Hey, this is Brett, and this 2021 Ram 1500 Crew Cab 5 foot 7 inch short box Laramie Level B Night Edition is stock number 14150ZA. I am here at Summit Automotive in Fond du Lac, Wisconsin, you're new and used light duty truck and Ram headquarters. This 2021 Ram 1500 has the 5.7 liter V8 Hemi engine with the e-torque assist. It's paired up with the 8 speed on mag transmission. This truck has been fully safe to be inspected by our service shop, has a fresh oil and filter change. All the fluids have been checked and topped off per the state of Wisconsin inspection process. This truck is 100% ready to go. I'm going to go all the way around in this video inside underneath, start it up, take a look under the hood and give you the most accurate representation that I can of the vehicle, show you all the options as well. Bright white clear coats of color, I shoot all my videos in 4K. If you like the video, subscribe to the YouTube channel, click the bell notifications, get updates in the videos I do each and every day as well as having access to one of the largest catalogs of vehicle and light duty truck walk-arounds on YouTube. 9,000 videos in County and stay current on our inventory here at Summit Auto. This one comes with the 22 inch painted black alloy wheels and it has Goodyear Eagle Touring 28545R22 tires. I would say these tires probably have about 50 to 60% of the tread left on them. Frame and underbody is in nice shape. This is a clean title history out of Michigan and Wisconsin. Front fender is absolutely perfect. You get the LED headlamps, running lights and fog lights. No major dents or dings on that front bumper. You get the painted bumpers with the night edition. You also get the gloss black grille. That's in really nice shape. The hood is in really good condition as well. No dents on that. And the passenger side front fender looks really good. Get the fender flares with the Laramie package, passenger side front wheel, no major scuffs or scrapes on there. And as you go down this side of this 2021 Ram 1500, take note of how clean the body is, how reflective and mirror like that paint is. I take these HD videos so if you're far away or even if you're close by and you just cannot make the trip down but you're still interested in purchasing the vehicle, you can see the truck, hear the truck, and have confidence in the vehicle that you're looking at before you can get here. So when you do get here, there's absolutely no surprises and you can make a smart and informed buying decision or just make the decision to come take a look at the truck from wherever you're at. If this video helps you do either of those things, let your salesman know that you saw the video. It was helpful and that brought sent you back wheels. Absolutely perfect. And the back tires have just as much tread as the front tires. You get the plastic wheel well liners, which keeps your frame and underbody looking good. Very little to no corrosion under there. Lower rockers all look really good. It does have the power running boards. I always like showing both sides so you know that both sides are working properly. Pass under side box, no denser dings on there. You do get the LED tail lamps on this one as well. Rear bumper is absolutely perfect. No dense or dings on that. You get the black chrome looking dual tip rear exhaust towing package with the receiver hitch four pin and seven pin wiring. The tailgate is in nice condition as well. You do get the blacked out four by four Ram and Laramie logos on there. And this one comes with a tiger soft tonneau cover. This is a power drop down tailgate has a shock down assist. So it's never going to slam on you. It also has a drop in Ram bed liner. That's in really nice shape. And that bed liner goes on to the tailgate, which is a really nice feature as well. Tailgate shuts nice and solidly and coming down the driver's side just as clean as that passenger side. No major dents or dings on the box. And for full disclosure, this back wheel just as nice as the rest. Capless feel fill, never get gas on your hands again. And down the rest of the side of the truck. Cab and doors all look very, very good. You do get the heated power mirrors blind spot monitoring or blind spot mirrors, I should say, and built in directional signals. This one has the enter and go system. So just put your hand in there. It'll automatically unlock if you have the keys in your pocket. And the power running boards on the driver's side work really well as just as well as the passenger side back seats. No rips or tears back here does have the leather and suede interior. You get the speakers in the ceiling. And that's part of the Harman Kardon premium sound system. Power side and rear window with the rear defrost has the fold down headrest for better visibility when nobody's riding back here. These seats do fold up. You get a storage area under there, all weather floor mats back here in floor storage with removable bins for easy cleaning. You can put ice and drinks in there.  There are your heated seat buttons for the outboard side on the back seats, two USBs, two USB C's and a 115 volt 400 watt plug-in. These seats do decline just a little bit. There we go. You can see how much they recline there. Put them back like that. Child safety locks on the back doors and the inside and bottoms of the doors all look really good. I'll show you the VIN sticker here. No previously owning Canada trucks here. And then the tire and loading information sticker. Inside the Laramie level B package gives you the bucket seats in the front. You get that same suede and leather trim seats with the gray piping on there. The Laramie stitched into the backrest. No rips, no tears on those seats. Power driver seat with lumbar. Factory all weather floor mats up here as well. Power pedals, auto headlamps, tilt telescopic steering wheel. Power windows, locks and mirrors and memory driver seat. These mirrors do power fold in. I always like showing both sides once again so that you know that both sides are working properly. We'll hop inside, check out the miles, radio and everything that this one has to offer on the interior. And then start it up. You can see this one has 62,806 miles on that seven inch LCD display. Digital spinometer and compass display. Oil temperature range to empty. And you can change all those corners to read pretty much whatever you want. And the instrument cluster is very nice and clean. Comes with the heated leather wrap steering wheel. Cruise controls and gear selector on the right. Bluetooth and information center controls on the left. And audio controls on the back of the steering wheel. Steering wheels in really nice shape. Nice and clean as well. Push button start. Push button four wheel drive. Start stop capabilities. There's your shifter for that eight speed automatic transmission. This one has the Uconnect 12 inch. Uconnect four 12 inch radio. Has the factory navigation system on there. There's highway 41. So you can see that is working nicely. You also get AM, FM and Sirius XM radio capabilities and USB hookups. Here you're heated and cooled seat buttons as well as your backup cam. And you can see how crystal clear you can see that backup cam. And you can zoom in on the receiver hitch to get it hooked up to your bolt camber or trailer the first time every time. Here you're climate controls, including your dual climate controls. If you don't like doing them on the screen, do them on the side right there. There's your Harman Kardon badge. And then lastly, you get all your different apps. This one has projection manager. We project your cell phone to the screen via Android Auto or Apple CarPlay. We did a demo on Android Auto with a 8.4 inch screen. Same radio, but if you want to check that out, that's in the upper right hand bar screen. Stability control toe hall mode, front and rear parking sensors, two USBs, two USB C's. And an aux jack. There is your wireless cell phone charge pad. And down there is 115 volt, 400 watt plug-in. You get your sliding cup holder and coin tray right there. Here's your keyless entry with your remote start and power drop down tailgate. Passenger side, format and seat. And glove boxes are all in excellent shape. Smells very clean inside this truck. You get these second row fixed glass power sunroof in front. Vista roof. You get map lights up there, assistant SOS buttons, sunroof and sunshade controls as well as your power drop down tailgate button. Auto dimming mirror and your home link buttons for your garage door security systems and lighting systems. Let's start it up and take a look under the hood. And check out all those LED lights, as promised. Starts right up, no check engine lights or anything like that. It does have the digital speedometer on there. I would personally like to thank you for checking out the video today. And hopefully from this HD video, you've been able to verify the quality condition options. And of course, cleanliness of this truck all the way around. I think it's in fantastic shape considering the miles on it. Really nice condition. All those lights are very bright and working nicely. Under the hood, we have the 5.7 liter V8 Hemi engine. With the e-torque assist, and it's got this silver box on the top. It's got the e-torque assist. Once again, this truck has been fully safe and inspected by our service shop. Has a fresh oil and filter change. All the fluids have been checked and topped off. This truck is 100% ready to go. You can see the shocks are doing a nice job holding that hood up. There is the emissions sticker. And I would highly recommend this truck from a quality and condition standpoint. I think whoever's going to get this one's going to be very happy with it. And to see more pictures of this truck or one of other 550 new and used cars, trucks, SUVs, minivans, wranglers, halftones, three-quarter-tons, one-tons, you name it. We've got to go to the website right there, summonauto.com, full pictures and descriptions of every single vehicle all at summonauto.com. And if you'd like to check out more HD videos, you can go to youtube.com slash summonauto. Click the bell notifications. Get updates on the videos I do each and every day, as well as having access to one of the largest catalogs vehicles and light duty truck walk-arounds on YouTube, 9,000 videos and counting and stay current on our ever-changing and vast inventory here at summonauto. In fact, in a second, you will see a link to subscribe to my YouTube channel on the upper left. A link to all the Ram 1500 truck videos I've ever done in the upper right. Link to this vehicle on our website and lower left in a link to one of our latest YouTube videos on the lower right. Click those, check us out. We're super excited to help you with this ultra-plated 2021 Ram 1500 Crew Cab five foot seven inch short box Laramie level bead night edition in bright white clear coat. Thanks again for checking out the video. Remember to like, subscribe and share on the YouTube channel. I really appreciate it. Thanks again.


