I'm really looking forward to this talk. If you've been to a lot of talk so far, you know that they have all been pretty technical. My understanding is we are going to get some entertainment and some jokes and some stories from Ben here. So let's get excited, give Ben Morris a big round of applause who is going to talk to us about AWS. Have a great time. Hey everyone, how's it going? You guys having a good time? All right, so am I. So am I. Thanks for coming in today. I know you guys have probably been waiting in a lot of lines and yeah just really appreciate you guys being so excited coming here to see this talk. Put a lot of work into it. So thank you. And we're going to be talking about a lot of cool stuff today. We're going to be stealing lots of secrets and we're going to be hacking AWS and showing how I did it all and then talking about how we can basically help fix the issue. And if you just give me one sec to actually get my timer started. Okay, perfect. So yeah, thank you very much for coming in. Just a little bit of a disclaimer before we get started here. Please do not arrest me FBI. No post exploitation was performed and everything I found was basically publicly available already. I'm not going to be talking about any AWS zero days or any exploits in customers specific software. This is just a widespread misconfiguration issue with AWS. And I'll talk about that a little bit more later. But basically you know I was just kind of driving down the road and I looked out the window and said to myself, huh, a lot of people's disks are on fire. I should probably you know just call the police and let them deal with it and I just kind of kept driving. So didn't do a lot of post exploitation and I definitely stuck to you know the look but don't touch. But anyway, so what is EBS? EBS stands for elastic block store and it's essentially a virtual hard disk that you can attach to a VM. So anytime you spin up a virtual machine inside of AWS, it's going to have a disk that's automatically provisioned to it. And that disk is an EBS volume. They can vary in size and the default is like 8 gigabytes but basically anytime you start building an application using Amazon EC2, you're going to be running one of these EBS volumes. So they contain your application code, your data, and everything else you would want to deploy. So these volumes, they can basically be detached and reattached to various machines. You can move them around kind of like network attached storage in a way. So they can, you can clone them, you can delete them, you can copy them, you can do everything with them that you would expect. And they come in generally four flavors for security purposes. They come in unencrypted, encrypted, and public and private. So you can have a combination of them like public, unencrypted, private, encrypted, public, encrypted and what not. And we're going to be looking at the public and unencrypted ones today. Those are the ones that are interesting and those are just the fun ones that have all the credentials in it. So if you have an encrypted or private disk, they're not really vulnerable. And also these disks by public or by default are private. So when you do spin up that instance, it is going to be backed by a private volume which kind of made this vulnerability really interesting to me. I wanted to know who is out there exposing their disks to the public when AWS actually makes it pretty tough. You know, you have to go into a separate menu after you create the snapshot and after you create the image to actually go check that public box.  So what could possibly go wrong with an unencrypted and public disk? Well, basically back in January, I was at an on site for a client and, you know, I was just really jet lagged and not able to sleep. I'm sure you guys have all been there. It's like, you know, you're on the west coast and you got to fly all the way to the east coast or you're on the east coast and you got to fly to the west coast and you get to that hotel and you sit there and you're at the bar. But there's nothing to do. You know, you're just stuck there. And then it's like 1 a.m. the bar is closed. There's nothing there. And you basically just say, well, I'll go set on my computer. Fine. So I thought to myself, well, I'll look at this client's cloud security controls. That'll definitely put me to sleep, you know. Except that it really didn't. I basically found an unencrypted EBS volume that was public on their account. And I really wasn't familiar with this vulnerability.  And I found some blog posts. But there were only a couple of them and they didn't really talk about this vulnerability very much. They basically said, oh, well, that's bad. But just don't do it. And it's fine. Which is, you know, it always just piques my interest. I'm like, okay, well I got to know more now. So I basically took this client's disk and I went through the 27 steps of attaching it to my VM through the console and mounted it. And I realized that this client had made a copy of their entire web application available to the public internet. And this basically had everything to run the app, including their AWS access keys, their AWS secret keys, API keys for third parties, database credentials, because, you know, of course, and of course the database was exposed to the internet because why not? Of course you'd want to do that when you have AWS, you know, that's totally normal. So after I discovered that disk and basically had this incredibly critical finding, I knew I basically had to investigate more.  