to 2004 something However, that was kind of funny you have a Developer mode on the Chromebook. So you don't have to jailbreak it You have a little switch that you can turn on then you get a big scary screen that says well now you're violating your warranty or whatnot And then you actually get root access So how does the protection work on the Chromebook? So they they actually had some really good ideas the firmware and The the kernel and the root file system. They're there twice like there's two copies of each And every copy is like one chain So you have the read-only memory on flash that verifies the firmware key block that verifies the firmware pre-embled and you know, it goes on and on it verifies the kernel it verifies everything The key material in every stage obviously sits in a stage before And the two file systems and kernels and everything being redundant Allows them to actually have pretty decent recovery stories Also, the device system integrity protection is something new. It's called DM verities. So it's a DM Module for the device manager So what they what they do is they actually have the file system not covering the entire partition But there is Sha one hashes of the blocks behind this and then there is a hash over the hashes that gets passed as a kernel parameter Into them, you know into the kernel when you boot the kernel So that is pretty smart because you're actually checking the integrity of individual blocks below the file system once the blog is accessed and Once the blog is accessed and is in cash. You're not checking the signature again It's it's a principle that many embedded systems people should actually follow So there's a few imperfections that we found Well, Google guys are smart and we're not so smart. So But there's a few things that that you know showed the partition table is actually not integrity protected So, you know, if someone can write your partition table, you're pretty much fucked Then there's two partitions one is called the OEM partition one is called the EFI partition And they're not integrity protected So if you would actually buy the story that the Chromium OS is the same as the Chrome OS and you compile the Chromium OS And you put it on your personal laptop thingy You're not running the Chrome EFI bios. So it will actually load EFI stuff from your EFI Partition and Chrome doesn't care about this scenario and they just you know load whatever you have and this enables you to have EFI back doors Also, there's a funny Unfortunately, not exploitable but funny breach in the integrity protection chain because what they do is like I told you that they Passed the share one Of the file system when they load the kernel However, what they sign and what they check is this like when they when they actually load the kernel is this Parameter line and after the check they're actually passing in the GUID of the partition That is going to contain the hashes. So this is what's signed and this is what's actually booted So if the firmware can be made to you know Fuck this up, then it's actually using arbitrary disk space to verify the share one hashes Also, I mentioned in the in the intro that the Chromebook is meant to be used by many people so What Yeran who's unfortunately not here because he's deejaying right now at our party already What he found out is it's really trivial to you know solder two pins together and make the read-only flash area less read-only So once you install a different initial boot stop loader you obviously can do whatever you want So in this university scenario, I mentioned before it is to solder points to own every other student in your class forever Here's the user data encryption It's pretty decent. I'm gonna skip over that because we're running out of time. What is interesting is that What Google did was they actually connected your account password to the crypto scheme, so the part of Part of the key scheme actually depends on your account password, which is then truncated to prevent offline brute force however effective that is So web story. Yep. Yeah, so the Google web store is used to distribute extensions for the Chrome browser and So which are in most in HTML and JavaScript and These extensions get access to an additional API Depending on permission squandered to them by the user upon install These extensions are partially for free partially you have to pay for them But you always get the source code because it's JavaScript And extensions are really really good for e-banking trillions and this kind of things Because the API is designed to make it simple to inject into the DOM of other pages So, I mean, it's like like a work of a few hours to write something to attack an e-banking site in this the first thing to note is that You do not have to actually pay for paid extensions. You can just Construct an URL which allows you to download them This also applies to beta test to extensions and beta testing and Google won't fix it. They will update the documentation. That's their fix So how to install malicious extensions onto a victim's browser So the first thing is of course social engineering But otherwise what's interesting is Google sync so you can synchronize a list of installed extensions to your Google account and If you enable this then a point Google account means a point browser Furthermore, there was one really nice bug so Chrome exposes a special API to the web store domain and this one is used to install extensions and They kind of fucked up the white list. So there were HTTP domains inside So you so you could install extensions from a man in the middle attacker and The confirmation dialogue where the user grants permission also used to be rendered from JavaScript, which could be Forgotten by the attacker So another thing is There are really more things you could do with malicious extensions For example, you could run click-jacking attacks against internal browser pages in order to do things like insert new SSL certificates You could rewrite download links so that they point to malicious files afterwards in order to get full system compromise Okay, so much for the Google web store Another thing we looked at our Google apps Google apps are very different. These are just plain web apps like Google Docs or Gmail and You need to see if you use this then you completely trust into one session cookie or into a lot of session cookies if you lose one of them all your data is lost or if Google stops behaving fair to you and There are many many Google apps by different authors also many of the apps which are by now provided by Google we're actually produced by companies which Google bought and This is very inconsistent and Basically an authentication nightmare, so some of the inconsistencies One thing was macros in Google Docs, so you Google Docs you can upload macros and some