Hello and welcome to the session, let us discuss the following problem today. Let every function from n to n be defined by f of n is equal to n plus 1 by 2 if n is odd and n by 2 if n is even for all n belongs to n, state whether the function f is bijective. Just define your answer. Now let us write the solution. Now let us first check for 1 1. We take that f of x is equal to f of y which implies x is equal to y or not. Now consider 1 comma 2 belongs to n. Now f of 1 is equal to 1 plus 1 by 2 which is equal to 1 and f of 2 is equal to 2 by 2 which is equal to 1. Thus f of 1 is equal to f of 2 but 1 is not equal to 2. Therefore f is not 1 1. Now let us check for on 2. Let n be any arbitrary element of n. We have to prove that for every n belongs to n whether even or odd there exist its pre-imagined n. This is an odd natural number. 1 is also an odd natural number minus 1 which is equal to putting to n minus 1 in our given function we get 2 n minus 1 plus 1 by 2 which is equal to n. Now if n is an even natural number then n is also an even natural number. f of 2 n is equal to 2 n by 2 which is equal to n. It belongs to n whether even or odd there is a pre-imagined n but since n is not 1 1 therefore the function is not bijective. You understood the problem. Bye and have a nice day.


Hold on... Just a little while longer Hold on... Just a little while longer I'm just a little ey...! Just a lit...? Just a little- Just a lit откol bespوا


Right next to me are Daniel Crowley and Damon Smith They are both security engineers for the NCC group and they told me they could not bring a unicorn today Very sorry. Yeah they're gonna Tell us about some special properties in regular files, so Exciting, I think do your best. Thank you. I Think you're wrong. Hello. Hey, great microphone volume. Love it So as previously stated and we're here to tell you about bugged files, so Let's start out with a quick introduction. Hi. My name is Damon Smith as mentioned I am a security engineer working with NCC group Traditionally my focus has been application security including web applications embedded devices Mobile applications more recently. I've started doing some Research on file formats with this lovely gentleman right here So I mostly work. I'm also a security engineer within NCC group and I'm mostly like working with web applications crypto some embedded stuff and File formats, so let's let's move on so just to Clarify a little bit this this talk is is focused in a particular way and We're gonna be talking about files that trigger outbound traffic when they're opened We didn't want to look at executable formats because it's not really interesting for me to tell you that an executable can make Outbound traffic when you open it because there's a lot of other nasty things that can do of course We didn't really try to limit it to complex formats or simple formats or anything like that We were taking a look at what we believe are very common formats So We also didn't want to use any exploits. We didn't want to find bugs in file parsers. We wanted to Use only the features of the parsers and the formats that they're parsing And we also want to discuss the implications of all this So why should you listen to us talk at you for the next 50 minutes? We think that the research that we've done is very important for a variety of different reasons the first and most obvious reason are the privacy implications Imagine we're going to go over some of these use cases in a little bit more detail But for now imagine documents that can phone home every time you interact with them This can be used in DRM data loss prevention and of course de anonymizing users in addition to the privacy aspect There is also some serious security concerns with these types of file formats which we'll go into a little bit later Finally and I think most importantly all of the things that we're going to show you today are not bugs They're not a mistake that a programmer made. They're not off by one errors They're not memory corruption. These are things that were written into the RFC They are in the file format specification and they are working as intended This is not something that's going to be fixed on patch Tuesday. These bugs are going to live for years so We're gonna start with a quick demonstration with three different formats RTF SVG and WMV a quick prayer to the demo gods, please So here I've got I've got metasploit open just for the SMB capture so We've got this can everyone see that okay Yes, excellent, so we've got this providing the standard challenge and dumping to a file And over here we have our victim machine With several of our bug documents and this is running Windows 8.1 fully patched. Yes So we're gonna open up this RTF file now Something interesting happens here When we open this You can see in a moment. It's going to pop up a little Dialogue that says this document contains one or more links to other files Do you want to update this document with the data from the linked files? What's really interesting about this is that it has already Sent the hashes along so worst warning message ever, right? Yeah and I think probably they're looking for they they're looking to prevent bugs with You know the document attacking some parser, but Even if we say no, it doesn't matter because the hashes have already been sent, you know cats out of the bag so just So there's nothing up my sleeve here. I'm gonna clear clear this and We'll open up this SVG file by default on Windows SVG files are parsed by Internet Explorer Yeah So there's a bunch of fun things that you can do with Internet Explorer regarding this and if we have time We'll discuss that a little bit But here you see An image format of all things can can cause this interaction to occur So our example SVG file is blank But you could easily have whatever arbitrary image that you want show up so that people don't get suspicious absolutely So what I'm gonna do now we've kind of set this up to knock it out of the park It's not always gonna be this easy But in this case since we it was not quite so easy to set up a demo for NTLM relaying Which would be mostly what I think would be useful We're gonna go ahead and just crack the hashes that we've received and Here we see That we've got a throwaway account with the password of throw away so like I said, we set this one up for ourselves, but We we now just because somebody opened up a document that is you know, not malformed It's like a well-formed example of a format that's using its features You know everything is working as normal, but this is normal. So this is by design people This is how it is supposed to work. So It's just a lot of things that when put together don't work the way we really want them to So the last thing that I want to show you here is a Windows Media video file This is a slightly modified version of a video that comes with Windows by default As it turns out you can actually cause Interactions to occur from a video This is again, this is part of the format and we will be discussing this later on But we've just had it launch a a browser window So that's lovely So that concludes the demonstration and we're gonna start talking about, you know, all the different formats that we have That we've got things on and sort of the implications and whatnot so Continuing on from the demo. I probably should have hit play from current slide and I'll play from start so So there's been some prior work in this area and Damon would do you want me to take this one? So there's been some prior work in this area This is not really a new technique. We're not pioneering this whole hey, let's send ntlm In let's send SMB and get ntlm hashes This is something that's been known for a while. There's a tool out there called Zac attack which implements many of the ones that you see here There's also a tool in Metasploit that's been around since 2008 but but this problem still exists and We kind of wanted to see like how how widespread is this? So it's already known that you can do this with the office format the office open XML Which is not confusing at all when compared to the open office XML format, which is it from a different Anyway, the Microsoft XML based document formats There are ways to do this PLS playlists Shortcut files, I can read it to you, but I think you guys can read Some other silly things in Internet Explorer HTML elements can reference SMB paths and cause this interaction to happen So for instance in in Windows media player You saw that we were able to pop open a browser window using Windows media a Windows media video file We can load that up to a URL Which then has an image on an SMB resource and triggers that same ntlm interaction The same thing can be done in HTML emails in Outlook So that's a little bit of the prior art in the area. What did our research focus on? So we focused on three families of formats document formats media formats and group where formats are meeting and scheduling formats We wanted to look at file formats that your traditional corporate employee on your traditional corporate build is likely to open For instance PDF files, that's something that your average corporate employee is used to receiving in their email on a daily basis And will blindly double-click them with how and any thought So that's the that defines which file formats we specifically looked at So one of the most obvious ones is PDF This was immediately something that we wanted to take a look at. It's a very complex format We knew there was going to be something in there somewhere and they're incredibly common PDF files So we spent a little time on this you can embed remote images in PDFs as it turns out So this will just automatically go and fetch the image when opened One of the interesting things is that So as a note these only work on Adobe Reader Most of the PDF readers out there have a very limited subset of the PDF functionality available So Firefox, Chrome Preview from macOS all of these Support a limited subset of PDF functionality and these techniques don't work on them Fortunately or unfortunately depending on who you are So the remote image functionality That basically just grabs an image from a remote endpoint and displays it within the PDF And of course you have to reach out to a third party to get that and if you're creating the PDF document You're choosing who you connect to There's also JavaScript functionality in PDFs, which is you know, what could go wrong, but There is a method that allows you to open a video player within a PDF, which is is Insane I can't imagine why you would ever want to do that I can imagine why you might want to but I might you know need substances first But regardless I just you know Maybe I'm just not thinking of PDF in the way that other people are thinking of PDF regardless You can open up a video from a third-party location And the same and there's also a method that allows you to Just pop open a URL in the browser In the default browser that is which is get URL and this you might be looking at this this warning message and wondering What's going on here, and I'll I'll leave it to Damon to explain the the nitty-gritty details behind that So as we mentioned it is possible to open SMB pass