Because this bug was really powerful. It had, you know, the keys to the kingdom for this whole application. So, you know, I started doing some digging and I wanted to ask myself, well, why does this happen? How can this happen? And basically, there's two screen shots here. You want your disks to look like the top screen shot there. If you can see it says there's a, this snapshot is currently private and that's what you want it to look like. By default, that's what it will be. But if you go into that tab and you change it to public or use the API, you have some kind of broken API code that ends up setting that snapshot to public. What happens is it shows up in that nice search box down there at the bottom.  So basically at that point, you know, I kind of realize like, whoa, this is really cool. Got something here. And basically, when you do set that public tab and it shows up in that search box, if it does have sensitive information in it, you have to assume it's compromised at this point. Because anyone can go search through it. And I don't know if you guys have heard about like the Capital One stuff that just happened recently or any kind of other like S3 bucket exposures. This is kind of a similar vulnerability to that. In that it's, you know, it's kind of going through someone's private data storage that they think is private, but it's really not. And one cool thing about this bug is all of the snapshots are queryable and you can pull all of the IDs back from the API. It's not like an S3 bucket where you would have to start guessing people's bucket names to try to find one. And if they set something like a GUID for their bucket name, you're not really going to be able to find it. So this, this made it really, really fascinating and really cool to me because you could basically just start going through all of their stuff in a programmatic fashion, very easy. And you know, even if you just want to use the web GUI, you just start, you know, typing in stuff in there. So at that point I was just like, this is awesome. And so let's just talk a little bit about what I found. Because everyone likes loot and yeah, that's what you're all here for. So what did I find on these buckets? I found a lot of stuff. So I'm going to give, first I'm going to give three examples of some critical exposures that I was able to find. And then I'm going to kind of talk at a higher level and talk about overall trends and some more stuff that I did find. So the first example I'm going to talk about is about some robots. And I like robots. Robots are great. They're our friends. And if you think about robots and service accounts in your own organization, you may be thinking about, you know, your Slack bot or, you know, other chat bots you have and think about what those robots can do. They can do things like push code or, you know, deploy new builds. They can do a lot of stuff and have a lot of access.  So this case I was able to find these credentials in this user data.config file on this random disk basically and I was a robot. So what could I do with robot? Well, I didn't have any permission restrictions and, you know, the ability to, you know, deploy stuff seems pretty great. And when I started looking at the disk one more thing. This output right here is basically the equivalent of who am I for AWS. There's one command you want to run whenever you find a set of credentials. It's called STS get caller identity. And that basically is like who am I. Anytime you have a set of any credentials you can pretty much always call this API endpoint no matter your region and it will come back with, you know, who you are. So this is just a simple listing of, you know, who I am. And so I started looking through this disk to try to find clues. One thing that's interesting about this is you always got to have like the scavenger hunt to figure out who owns the disk and who, you know, who owns it. So in some config files that these creds were near there was some database configs with some internal URLs and some just some domain names. And these domain names led me to a pretty cool company. And the company ended up doing a lot of really interesting things like tracking ISO social media requests and posts. And they did things like record border interdictions. And they were basically software as a service company that sold pretty much exclusively to the government. So they're just doing government stuff and their robots keys are just sitting out there for anyone to go grab.   