javascript dialect and these are executed server side also, you're supposed to There's some kind of marketplace for macros where you can execute or import macros written by other people For example, one of the most popular macros was a credit card number validity checkup by some Russian authors Yeah, so Luckily you can inspect the source code this one was actually benign, but if I used it in my well spreadsheet then later on the author could update his script and it would update in my spreadsheet as well and be less benign Furthermore Uploaded loaded macros I executed server side and they can issue web requests and these come from Google servers so that's fun for IP address filtering Adverse filtering and it's really fun for denial of service because these Google servers have a big big pipe Only Google can DOS Google so somehow inconsistencies there when you serve long and look at the various different things that can happen between the Google pages we had one bug where Where when you when you switched accounts there was a token which was transferred in the clear so I think the details are not that interesting any longer it's fixed and You could exploit it by logging a user in from a man in the middle attacker So There were also some cross-site scripting issues. I don't think I'll Go into the details, but what's interesting is the quality of the code is really really inconsistent I mean, there are services like postini by Google which have an abysmal source quality source code quality like multiple cross-site scriptings and search panel in the search fields of an admin panel I mean, it's really different The quality of the different Google apps Another important point if you want to entrust your data to the cloud is How do these different? Well, Google how do these different web apps exchange your data? So it's supposed to work via protocols like o out or o out to or outs up and the idea is a page like if comm requests access to my my data on Google and redirects my browser to the Google page puts its Access request into get parameter and then Google asks me whether whether I should allow the access and Then a token is generated and passed back This is bad in view of URL redirectors like this Google wants to access my data on Google Well, better allow However, the data is sent In the end to us Because it's leaked in the referral because this Huge URL there we directed to our home page. So That's it for me Thank you So essentially if if you're a fanboy, then you don't want to hear this Essentially Google can do whatever they want to your data. That's the whole point If you know you follow the drama with g plus accounts People putting all their data in there and then you know having this account cancelled because their name doesn't sound like a real name We actually do think that there will in the future Be more and more ways that people can get your Google account or session The thing where with the whole cloud concept is the moment someone gets your session You're fucked.  So If you like to go to, you know cafes with Wayflan and hang around in the st. Oba cloppy in Berlin or somewhere You shouldn't actually use your Google accounts This can lay this can actually affect you really hardly. I talked to one of the HP Gary guys They were watching anonymous downloading their emails for eight hours before Google actually closed their account That hurts Back to the Chromebook if someone has physical access to the Chromebook And Google doesn't promise you any security on the on the physical access scenario they can essentially back to work but forever and That's bad because the design is shit. The device is designed to be shared and Well, if you install the crew a Chrome extension where you update a Chrome extension Be sure that you know that your ass is owned So in general Well, what we found after we looked at all those issues is this is not the security you're looking for Whatever altruistic reasons you think the company has to provide you with the core tools and the core web apps that's not the reasons they have and If you rely on a cloud system to have all your data in it's you're putting all your eggs in one basket And it's not your basket They don't care if they lose a single user. You will probably care if you lose all your data What is also interesting is that if we look at web security and I mean the company Google is To the rim full of brilliant engineers, but even Google Appears to think that over as top 10 is something that you need to achieve for compliance Which in fact, you know, you should actually not have And Greg wants to say something I think Yeah, right So the point here is Regarding the Apple data protection If Apple actually wanted to protect your data They would probably allow you to roll your own crypto on the devices to exchange the root keys and all that stuff But they don't that's not about your data. That's about Apple's security here. That's not your security, right? So that's that's just regarding the Features marketed as security for you. Maybe security for the vendor. That's that's the point here.  This is the night to do so. Thank you Thanks very much to all three of you for that very thorough analysis. I I'm sure there are lots of questions and I guess the guys are happy to take them Thanks for asking questions that makes that brings drinking 10 minutes earlier Yeah, you know the deal we have the mics in the aisles so if you line up at those mics Okay, so thanks for your talk. It was very interesting, but What are we supposed to do now? I mean iOS and secure the Chromebook insecure.  Hi, you mentioned that the iPad comes with a pre is shipped with a user certificate. I wonder is this the Is it really shipped with the certificate or is it the one which is downloaded during the activation of the iPad? As far as I remember it is not yeah, it is actually downloaded as far as I remember So but in that scenario it doesn't make any difference because you get the certificate when you register or activate the device So one question from the internet Does the two-factor authentication protect against the Google Chromebook attacks? I think he means two-factor authentication process helps against the Google Chromebook attacks. I think Matt is the Google two-factor authentication where you get an SMS message with a token for login So Most of the attacks like not just the ones that we found but the ones that we're expecting to see in the future deal with especially in the Google Cloud scenario deal with stealing the session cookie. So that's past the authentication So no matter how many factors you used for authentication at the end of the day the web applications need to Keep the authentication state and that's in a session cookie and this is what you usually steal That's it. Thank you very much for coming and let's have a party