within the JavaScript parsing engine of PDF readers Unfortunately, it does issue a warning message. However when we were investigating this particular bug We found an interesting aspect to this warning message Many of you are probably already familiar with UNC pass which is something like slash slash host name slash share name slash file There is an additional form of UNC that you may not be familiar with called long form UNC that goes Slash-slash question mark slash host name slash share name slash file I don't really know why that exists, but as you can see from this warning message We actually confused the PDF reader into thinking that the question mark was the host name So we can cause you to connect to dub dub dub sketchy attacker website comm but your PDF reader will instead say this document is trying to connect to Huh, do you want to allow this? I'm not sure if that's more or less sketchy than saying dub dub dub dot attacker comm But you know it's a it's a neat nuance of this particular format So have fun with it. We thought it was funny enough to include regardless of whether it's actually useful to anybody So the next format that we have and one that you've already seen a demonstration of is the rich text format The very cool thing about the demo that you saw earlier and the proof of concept is that it works in both WordPad and Microsoft Office So it doesn't matter if your victim has the Microsoft Office suite installed or not if they double-click this RTF file You will get their NTLM credentials Additionally as you saw during the demonstration It does put up a little warning message about linked files and do you want to display them? But it only displays that warning message after it has already sent your credentials to the attacker making it possibly the most useful Sorry useless warning message ever You also saw the I think it's actually So the other thing that we've already demonstrated is SVG which stands for scalable vector graphics It is an image file format But it is for displaying vector images instead of the traditional image formats which are used for bitnet images very quickly the difference between bitmap and Vector graphics is bitmap roughly is a data structure that defines this pixel has this color and this Transparency and all that and then it describes the next pixel and the next pixel and the next pixel until it has built the Entire image with vector graphics it describes the image in terms of vector functions So it says draw this line from here to here with this color So it's two different ways of encoding an image file An SVG as we mentioned during the live demonstration by default on Windows is parsed with internet Explorer The fun thing about SVG is the way that it's structured It is a markup language very similar to HTML and it actually implements a subset of the HTML language As part of the SVG format one of the things that you're allowed to specify in an SVG file are remote XML style sheets So I can say load this cascading style sheet from this remote location And if you're using internet Explorer, which by default on Windows you are It will accept file paths. So you can say for this image file I want you to download the style sheet from this remote SMB share Which of course as you saw during the demonstration leads to disclosure of NTLM credentials Additionally, they can run JavaScript. Did you know your images could have JavaScript in them? No, because that's insane So we took a look at various playlist formats as stated earlier in the talk PLS is prior art. That was not our Discovery and but we found out that both M3U Which is closely tied to the MP3 format and ASX Which is more of a Windows media specific playlist format both of those are also susceptible to this sort of Tom foolery So basically all of these playlist formats support for you know Reasons of internet radio and that sort of thing remote paths. So obviously there's the the ability to make remote references interestingly and Now I think it's probably the right time to bring up That Windows is where UNC paths are handled in general the same API call that is used to open a file from the local file system is The API it's the same API used to open UNC paths. It just sort of at some point during the the function call Sees oh, this is actually UNC path. Let me handle this remotely. You know this like remote interaction so You don't necessarily need to Write you went like SMB UNC whatever handling into your parser You just have to like use the standard way of interacting with the file system in your parser And Windows will make make this happen for you so most of these playlist formats are just They're a simple and in the case of M3U at least As a list of items a list of paths To be played so in all of these formats instead of specifying a file path You can specify UNC path and it will do the interaction sort of interaction that you saw previously Or if you just want to see when somebody opens up your playlist you can embed a remote reference at the start So the next format that we looked at is actually a family of formats the ASF family of formats Which you are probably more familiar with as Windows Media video and Windows Media audio This one was actually really interesting to us because who thought that your audio and video files could contain remote tracking code So this was actually kind of surprising result. It comes courtesy of a friend of ours Derek Hinch black days So shout out to him for introducing us to this technique the way that this is accomplished is by embedding script metadata Into an WMV or WMA file You have the ability to embed scripts in these video and audio files such that when playback reaches a specified point for instance Five seconds in it will execute the constants of this script command This has traditionally been used to accomplish things like closed captioning So you can have it display text on the screen when you reach the 30 second mark that corresponds to whatever the people on screen Are saying at 30 seconds. That's more or less how closed captioning is implemented in this format However, when you're looking at these script commands in addition to doing something like display text on screen You also have this really cool one called URL and exit which means open this specified URL and the default browser and halt playback As you saw during the demonstration this equates to you are watching a video file that you you know, whatever video file I'm not gonna I'm not gonna speculate on what kind of video it is. That's up to you But anyway, so you get to the 30 second mark That's when the video starts to become really interesting and bam It opens up your browser window to www.nsa.gov slash you've been tracked lol all so That's that's what we're running into with these file formats Yes, your video files can contain embedded script commands and yes those script commands can de-anonymize you which is really unfortunate additionally a Technique that we've postulated but have not yet proven is abusing the built-in DRM functionality So to briefly describe how DRM works in this family of formats It's actually quite simple It encrypts the entire video file and then in the header information it specifies if you want to watch this video file You need to go to this URL and download the decryption key That's more or less at a high level how DRM is implemented in these formats. It's fairly obvious that this can be used to track people Unfortunately, this is something that we haven't yet demonstrated because the DRM is so horrible to work with that We can't even get it working legitimately much less circumvented, but look for that in the future That's probably a technique that either has been used by your adversaries or will be in the future Additionally one quick note subtitles they can include arbitrary HTML Not just bold or italics or underline like you might expect in a subtitle But they can include things like image source equals so you can actually have subtitles in a video file They reference a remote image. I don't know why that's the case, but that can also be used for tracking So the next format that we took a look at was mp3 and this one was obviously very interesting to us You know, obviously there are a number of entities that are looking to crack down on piracy So this was definitely an interesting one for us The thing is that mp3 is actually a rather Simple format in comparison to some other formats mp3 by itself doesn't actually include any metadata whatsoever And this might seem confusing to you because you know, obviously mp3 is that you might legitimately acquire Have metadata and I'm describing the artist the album and all that sort of thing and as it turns out That's actually a separate format called id3, which is just sort of de facto part of mp3 now so Since mp3 is basically just a series of fixed-length blocks that say here's how you're going to interpret this block of data as Audio neck, you know coming up and then the the block of audio data and repeat that until the end of the file Id3 was the obvious choice for going after this one of the things that we learned while doing this is that People don't always follow the RFCs when creating something that is working with whatever technology you're defining There's there so id3 is The way it's structured is as a series of frames, right? So you have sort of like here's the type of frame and here's the length and then here's the frame data, right? So there were two that were interesting to us the link frame and the a pic frame link frame basically says the frame You're looking for is in another castle So, you know go off and fetch this frame from this other file here So I was like yes, that's what I want and and then there's also the a pic frame which is attached picture So you can say this picture is not here. It's in another place go fetch it So the thing is no player that we looked at and we looked at a lot of them support either of these types of frames However When we found out that you could do the the scripting content in WMA files as it turns out you can just rename a WMA file to .mp3 and as long as it opens with Windows Media Player, it will be like oh Oh, this is this is name-drawn here. I'll open this as a WMA file. Oh, oh, you want me to open a URL?  