So, you know, we reached out to this company and they were, you know, of course very grateful and they, you know, super positive response. And they gave us like some remediation steps. So they really liked this. And yeah, this was this one just kind of highlights this problem entirely. Like it's just, you know, you could find anything out there and these accidental exposures could contain anything, really. So it was really interesting just kind of going through them all. The next set of credentials I want to highlight is something I just call Woot Woot. And basically, there was a disk with a Docker file. And if you guys are familiar with Docker, it's just a way to manage your infrastructure, basically. And there was some other code around there. There was like a Golang program that was compiled. And then there were some kind of scripts. And it looked like they were mostly for system administration. It looked like this thing was responsible for, you know, spinning up infrastructure. And the one thing that I couldn't really figure out was who actually owned this disk. The config files didn't really have any clues. There weren't any domains. It was all just like internal 10 dot addresses. So it was just kind of like, okay, well, I don't know who owns this disk. But what I did know was, you know, which account I was and who I was and who I was was root. So just out of thin air, I was able to grab some root credentials for this account. And if you're not familiar with AWS, root is basically God permissions on an AWS account. It has unrestricted access. It's an administrative account. And you're actually not even really supposed to use them. You're kind of supposed to delegate an account or you're supposed to create an admin account and delegate admin permissions to it. So that way you're not directly using the root account. But these guys thought it was a bright idea to just start using that root account. And they said, oh, well, no one will ever find this disk. You know, it's just some internal thing that spins up infrastructure. No one even really interacts with it, except me, you know. So the, you know, the highlight here is just, you know, you could find everything. This was actually the only set of root creds I found in the disks. So that was kind of cool. I honestly wasn't even expecting to find it, just because I think everyone kind of knows not to do this now. But this just highlights again, just the critical nature of these disks and what they contain. Because a lot of people just aren't expecting you to be able to get access to these ones. So the next one I want to talk about is a little, it's about a little piece of software I love near and dear to my heart. It's Jenkins. And if any of you guys have, you know, owned some Jenkins machines out there, you know why I love it. It's always full of credentials. It like has access to production source code and it can like push builds. People do all kinds of crazy stuff in their Jenkins jobs. So, you know, anytime you come across a Jenkins server, it's just great. You know, tons of stuff. So in this case, I found a Jenkins server and it was basically, it looks like a developer instance. It looks like to me some developer was trying to get an internal application to work with their own Jenkins setup. So they kind of like spun up a copy of their Jenkins server and were trying to, you know, get an application to work properly with it. So, you know, in the Jenkins server I found some AWS credentials and I popped them in to the STS get caller identity and I found out I was a dude named Kumar. And I thought, wow, that's great. I'm Kumar now. Sounds good. So I looked in the users.xml file, which is, if you're not familiar with Jenkins, that is just the file that holds basically all of your user names and passwords for users on the machine. And that's kind of assuming there's no single sign-on in place or no active directory integration. But so this user.xml file was kind of funny because I looked at who made the server, who had the admin account and their email address and it was definitely not anyone named Kumar. So, you know, it was kind of funny.  But then they like also framed their co-worker somehow. I don't know why. Maybe they were trying to frame their co-worker. I don't understand. But yeah, so Kumar, we got his keys and started looking around, trying to figure out who this was. And from the email address we were able to determine it was a software company and the software company, I can't name them but I can talk about who they do business with and from their website, you know, these are the people they work with. They work with Salesforce, Apple, FIS, a lot of other like Fortune, you know, Fortune, whatever, end companies. So, you know, this is a large software kind of consultancy firm and they just did, you know, a lot of cool stuff.  