So there you are You might be wondering why there's a picture of a fish on this slide There's some hilarity in the id3 RFC as it turns out as a part of the a pic frame you specify What type of picture is attached? Number 13 is a bright colored fish For whatever reason Another fun fact Primus has its own innumerable like genre number in id3. So Go Primus, I guess So we also took a look at the torrent format Again, you know, lots of entities looking to de-anonymize Pirates and torrenting for whatever reason they you know has some ties with that so This one is actually pretty easy because you can have as many trackers as you want on Listed in within a torrent and when you open up the torrent It's going to check all of those trackers until it gets you know a certain number that are actually active So it's just going to visit URL after URL after URL And so you can get it to reach out to however many different places you want And since people tend to open up torrents and then just kind of leave them going for a while The fact that it takes a long time to step through Doesn't really make that big of a difference The other thing that we saw that wasn't really implemented in any torrent client We noticed that that we tried was URL seeds So this was pitched as an alternative to the classic bit torrent protocol seed You can have HTTP seeds. You can have FTP seeds Which you know if you have nothing in the swarm if you have no active seeds This is a way that you can get the data initially, right? But we didn't find anything that supports this So we weren't able to do you know FTP or any other funky URI handler We were hoping for file because again, we could get the NTLM win, but that's not something we got However, I can do something like initiate a whole bunch of HTTP requests from wherever you're opening the file So if I want to try to exploit let's say Every C-Surf flaw in home routers for the past five ten years Using a torrent file. I can do that. So that's interesting So the next one that we got a win on is the V card format This is using for exchanging virtual business cards between users of for example Outlook which is part of the Microsoft Office suite So the V card format is used for exchanging of business cards like I mentioned It has a lot of the obvious fields such as what is the person's name? What is the person's email address? What is their phone number all that stuff that you would expect? It also has some things that you might not expect at least not at first One of the attributes that it supports that we found very useful is the free busy URL Let me briefly describe what this is used for so let's say that I've exchanged my virtual business card with Dan and Dan would like to set up a meeting with me when Dan opens up his calendar client and says I want to schedule a meeting with Damon Smith His calendaring agent will automatically go to my free busy URL and say Okay, is Damon Smith busy at three o'clock is Damon Smith busy at four o'clock, etc. That is the proper functionality of the free busy URL That's obviously that's that's able to track people over HTTP What is perhaps not so obvious and I still don't understand why it's implemented this way You can include a UNC path as a free busy URL So I'm telling Dan's calendaring agent if you want to find out when I'm free You need to connect to this remote SMB share and download it from there Which is completely insane and I can't imagine why this is allowed in the parser But it's definitely allowed and it definitely allows you to steal in TLM credentials Yeah, I mean explain it away like oh well, it's okay You have local file paths that specify when somebody else is free or busy. Yeah, it doesn't make any sense like it's kind of a but um It does take a little bit of social social engineering or pretexting to get this to work Not only do you have to get the victim to Accept the virtual card and add it to their address book You then have to convince them to attempt to schedule a meeting with you So it's perhaps not the easiest to exploit, but if you've got some skills of social engineering Which I'm sure some in the crowd do you could probably pull it off so the next one we looked at we included this for posterity and for hilarity Because ICS is kind of a fun read if you take a look at the RFC Well, I guess if you like reading RFCs So I guess a quick anecdote if you're ever writing a file parser There are actually three critical steps that you have to follow step one is to read the entire RFC for whatever file format You're designing for step two is to take the RFC and light it on fire and step three is to do whatever the hell you want And completely ignore the RFC Truth real talk so So the way in which this this manifests for ICS There's a particular line of ICS files are actually very easy to read if you just pop one open You start immediately understanding sort of how the file is structured It's one of those great file formats that you can just kind of understand intuitively by looking at it when which is great One of the one of the things is V alarm which defines the alarm That is associated with a given meeting request or calendar event So one interesting thing about this is that this is actually defined by the meeting request sender not the receiver So and you can have multiple alarms So one thing that you can do which is really hilarious is to set up a meeting with somebody in Two days and set off an alarm to pop up a pop-up box and you know play a sound every minute until then So Defending on your your calendar user agent. It might automatically accept the meeting invite as well, which is hilarious so Denial of sleep attack. Yeah So so I start reading so I'm reading this RFC. It's late. I've probably had something to drink I've almost certainly had something to drink and I'm looking at this and I'm looking through the different types of alarms. There's four. There's two, you know Perfectly reasonable ones. There's one that's like display pop up a pop-up box Alarm like make some sound whatever. I don't care audio which is like Oh, go to this URL download this sound and play that and I'm like, oh that that could be nice And then the fourth one.  Just run this command with these parameters What So here is the heartbreaking thing or The really relieving thing depending on who you are It doesn't work in any calendar user agent that we looked at Doesn't work in any of them. I'm just imagining somebody implementing it and like looking at the RFC that no, no That's that's the light the RFC on fire moment right there So not even the successor because this is the iCalendar format Not even the successor to iCalendar supports this It I mean it does but you have to define the meeting yourself I got a little bit excited when I created something that used a procedure alarm Because it pops up this box It's like do you want to accept this and the options instead of being like yes or no are like no and No, you know, I don't even import this at all So I'm like, yes, they'll click through No or no harder. Yeah. No. Yeah. No or more no So Unfortunately, this is not a usable technique, but it's just it's a funny thing And I can't believe that this was an idea that somebody had and like wrote it down and Shared it because I just it I just I don't even understand but There you have it so All right start talking about Potential use or misuse So we've discussed the formats that make this possible now Let's discuss a little bit about why anyone would care Why would anyone want to abuse this functionality the first and perhaps the most obvious implication that we could think of is Digital rights management one of our favorite words at Chaos Camp. Am I right? We all love DRM imagine a dystopian future DRM that Every time a particular file is open calls home to a remote server to track that that file has been opened This goes beyond traditional DRM whose sole purpose is to dissuade you from opening a file when you don't have the right to open it This goes beyond that and goes into identifying the people that are attempting to open these files This is a lot more dangerous than the DRM that we have today And this is something that can be done today in today's file parsers. This is something we haven't seen it done But it's something that I think we should all be a little bit afraid of to be fair We haven't looked very hard to see if this is being done fear uncertainty and doubt on all of you So There's also the sort of a data loss prevention angle to this and there's there's two There's sort of two sides to this one is like I don't want somebody to steal my sensitive documents So I'm going to put like salaries 2016 dot PDF up on this file share of secret documents And nobody should ever open this but if it does get open then you know alert me at this URL The other side is let's say that you're a fascist government and you want to keep people from whistleblowing and You could use these techniques in theory to prevent people from being able to do that at least easily without being identified You can imagine that you know somebody exfiltrates a document that is of value to be put in the public knowledge and The document calls home from every place it's opened from your computer your work computer your home computer a Lawyer's office a friend's home And then everybody disappears Right, that's this is I think the thing that scares me most about all of this is is is this potential misuse So another that is fairly obvious is de anonymization So if you've ever used the Tor browser bundle raise your hand just kidding. Don't do that Don't tell anyone that you bad idea don't do it Yeah, so if you've ever used the Tor browser bundle and you've ever downloaded a file via the browser It pops up this great little warning dialogue that says note If you open this file it could easily de anonymize you and tell bad people what your real IP address is don't do it This research is why that warning dialogue exists. They know that this stuff is possible and they are trying to warn you The the to be clear this this warning existed before our research But this this technique this type of this sort of I this sort of idea is why that warning exists one potential application of this For instance a government agency you may not have administrative control over that jihadist wiki and you may not be able to track Its users, but let's say you upload a PDF file called how to make a bomb in three easy steps And it has a remote image URL embedded in it so that everyone that opens that PDF file You now know who they are and that they want to make a bomb in three easy steps so we we discussed this pretty or at least we showed this and Focused on this fairly extensively just because you know if you can take over somebody's machine If you can get somebody's credentials, then there's a lot more that you can do But you know this is I think a pretty important part of this is that you you can actually affect the security of The machine you can get credentials and and pass them along or or crack them Just in case somebody there's somebody in the audience who's not quite familiar with until I'm relaying attacks I'm gonna go over it very briefly So normal ntm until I'm authentication at least version 2 You as a client say to a server. Hey, I'd like to authenticate and get access to whatever it is You've got there the server says okay. Here's this number I need you to mix this in cryptographically with your password hash and send that back the client does so Returns that value to the server which then decides based on does this match up with the information? They have Should this person be allowed access now the problem here is that while the client is authenticated the server is not so there's nothing that There's nothing in this negotiation that ties this data to a particular server Except the nonce That that random number so if as an attacker you can get a client to attempt to authenticate to you You can just pass that information along Until you get to the point where you gain access and you tell the client no sorry that didn't work Would you like to try again and then you pass it to somewhere else? So We in our demo we had a password that was easily cracked. It was like you know two seconds if that This is an alternative to that where you pass the credentials along without having to crack them So anything that they the person attempting to authenticate to you knowingly or not is trying to gain access Whatever they can gain access to with their credentials You can now gain access to because of the way that NTLM works It's worth noting that as of the most recent are actually it's been quite a while back that they've patched this It is no longer possible to really authentication back to the same machine that that initiated it Hilariously before I think Windows 2000 or maybe XP you could have someone attempt to authenticate with you Pass the exact same authentication information back to their machine and authenticate to them So that's been fixed For a long time now So we discussed briefly The the fact that you're sending with these documents when you're initiating outbound requests It's coming from a privilege network position. You're behind that you're behind whatever firewall might be in place And you can exploit all sorts of interesting things that You know, maybe assume that if you're on the local network, you're totally fine And So this this slide probably could be renamed So C surf assumes some sort of authentication authenticated session that you're writing on in some cases that that that is absolutely the case As you saw in previous demonstrations Several of these techniques these formats the parsers will actually just pop pop open the default browser And and work from there If you can do that then you can ride on authenticated sessions That might exist with the default browser But even without that you're still coming from a probably a privileged network position when somebody's opening a document So we've told you what the problem is we've told you how it can be abused Let's talk a little bit about what we thought about how to fix it Possible mitigations because there really isn't a silver bullet there isn't a perfect solution to this But we're gonna go over what we thought of and why it's not necessarily a great solution The first and perhaps most obvious is antivirus all of the techniques that we're using have Fairly standard signatures. So if I bug an rtf file, it is possible for a program to analyze that rtf file and tell that it's been bugged Unfortunately, there are so many formats that this is possible for we really only scratch the surface There is no way that av can reliably cover every format that has the ability to be bugged Additionally, some of the techniques that we've used have legitimate use cases There may be a legitimate reason to embed a remote image in a pdf Or for instance a playlist file. There are legitimate reasons for a playlist file to have remote file URLs in it Otherwise, it would be kind of a boring playlist. I guess so These both of these issues are things that prevent av from being an effective mitigation Um, let's talk about format changes. So some of these formats They're not necessarily legitimate use cases for opening these types of URLs. So we'll just change the format to prevent that Unfortunately time and time again in our industry. It's been proven that that's just not possible You have to maintain a certain level of backwards compatibility There are too many people using these formats too many people using these parsers and too many files that have been created with older versions For us to be able to change the format. There's just too much inertia behind how these things are already designed Finally, in my opinion, the best mitigation that we've come up with yet application level firewalls Um, these are things like on windows zone alarm or on osx little snitch or on linux Is it lotus flower leopard flower leopard flower? So what these do is every time an application attempts to initiate a connection This firewall will notify you and say hey your pdf reader is trying to connect to attacker.com. Do you want to allow this? This is a pretty good mitigation for the vast majority of file formats. For instance It will never be the case that I want wordpad to connect to a remote server So I can say deny deny deny if my wordpad is trying to connect to a remote server However, for playlist formats like m3u that's kind of the whole point is that they connect to remote servers So you can't reliably say application firewall fixes everything and is a pancia Yeah, the the reason that we're talking about like all these different mitigations and how they Do or don't work to various degrees is Because honestly, we don't have a good solution for this. We don't we don't have a fix We're just trying to like put more fuel on the fire um So another thing we talked to we we thought about is warnings and and this goes, you know That obviously there's some use to warnings and and some people will click through but you'll at least Put be putting more information in the hands of the user um Obviously people click through warnings a lot of the time. So this is not necessarily helpful at all Um, but it might at least get you to stop and say. Oh, well, hold on that. Maybe this is not something I want to do So you're at least putting more power to the user um You could also do something to just shut off networking capabilities for particular programs in general um, you know, for instance, uh Damon made the uh example that with wordpad you I I personally and Damon apparently personally Don't want wordpad to ever communicate with the internet except maybe like if it has to communicate to Software update dot microsoft.com, but that's done through the os. So just never just never at all um So For something like that it's easy, but it's it has the same problems as application level of firewalls The other thing is attempting to hook network calls in some programs is a lot cleaner than in others Um, certain things proxy chains will just completely break because uh, it was a chrome Chrome disables the ld preload directive. So you can't use proxy chains against chrome at least the last time I tried it Um, there's also egress filtering. This is a good. Uh, this is a good partial solution and this will at least prevent things like, um Outbound smb traffic leaving your organization or your home, you know, this is something that's a good idea in general It's doing egress filtering But again, you still need to let some things through So you might be letting you know web traffic through and that's uh the way that a lot of the the privacy violating tracking stuff Uh, we were able to do that So you think this stuff is cool and you want to play with it yourself and get your hands dirty We have exactly what you want We have created a tool that accepts as input all of the various formats that we support and will produce as output A bug version of that same file. It's still a work in progress. It's like version zero zero zero negative one alpha Um, additionally, it's not yet on github because we have been really drunk this entire week and we haven't had good internet connectivity So it will be on github within the next one to two weeks if you want to download this thing and start bugging your own files So, um at this point, um, we're going to open it up for questions Okay Time for some questions anybody Over there on the mic. I see someone Hi, great talk. Um, did you guys find any issues with default file handlers? So when When windows gives a preview or when osx gives a preview of the files Did you find that would also initiate connections? to wherever so um The question uh, that the the question is did default file handling rules, uh prove to be any Effective measure against this or did they get in our way of doing this sort of thing? Or was that was that is that am I understanding you right either or really? um When you open when you click on a file, but don't open the file in windows explorer, for example You can have it preview the file without actually Opening a full version of word dot hc or whatever So so are you asking if the the preview is also vulnerable to this sort of thing? Yeah Uh, that's not something we've tested. Uh, I can imagine for certain vectors. I could certainly postulate like SVG files It would be very likely that that would be vulnerable because you can't properly display the image without downloading the style sheets So I would say it probably varies by format and I would say we can't say authoritatively whether or not that's the case Yeah, we can we can say with some some certainty that Some of them are likely to work even with preview. So anything that you have to visually render Probably it will work Anything like so like a video file where five seconds in it, you know launches a url That's almost certainly not going to work I I can say pretty pretty certainly that that's not going to work But as previously stated we haven't tested it so we can't say for try it out on your own Once we get the tool online. I will thanks Cheers Any other questions or did we just cover it so well that nobody has any uncertainty left in their hearts? I guess so Yes, let's bring it back one slide to the github url go ahead and copy it down We super duper dark promise that it will be there in one to two weeks We have a somewhat working version on our laptops But we have not yet found the person within ncc group that knows how to put things in this url But we will find that person in one to two weeks and then it will be there All right, thank you damon daniel. Thank you. Thank you all for listening


Hey guys, welcome back to my YouTube channel. This is Daniel Rosal here and guess what today's video is about That's right It's gonna be about the end disc again because I've just finished burning my Offsite archive of the M disc. I did look at this beauty. This is a Binder full of M discs starting from my first video my first First folder full of stock video footage b-roll wedding photos are in here somewhere It's about 18 discs and believe it or not this actually constitutes pretty much everything you're seeing on this YouTube channel plus some more Not all my YouTube videos are public. So there's some ones where I'm just like testing at microphones I put everything on M disc and that was firstly a massive labor of love Then I did another labor of love because I realized three two one backup. You got to have an off-site So I've been duplicating this sky one by one and I just finished earlier today So I've been having a lot of fun with my verbatim M discs But what I wanted to do in this video is I put together a presentation Or a slight whatever you want to call it. I want to talk about why I'm genuinely so excited about M disc I probably don't need to say that my Enthusiasm comes from a genuine place of excitement and I know it seems a bit weird for Non-dataire protection backup folks to be so excited, but I've genuinely been looking for something Like the M disc for the longest time. I assumed it didn't exist. I never heard of the M disc until about two weeks ago and I'm so happy to have found it because it's a great relief for me to have that feeling of having my stuff backed up on Some kind of media that I can control I can see it's in my house it's going to be in my relatives house and It's there is there's