But in this case, you know, you could almost have a compromise happen because of a contractor who maybe, you know, only has indirect access and, you know, are you really watching that whole supply chain of, you know, your contractors and who you're actually doing business with to make sure their security is also not weak. Because in this case, you know, the compromise could, you know, could definitely lead to some pretty severe consequences just with the amount of work this company does. So, you know, overall these kind of three exposures highlight the critical severity and just the kind of stuff you're going to find when you come across these disks. And all of this just makes sense, you know, these are just like people's application servers. It's just a lot of developers kind of, you know, doing whatever and trying to just make their stuff work. So, you know, overall we had, these are kind of the things I was looking for. When, when you get into a disk you find a lot of leaked source code, of course, because they're, you know, mostly application servers. So a lot of people are doing AWS right. And they have a set of temporary credentials which allows their credentials to basically expire. So, you know, if you don't get access to those credentials within about 24 hours, I think is the default, you know, those credentials rotate out. So, you know, that's good. But even if those credentials rotate out, you're still going to have that source code laying around on someone's disk. So, you know, we found a source code for some government contractors, some large tech companies. And a lot of these are just like boring internal applications. But a lot of them also give really good insight into how these companies operate, even just having their source code is really dangerous.  So it's just like really, really cool source code, even if that's all you get. And, you know, at the end of the day, it's just a medium, kind of like a medium risk finding. But another thing we got was tons of private keys. I know it's SSH up there, but just lots of private keys think about like TLS certificates and whatnot. We have just like tons of client and server keys.  You can be man in the middle. And some of the client keys we got, you know, just allow SSH access. You know, you're like going through people's bash histories and trying to figure out, well, where are these IPs? You know, who's running these servers? Try to figure it out. So, you know, that was a little bit harder to determine if those creds were valid. So a lot of the SSH keys and whatnot, we just directly handed over to AWS and just responsibly disclosed it with them to make sure they got, you know, word to their customers, hey, your keys are just sitting there. I should probably do something about that. So another thing we got a lot of, which was kind of surprising to me, was like SQL files that contained a lot of people's personal information. And I think a lot of these came from developers. They would, you know, borrow some data from production, move it down to a development environment and so they can play around, debug their application, do whatever they needed to do, but then they kind of left their disk out there just sitting there and these SQL files contained like thousands of people's, you know, usernames, hash passwords, email addresses, phone numbers, all of that stuff. So just some like really nasty hygiene around like SQL files and just kind of all of that. And another thing we got a lot of were like WordPress installations, which are pretty cool. If you get a WordPress backup, I should clarify that, you know, the WordPress like some of the things we found were WordPress backups actually. So in the backup, you know, you're going to have like the database, which would be basically a SQL file and that will contain like all the password hashes and also like API tokens for third parties, which are always great to find because they allow you to escalate further, do, you know, more privilege escalation kind of in their own environment. You can potentially start taking over more and more resources. So, you know, finding those API tokens was also really, really great. And a lot of just kind of like off the shelf software, it seemed like a common pattern would be like developers again, kind of like just doing a bunch of dev debug work, pulling down some stuff like a Drupal instance, throwing it up there and then just leaving it there. So a lot of those kind of credentials were laying around. And also VPN credentials. Lots of open VPN creds and some of them were for legitimate companies who, you know, were using it to access their internal network. So, you know, at that point, you know, it's pretty much game over because that's, you know, it's kind of one of the big goals of an external attacker is to get internal network access. So that was really cool.  And that made me really, really curious. Just like what kind of attacks could you accomplish? You know, you could definitely just, you know, abuse them but could you also like maybe man in the middle of them when they think they're on their VPNs? I'm not really sure. But I thought that was really cool to find.  And then also, just in general, we just found lots of AWS keys, Google OAuth tokens, you know, third party API tokens, email passwords. Think about like your SMTP creds, your web apps are using SMTP to send mail or mail gun. Like one thing I, one app I specifically remember very clearly is something called, it was just called surveillance app. Like that was the repo name. I found there like that get directory is just like surveillance app. Okay. And so I looked at it and it's just a bunch of code that just takes raw RTSP streams and just dumps them into S3 buckets. So, you know, whoever or whatever this thing is surveilling, I have all of their keys now. You know, I can go read their buckets. I can go, you know, look at who's, you know, who's being watched and I could basically surveil their surveillers. And that one was so hard to like not touch. I did not, you know, like it's so hard to just not touch this stuff and want to just explore. So that one in particular, you know, you like want to see like web camera roulette, you know, you always want to see what's behind that web cam or like, you know, one of those crappy cameras that, you know, is just on the internet. So that one in particular was just kind of funny to me. It was really hard to just kind of bite my tongue there. So yeah. So overall, we just, we just looked for, you know, a lot of the easy wins. You know, when I initially started off a lot of this research, I kind of had this dream of like, oh, I'll steal everything under the sun and then just deal with it later. And you'll kind of like go through it. But it just turned out that kind of grepping for the common stuff you'd think would be good. It was, was a good approach. You know, just, this just kind of goes to show like we had a lot of success there. So yeah, just a lot of great stuff. And, you know, sad I couldn't like do a lot more poking with what it actually was, you know, when you do find something. But it was still really, really cool to find all this stuff. So basically, I want to talk a little bit about how I did find all of this. The, the vulnerability and the misconfiguration on the surface is pretty easy to exploit.  And you can definitely do that. It's, it's totally possible. But I basically wanted to kind of automate that process a little bit because when you talk about temporary credentials and things like that, it is a bit tricky to deal with those manually. Like if you, if you have some set of temporary credentials, you know, those are exposed for a good window of, you know, 24 hours. And if you get those credentials, you can basically endlessly refresh credentials.  But it's definitely a known technique. Like if you get those temporary I am credentials, you can just refresh them endlessly until they basically rotate them out from underneath you. So it was really important to have some automation under your tool belt. You can exploit some instances manually, but a lot of the ones you're going to find are just unlabeled and difficult to detect. So you definitely want to have some automation there. And there's basically a really simple three step exploit process here. You know, you're just going to pick a snapshot. You're going to attach that snapshot to your EC2 instance. And then you're going to search it for secrets. But the problem is there's about 120,000 disks that are exposed across all regions. And a lot of them are just, you're just not sure what they're going to be because they're not really labeled. And a lot of them are just garbage. They're just totally legitimate disks.  So the first step, oh, clicker. Oh, sorry. Clicker was malfunctioning. So at high level, this is kind of the architecture I used. There's nothing really crazy here. I'm basically just using an asynchronous queue to send new snapshots to workers. And then that master in the middle is just a little application that kind of coordinates everything. So that master, he just pulls all the snapshots about every minute, looking for new ones. When a new one is detected, it just puts it in the queue. And then the worker in each region that, you know, the message is destined for. We'll just pick up that message and start the scraping process, which, you know, extracts all the secrets. And it just throws it into the database. So it's a pretty simple process. And this asynchronous queue and worker setup gives us the ability to scale up and scale down the worker processes as we need. So we can save a little bit of money, too. Which is always nice. So, and all of the code and all of the scanning is within the default AWS API limits. I didn't have to, like, ask for, you know, well, I need to scan lots of disks. They let you do, like, five disks concurrently across everything. So, you know, within those limits, within a default AWS account limit, I was able to scan these disks. So there wasn't anything, you know, anything preventing me from doing this, basically. So with the architecture out of the way, step one, pick an exposed snapshot. So what to read. And there's kind of two ways you can go about this. You can do an exhaustive brute force over all of the disks. And that's totally possible. You can spend, you know, a couple months doing that. Or you can kind of do a more careful approach. And I initially started off doing the brute force approach, like I said, I just wanted to steal everything out of the sun, you know. But that just didn't really work out. For mostly a couple, for basically, like three reasons. I was just fishing up a lot of garbage. So the human genome project is on AWS and there's like, you know, genome sequencing happening.  