no maintenance. It's supposedly and again, I'm going to get into the claims about the M disc It's supposed to just sit there for 100 to 1,000 years No bit rush to worry about and it's the only kind of media that actually promises that so I think it's fascinating I actually think it's amazing tech now I get there's a lot of skeptics Especially on reddit or people like well if it says it's a hundred to 1,000 years How can you know that because it's only been on the market since 2009? So I definitely hear that argument. I did speak to the inventor of the M disc Barry Lund class week I just trust it This is technology. I trust, you know, I trust that it's a unique tech. It's patented It's a unique engraving process and realistically when you're doing something like three to one backup, you know You have two copies as well as your original data It's probably data. I'm not going to need again. It's archival of these videos It probably never will be anywhere, but YouTube, but I still want to protect it and have it my own copy for Here on after the next generation whatever you want to say. So let me get into it. Let me jump into it here So this is called why M discs are amazing tech I was gonna say in my opinion But I said I'd be a bit a bit more brash because I think this is just really a cool invention Irrespective of whether the use case is really small I still think it's easy to be hypercritical and let's just say this is a cool tech So I'm gonna put myself over here a little bit as it says on this slide show Feel free to use this slide or this video however you want all my YouTube videos Unless they unless it doesn't have it in the description our licensed under CC by NC and the 4.0 Creative comments license simple language. You can share it distribute it. Just make sure you say it was by me I do want credit for my M disc fervor and that's a quick URL if you ever want to jump to this YouTube channel Daniel Rosal.com slash YouTube will redirect over to this YouTube. So let's get into it. So What's an M disc you may ask it's a good question So what these things are basically it's a modified version of the DVD and blu-ray that's specially engineered for archival Offline storage. So when we talk about data storage and archiving there is typically two ways it can be done and One of those is storing it on a live system on a server. Let's say The cloud falls into that category the cloud as the famous saying goes is just somebody else's computer So you're just storing it on a server. Let's say you have it in glacier. It's up in Amazon's cloud Now there's a theory that that AWS glacier is actually tape No one that seems to actually know that for sure But irrespective it's in someone's cloud storage connected to computers and the internet cold storage by contrast is Also known as sitting on a shelf, right? So it's literally just taking your finished archived and discs and putting them ideally somewhere You know humidity humidity temperature control, but basically not in a computer, right? So what makes M discs unique? So it's actually in and it's a pity. I should have included probably the diagram But it's in my other M disc videos And if you do want to watch my interview as Barry Lund if you're really interested in M discs He explains all this in detail. So basically the unique thing about M discs Is that usually when you're writing to optical storage CD DVDs and blu-ray to the best of my knowledge And I wouldn't wouldn't yet consider myself a optical expert. I'm just an M disc fanatic The laser ablates a way at a die and the problem is that over time that die will degrade the die will fade So if you think about the bits and bytes of data being stored as millions of tiny ablations onto that die If the die itself fades we're gonna lose that optical contrast that is storing the data so when their laser passes over the disc That's how it reads it goes up to a it's actually pretty fascinating a reflector and that gets fed into the computer So that's how it usually works and M disc took a different approach. This guy Barry Lund went on a hike I love this story. It's this is to me partially why I love M disc is such a great origin story He went on a hike. He noticed what are called petroglyphs petroglyphs are little pictures carved into stone And he noticed that these ancient carvings were just this deep in stone not very far But that had made them much more weatherproof than painting on stone So this guy is a storage storage expert computer scientist and he was like, aha Why don't we try to make a form of optical storage using the same principle? So that's what the end disk is in between the exterior and the bottom somewhere in the middle Again, you need an electron microscope to be able to see all this stuff But somewhere in the middle between the top and the underside of the disc There is a trade secreted inorganic layer and when you're writing an M disc And this is why writing an M disc takes such a bloody long time.  So it's verbatim who are continuing the technology But in any event so it is a trade secret and it's patent protected and look people will say oh But you know the fact that it can be read on regular blu-rays. It can't be that secret. I don't buy that You know, I think someone should probably try to reverse engineer the M disc if they really want to prove That it's not that unique. I suspect it's a really good technology And yeah, we're not probably not going to know for another century if we can still read them whether whether all the hype was justified But I'm willing to live with that at uncertainty Yeah, so I said here technically they're correct. So you're technically engraving rather than burning an M disc So here's the thing about M disc So they can be read by regular optical drives Which if you think about it makes sense, right that the burners or the engravers need to be M disc certified But you don't need M disc certified readers, right? Because the data once the data gets put on the disc It's just an irregular optical disc can be read. But to get through that process of engraving I think you need like a stronger laser So you need to if you're want to get into archiving to M disc You need to look for M disc blu-ray burners. I assuming you're using blu-ray I don't know why anyone would be using DVD in this day and age because you can just fit much more data on a blu-ray I was gonna say next slide and I realized I am the slide guy been watching too many YouTube webinars so why Let's just roll back a second, right? Why is this something that is Interesting in the first place. So there's a misconception. This is something you see people do I've even seen so many YouTube videos where people are showing their backup archive and they're like Yeah, we're a video production company and have a look at how many hard drives we filled up and they're just sitting in a box Now just because a lot of people do something doesn't mean it's actually the right way of going about something I'm trying to think of examples, but too many examples to list So if you leave hard drives, right like the hard drive here, they're not intended to Be stored cold hard drives are supposed to live in Computers right and the computer almost all operating systems nowadays has you know error-checking software And if the hard drive is about to fail, they'll say hey your hard drive is bad sectors and you know, oh crap It's about to you know, it's about to fail I need to take a backup and get a new hard drive and move the data over right So there is that mechanism when you have hard drives sitting cold on a shelf the way hard drives write data Is freaking fascinating right? It's actually using magnetization and when your hard drive said let's just pretend this hard drive here It's on the screen next to me is sitting on someone's shelf It's actually going to be Demagnetizing over time right the bits are going to flip. So if you think about magnetism North Pole South Pole Those bits are going to flip And when the bits flip it can range from the idea the outcome of that can be Skipped frames in a video or frames was a bit of distortion or in the worst case data That's totally unreasonable not only that but hard drives can Catastrophically fail because of the fact that they have a physical mechanism. So that's why hard drives however many people say Oh, yeah, we're just storing our stuff in hard drive That's why it's not a good idea to actually store your stuff on cold storage in a hard drive SSD also suffers from this problem Just not the mechanical failure aspect and tape does as well. Don't trust me trust. Mr. Backup Curtis Preston and Or trust other resources. You can look online if you don't believe me tape LTO linear tape optical does and can't suffer from bit rot So even though tape is yes what people think of for archival storage. It's not actually guaranteed to Do its job right so this this end of stuff is actually very unique It's a technology where the manufacturers say claim. Yes, I understand it to claim this will not be susceptible to degradation of any of any kind and we're going to write it in stone and that's going to last for 100 to 1000 years I have not seen any other optical storage if they're out there leave me a comment that actually claims this so as a Small timer small-time data person, right? I'm not backing up petabytes or even terabytes I'm backing up these YouTube videos this YouTube video will end up on an M disc. That's what I'm backing up, right? At my level that's unique. I'm like, oh, that's very exciting, right? So I can just back it up Two copies three two one backup one of my home one in an off-site and say hey my stuff is good Don't need to connect it to power. Don't need to check it periodically. It's good. So that's unique so Yeah, so basically that's the problem with so that that's why it is unique Yeah, now the cloud is a different different beast or an NAS network attack storage device Which is kind of the same thing you have raid random Array of independent discs and that's connected to power and I own a sonology I do have one in my house and it's got all these programs checking it for data art, right? So yeah, that's another approach a viable approach so you could do NAS plus cloud but That's a it's a powered product, right? It needs to be connected to power and if you want to expand it you have to look into Expanding it with expansion bays So it's a little bit more in a sense It's actually a good deal more complicated than the simple but effective means a backing up data by just repetitively burning discs And yeah backing up disc isn't fun. No one enjoys it including me, but Yeah, it's Quite unique so then the question becomes well, what about LTO or tape isn't that isn't tape supposed to be What isn't there already something doing archival, right? So first point against that is LTO is susceptible to bit rather data rot According to Curtis who I have a relationship with as a friend. I was on his podcast He hosts the restored all podcast. He's a backroom storage expert Curtis just says yeah, it does but it's much much less than HDD SDD Now another problem really for home consumers is that tapes really expensive not the actual tape The actual medium is much cheaper on a per gigabyte or per terabyte basis But the drives are a lot more expensive. You can get it M disc burner for like a hundred bucks Okay, and again, so this hasn't been the point I make here is that look and just say a hundred to one thousand years They've only been around since 2009 so I'm recording this video in 2022. So that's 13 years Correct me if I'm wrong So we can't even know for sure they last a hundred years because they just haven't been invented with that that long yet So what we're left with is these accelerated aging tests done by the Department of Defense and others And that's the best surrogate we have today, right? We can't teleport We can't teleport 90 years into the future in a time machine because time travel is impossible to say Oh, yeah, the M disc. Here we go We burned all these M discs. We read them back in a hundred years and the marketing was accurate No one can do that. So there's no point arguing about this We just have to either trust them or not trust them and that's a personal decision. I personally I'm on team M disc and this debate So why is tape much bigger than M disc? Well, if you think about it as optical storage has never really been suitable for the enterprise There are a few reasons for that the capacity in optical is just too small, right? These M discs get up to 100 gigs and writing to them as I mentioned is very slow Although that's actually I think a problem with LTO as well. Just to be transparent. I don't own an LTO drive I'm not an LTO guy, but I've been reading enough threads on data hoarder subreddit that I think I understand the pros and cons between these two technologies pretty well and as Barry said the M disc guy M disc optical media in general is hamstrung by Small capacity problem, right? Including the M disc There are apparently in the works super super cutting-edge developments of storing data on quartz and crystal If that tech ever materializes optic may have it optical may have a renaissance But for now the capacity just is not there now There's one more problem actually or there's one more advantage of LTO LTO is a really established tech in enterprises for archival and tech libraries are big things And you can see the graphgads here of these they have these crazy robots that'll like jump grab out a Tape from a tape library physically insane tech that exists in enterprises You can even have LTO drives that can allow you to use it as a file system I Amdus are also worm media. They are right once read many times. You eat. It's a one-go Engraving process you put your data on once so for a business doing archival and that doesn't is you know Has tons of petabytes of data to store and it's going to be powered on anyway LTO LTO makes way more sense, but that's not this M disc is intended to serve a different purpose So I don't think it's an either or situation. They're just different use cases So what is M? So basically for the kind of stuff I'm doing this is a this is brilliant, right? It's for it's for folks like me really like you know, I have I have a video or I have photos or I have a few What else do you want to put an archival? I don't know Books you can put in books. You can put in animations. You can put in You know, whatever type of data you create that you really care about you can put it on an M disc It's going to be an archive. So And the worm media as I said, so this you're not putting on to end this stuff You're going to be changing like a book you're working on right that would absolutely make zero sense Because every time you change that you need to burn a new disc. So that would be pointless So what it is again, I think for a videography work and that's I suspect why BNH actually sell the M disc.  You just want to have it For retrieval maybe for your clients, right? M disc is brilliant. It's not that expensive to $2.50 a disc If you're making a living from video, especially, right? You know and again You have to think about the cost of your data storage if data is important to you Then 250 per disc for something that's supposed to last and last and you don't have to worry about it for me That is well worth paying so and this is our price here than a blue rays and people cream people curb about this on reddit, but There is you have to in my opinion look at the flip side of the process It's free thereafter that you have to buy the discs, but then it doesn't cost anything really to store a disc It's just in my binder put that in your attic or ever use space and For the offsite likewise put it in your attic review space You don't need to pay AWS or back plays or anyone for storing the end discs And again, I don't know of any other until I came across this project I didn't know of anyone that claims to be impervious to bit rather data. That's a very very exciting thing Moving on I mean we're getting near the end. I'm using so here's what I'm doing I'm personally using it to archive these YouTube videos because I actually do really care about these videos I know there I know my YouTube channel is in its early phase and I still regard these as my rookie video attempts Even though I've been at this for a few years, but yeah, I want to preserve this data I want it to be accessible. Maybe for my kids. Maybe for my grandkids I don't want it to just be on YouTube a third-party SAS provider and hope There isn't a random strike against the YouTube channel or I get hacked or some of my videos get deleted So therefore I'm preserving my original data three two one in two places I'm actually generating a decent amount of data in a small time for a lot of people But you'd be surprised the amount of data if let's say I put up one video per day Which at the moment I have been I've been actually doing quite a lot of this video stuff This video might come to 500 megs to do that every day and add the numbers up and you're suddenly the data is accumulating Right, so here's what I personally do when I finish these videos I put them on my NAS and then I wait for 25 gigs or 23 gigs because you don't get the full 25 Then I take on my end-bisk burner and I burn two copies One goes into my onsite library in the second I get Now I'm bringing it in my suitcase to my in-laws and future I might have a backup buddy where like I post my discs. He posts his discs or she posts her discs There's different ways to do physical backup and you can actually a bit of fun with it You can have a backup buddy that you meet in a bar once a month and he brings his latest Discs you bring your latest discs and now you've each got a copy of your discs in a different geographic location That's an off-site. It's just not the cloud. So disbelieve it or not is still done in enterprise tech terms This is an analogous to iron mountain So you can actually do three two one backups with just with the end disk. That's actually what I'm doing at the moment I have my original data these YouTube videos. I have my originals sitting in my home office eventually these guys will be in a pelican box for now they're in this binder and In about three weeks from now, I'll also have them sitting in somewhere in the US as my off-site So as possible, which to me is pretty damn cool What are some other advantages of the end-disk optical cold archival storage? Again, I'm going to argue that it's just not that expensive, right? So if you're doing three two and backup that means each 25 gigs is twice Copied so if you have if it's 250 a disc, that's five bucks for your two copies for 25 gigs And let's say like me you go through the month So if you're spending five dollars a month, but for lifetime Protection no cost thereafter to me. That's an absolutely worthwhile investment in data protection, especially if you're Business really even if even if you're not doing it for business just for keeping memory safe And that's at the high scale. Maybe you only burn one end disk a year So I think it's it's uh, I don't I think it's yeah the more expensive than optical because It's a special tech and it costs money to make this engraving layer. I presume It's green as a new be environmentalists. I'm currently working I've made a slight career transition recently. I've historically worked in tech and now I'm actually working in For a sustainable sustainability an individual Involved in financial sustainability So I'm becoming more conscious of this stuff and actually m discs my opinion are a green cause, right? Think about how much there's a figure about how much of the world's power consumption Goes to data centers data centers have to have power fed into them. They need a lot of cooling They need a lot of electricity And some of that data does not need to be accessed. It's just there is a failsafe for archival like my video backups, right? So all that power all that data if it were stored on m disc Or even lto but let's say m disc never have to check it again. There's potentially actually a huge Power saving here. So I would argue that the m disc is a green form of storage Because it's just one one time burn and then no electricity cost required to have it sitting on your shelf um So, yeah, green people buy m discs. How do you write to your m discs? So, um, I've had no trouble using k3b on a bunch To there's also serve as services for programs for windows and mac You do need to make sure you have an m disc capable burner.  It's a it's a slow process and I presume that's got to do with the engraving I was burning them at one time. So If I look a bit demented right now or have a crazy think about what I've been doing guys I literally burned these there's 18 discs one by one by one by one So that was 18 hours. By the way, I was doing work as this was going on But I spent yesterday as I was working Feeding discs in and out of my m disc burner and then I did the whole thing again for my off site So it's a lot of work But that was because I was doing five years of m disking previously If you are doing it once per month, it's going to be much easier, right? That's the way to do it at the end of each month Set yourself a google calendar appointment for the 31st Burn your month's data onto m disc two times one onsite post one off site. Boom. You're done. So Yeah, if you're doing five years retrospectively, it's a lot of work, but Data protection is worth it. I would argue. Um So, yeah, uh, don't do it the way I did it do it ongoing Where can you get these things? So, uh, not actually that hard now. I live in fear I live in fear right now That the m disc is going to go out of business. I really hope it isn't so That's my ulterior motive in these videos. I'm not sure. I don't have shares in m disc I'm just hoping they keep making these things because uh, I don't see a replacement for it So this is how much they cost 65 bucks on amazon for a 25 spindle And burners are about 100 bucks. So Not bad. Again compared to lto. This is a ton cheaper, right lto drives cost thousands of dollars So, yeah, you can get started with if you watch this video and say I love it I'm in I want to start burning m disc. You can get going for about 100 bucks Uh burner plus m disc you'll get these combo things on amazon By the way, they also exist these duplicators. Um, so what these are useful for is it's these work offline So you don't need a computer so you can burn your one m disc And I haven't found double m disc drives that like they'll burn two at the same time So you could try to use two external drives Or You can use these duplicator folks duplicator yokes And that that means the what you do here is you burn your first m disc And then you just feed it into this machine and it will copy It'll copy these are all these can work without a computer. Now. Look at the price tag 250 bucks It's actually cheaper to buy a second and just burner and burn two copies at the same time But this is more convenient arguably especially if you're doing like what I did for the last Day or two and you're literally one by one by one feeding reading copying feeding reading copying That's what he's doing feeding my first copies Dialoting the ones at the computer about a 30 minute per disc then burning them about an hour per disc Very very slow. So this something like this would really speed up the process I can't find one with 220 volts power if I did I would probably buy one. I have to be honest Why not if you're taking this seriously and these these things unfortunately, I reckon are going to go off the market So if you can get one, I personally would snap one up before they stop making them because Eventually we're realistically all on the path towards obsolescence Here's some photos for you guys of m disc madness and progress.  