All I'm getting is a ton of garbage. And there's no faster way to, you know, just thrash your database than just filling it with worthless files from that. So there's that. And then each disk also takes about two to five minutes to scan. So at a minimum, just the logistics of cloning the disk, mounting it to your image and then detaching it and force detaching it. Takes about two to five minutes. So the more disks you have to scan exponentially, you know, more time you kind of spend, not exponentially, but just a lot more time you spend doing it. And also it just costs money. So, you know, who likes spending the profits, right? So basically I kind of came up with a way to filter out these disks. If each disk has an owner ID and that owner ID basically just tells you who made the disk. So I looked at the owner IDs, I just counted them and I looked at the frequency that owners would publish disks. And what I found was there were a couple of outliers that published about, you know, like 50 or 60 percent of the disks. There are about four to five of them. One of them is Amazon themselves. So these disks were basically just kind of worthless.  So I took those and I figured the smaller owner IDs would have a better chance to kind of reel in those credentials and get them going. So using that owner ID I was able to cut down the number of disks I had to scan to about 20,000 and that just made the whole process much faster and I was able to finish it in time. So the next step is attaching the volume and there's this like nice AWS butterfly effect that happens where you end up wasting a lot of money because a tiny bug in your code ended up, like, breaking everything. And there's some really interesting failure points that I didn't realize exist. Like I didn't know the metadata URL could fail.  But it kind of made me think about, well, if I'm testing for SSRF and I have a scanning, you know, some scanner and it throws the metadata URL at the target and that metadata URL had just happens to be broken during that time period. You know, I just got a false negative and it kind of made me rethink some of the AWS testing that I do myself, just in simple cases like that. And then also you're going to have like a ton of file system issues like LVM disks that just, you know, like for some reason it just needs a totally separate tool to unmount and mount. I don't know why but, you know, that's just the way it is. So you're going to run into a lot of those issues and you kind of just want to make sure that you're, you know, taking care of them. And then searching the disk for secrets. So one thing you can do is you can use something like DLP Diggity or like Git Rob or Truffle Hog to kind of go through like specific things. And that's pretty much what I did. I just, I stole the greps from Truffle Hog. Thank you. And then I kind of came up with some of my own to just look for the private keys and whatnot. So this process was pretty straightforward. Just mostly a grepping for like really high signal stuff. And also I did sniff the MIME type for each file. I would attempt to kind of only scan files that didn't look like, you know, binary or images or whatnot. So this kind of cut down on the number of files I had to scan for each disk and led to, you know, faster, you know, faster scanning. So, and another interesting thing I did with this as well is because you have access to all the default disks on AWS, I just spun up all of the default disks and made like a huge blacklist of every file that you don't want. And then I manually like added some for Etsy Shadow. We always want to steal shadow files. So we kind of go through this white listing and blacklisting process. And all of this, you know, ended up kind of coming together to make it pretty quick to scan these disks. You know, each disk can kind of go down in about like seven minutes. So that's pretty good for, you know, for the purposes of my research and it ended up working pretty good. And yeah, so we just end up grepping through everything.  Like have tests for your code. The AWS butterfly effect is definitely real. And it's going to return things. The AWS APIs will return errors you definitely don't expect like the metadata you were all failing. And also you definitely want to design for like multi region upfront. I made some design decisions that ended up kind of, you know, messing that up a bit because I didn't realize snapshot IDs are actually not unique across regions. So you could have two regions, two different snapshots one snapshot ID. And, you know, if the primary key in your database is that ID, you're kind of going to have a bad time. So yeah, just make sure you think about all of these things up front before you start, you know, kind of looking at it. So we've kind of talked a little bit about, you know, what this is, how to find it. And we can talk about fixing this problem. So remediation, what does remediation look like? In this case, it is pretty easy. But there's a couple of things that to keep in mind. You definitely want to go and search for your three AWS accounts to find any public disks that are unencrypted. If you do find one that is sense has sensitive information in it and is meant to be is not meant to be public. You want to take down the snapshot, first of all, that should be obvious to everyone. But then you also want to rotate your credentials. And I know a lot of people like to skip this step because it's a pain. It's hard. Oh, there's that one system, you know, that someone built five years ago. We can't rotate the credits. I'm sorry, you know. But you should definitely rotate the