I was getting 1.4 times speed And it you can see remaining time here 51 minutes. Nothing about this was fast But yeah, I just you know get it running And then just go and do other things While your m discs are burning away Here is what my couch looked like yesterday while I was in the process of copying m discs from my on-site to my off-site folders Now here is a point of debate I posted a video on permanent marker on labeling your m discs and then a commenter on this youtube channel said don't label them because You could throw off the balance of the m discs and then because I thought I was being smart by not using Permanent marker although these ones have these are like my first I'm just kind of trying everything at the moment Then some people say permanent marker can seep down into the data and destroy it So then people say well use permanent markers That are cd rated won't be a problem Everyone agrees that writing here where my mouse is where there's no data stores Is safe So what I would do is get a cd permanent marker and just write you can see I'm using a 0 0 3 So I would write here on this area a 0 0 3 And not if you're really worried and not too labeling, but I haven't had problems reading back ones I've labeled Just with the label printer I haven't had problems writing to them with the label on them. So I'm not sure if it's really an issue These are we're probably getting into my new c a here and then people also say, you know, don't store them in binders because you're going to get compression effect I've worried a lot about this stuff and I'm at the point where I feel like these things I'm not personally worried about some people are you can make up your own mind about that So yeah, as I said here, this is the way I'm doing it I just got a folder from amazon and I'm slotting in the discs And I'm labeling them and you'll see why in a second But if you want to do it as well as possible dual cases, they are probably the safest way because Each disc is physically isolated and this is just my labeling system. You see the discs have a name like a 0 0 1 So I'm just keeping a spreadsheet where I say, uh, you know Uh at the top of my slideshow is cropped a bit but whatever. Um, I'm keeping a So I just write down and this is just a placeholder I'm going to be a bit more descriptive saying my youtube videos from june my youtube videos and that's a 0 0 7 And then for my offsite, I'm labeling them a 0 0 7 copy, right? I think that should be enough in terms of process Out at the end of the presentation So I hope that was useful. I'm going to be a bit brave and call this everything you need to know about m discs Given that that's probably slightly false advertising. There probably is more You need to know I'm going to say everything everything you might want to know about the m disc because Uh, there is undoubtedly more knowledge about these although it's pretty obscure tech and um There's not a ton on even a lot of threads on reddit that are interested guessing a lot of guesswork going on when will these be supported as a really blah blah blah But this is about as much as I'm aware that there is kind of like known in the public domain So if you're thinking about using these m discs for archival Storage I do personally so far highly recommend them. It's been actually in a weird way kind of therapeutic To go back to those optical days where you know, the burner makes that lovely Kind of startup sound like an airplane And all in all given that I was retrospectively backing up for years A video and that I've done it two times for a 3d one backup Yeah, it took me about a day while I was working But it wasn't like that bad and again if you do this once per month on an ongoing basis It's going to be much easier. So there you go guys. That's that's it. Wow I'm just going to cut out on exactly under 30 minutes if I stop speaking in 10 seconds So thank you guys for watching this video If you want to get more videos from me about tech m discs linux and all the other random topics I cover on this youtube channel, please feel free to hit the subscribe button and thank you for watching


Avatars are the future. These include digital avatars that will represent us in virtual worlds where we're increasingly likely to be working, shopping, socializing, and exploring. Avatars will also exist in the physical world, where robots will transport the skills and consciousness of a human to distant and remote locations. They'll help us visit friends and family, respond to emergencies, and go where humans cannot. But what does any of this have to do with life extension? We'll explore the crossover in this episode of Lifespan News. According to the CDC, in the United States alone, there were well over 14 million years of potential life lost due to fatal accidental injuries between 2016 and 2020. This includes things such as traffic accidents, falls, workplace mishaps, drowning, and more. And that's not including the over 3 million years of potential life lost due to homicide. Add in the amount of years of lost life from diseases that people can pick up in public, or the years of life lost that stem from injuries and ailments that themselves weren't fatal, and it's clear. The world is a dangerous place. Every time we ride in a vehicle, we are increasing our risk of injury and death, but most of us choose to do this. To justify this, we must believe that the benefits of using the vehicle, such as getting to where we want to go more quickly and having access to more areas, are worth the risks. Otherwise, we wouldn't do it. And maybe, if people only expect to live around 80 years, taking those risks makes sense. After all, you only have so many years to cram a lot of experiences and accomplishments into.  But what if we expected to live 800 years, rather than 80? Would your calculations change? Maybe in that case, riding in a car, or risking exposure to pathogens, or engaging in risky sports, doesn't make as much sense. After all, you now have more to lose, and your time for potential accomplishments and experiences is increased. Now, forget 800 years. What if there was no limit? What if you could remain alive as long as you could avoid death from an accident? Would you ever want to get in a car again? If we are able to overcome aging and disease, which is what we're working towards, these questions stop becoming hypothetical and start becoming very real. And this is where avatars come in. As virtual worlds become more immersive and interactive, and as robots progress and become more capable, it becomes easy to imagine a scenario in which humans with unlimited lifespans choose to prioritize the safety of their physical bodies and brains over everything else, remaining in a safe bunker, and interacting with broader society only through digital or robotic avatars. For many people, this may not sound like a life worth living. They may say that they would never want to give up on experiencing the smells, the breeze, the tactile sensations of a forest, or a beach, or the great cities of the world. And they may not want to miss the connection of experiencing a concert, or sporting event, or art museum, or simply being together with friends. And that is completely understandable, but it also may fail to account for just how immersive the experiences that avatars provide could soon be. These sights, sounds, smells, and sensations may be convincingly duplicated, or even if they can't, your brain could be stimulated to the point that it can't tell the difference. How close to perfect would these systems have to be for you, personally, to decide that the risk of losing an unlimited lifespan is not one worth taking? There are a number of fictional films and stories that show the level of immersion we may one day achieve. An obvious one is James Cameron's 2009 film Avatar, in which a human remotely operates a body to interact with Pandora. Another example of the level of immersion that could be possible is the virtual Oasis in Ready Player One. Other virtual worlds, such as those seen in the Amazon series Upload, and the Black Mirror episode San Unipero, provide a place for consciousness to live and interact, regardless of whether they are humans with physical bodies, uploaded consciousness, or AIs. Is this what you look like for real? You're not some old dude or something? No, this is me.  So I understand you were in a bad place yesterday. It's only weird if you make it weird. As you may be able to tell, Avatar technology is not quite there yet, but it is improving rapidly. There are already models, influencers, and musicians with real fans throwing real concerts that don't actually exist. You may have even experienced a movie or theme park attraction, in which you couldn't tell if the person you were looking at is a human, or is computer generated, or is an animatronic device. Other times, this technology enters the uncanny valley, and resembles a human to the point that it is familiar and recognizable, but has certain inhuman qualities that make it appear eerie and unnerving. You may even be experiencing something like this now. The future is going to get weird, and exploring how things could end up could help you prepare for it. There is a lot more we can talk about here. For example, how does identity impact avatars? What does it mean when you can change your age, race, sex, and more? When using avatars, how do you know that you're actually interacting with who you think you're interacting with? What level of ownership or control should you have over avatars that resemble you? The list can go on. If you're interested in these topics, we can certainly explore them further. Regardless, we have a lot more content coming soon, so please subscribe so you don't miss out. This is Ryan O'Shea, sort of, and we'll see you next time on Lifespan News.