credentials because if you think about the vulnerability, I'm scanning every single disk every minute basically. And as soon as you make that snapshot public, I'm going to initiate a copy on it. And once that copy is initiated, it takes about two to three minutes to actually finish the copying process. And from that point, the copy is mine. If that copy finishes, you can't do anything about it. And you're not even going to know, honestly. And that's one cool thing I thought that was interesting about this attack surface is unlike a lot of other attacks with AWS, if you're like, you know, sending a lot of web requests to try brute force directories or something like that. You're going to, you know, show up in logs. But in this case, you're not actually directly attacking a customer on AWS. So you're actually not going to log anything. And it's going to be really difficult for someone to actually detect that you're cloning their disks. There's basically no way to do it. So at least that I could find, you know, in my in my research, there might be some some, you know, logging set up somewhere, but I couldn't find it.  And you're going to not really even understand, you know, how it happened, because there's no logs. So if I'm stealing your disks every minute, you're going to want to make sure even if it's only a brief exposure of the disks, you're going to want to make sure you actually rotate those credentials because anyone performing this attack is almost certainly going to have a setup similar to mine where they're just kind of pulling it down all the time. And and and not letting you, you know, kind of get away with without rotating those credentials. So and then the last step is, of course, to have a little post mortem, you want to make sure that you understand how this vulnerability happened in the first place. You definitely don't want to just let your developers, you know, just kind of go and and just kind of have free reign. Is this an SDLC problem? Or is this like a random script that we have that we occasionally use and just happens to create public snapshots? You just don't really know that. So definitely check it out and investigate how you got there.  You can go through it manually. I'm going to delay the release of the tool just by a couple of weeks to coordinate with Amazon and get some of these disks, you know, taken down and give people an opportunity to go through their own disks and just make sure there's no exposures. But after after a couple of weeks, I'm going to release Duffelbag and you can just go download that and that will help you scan disks. And I've written it in such a way so that it will work on kind of any disk you have if it's private or public. So it can help in your own organization scan for disks, you know, because one thing that I find a lot is you'll run a scout suite report and then you'll get a bunch of EBS volumes that are unencrypted and sometimes there's like a thousand of them. And you're like, how do I go through all of these and figure out if any of these are actually if anyone should care about them. So this tool should work with public and private disks as well as like a wide variety of file systems. So you should be able to use this to kind of help sift through that pile of hard drives you do need to go through in your own organization. So definitely check out that in a couple of weeks that will also help remediate it. And we also just kind of wrapping up here some more loot that I thought was pretty funny. So I always like to look at my favorite password.  So I found like Nuglover's password and that was for like a Docker account. So thank you, Nuglover. And if that's your password, you should probably change it. Yeah, and another thing I was looking at some disks and I found some creds on there. I was super excited. I was going through everything and super, super jazzy as creds. And then I realized, oh my God, this is a capture the flag box. I just captured the flag on a disk. I didn't even, on a CTF, I didn't even know I was playing, you know, it's just, it's like, yeah, it was, it was, it was pretty good. Thank you, thank you. Yeah. So, so that was another great find. And one other thing I found on there was wallet dot bats. And if you don't know what that is, that's your private key for your Bitcoin wallet. And I found something like Zcash wallets too and everything. So basically when I found those, I mean, my heart rate went up so much. You have no idea.  Yeah, it didn't turn out that way. I'm here and not on an island. So you can definitely know that I didn't really get any money from that, but it was mostly just people toying with cryptocurrency, which is great. But, you know, it didn't get crypto rich, unfortunately, with this bug. But that would have been nice. So, you know, maybe in the future, maybe someone will throw their wallet dot that up there with a couple hundred bitcoins, whatever. And another thing I found a lot of was SSH keys on Windows machines. And I was really curious about this because I thought a lot of people using AWS and whatnot would be just using Linux or some other disk. And it just turned out there was a lot of Windows disks that I wasn't expecting. And I had to go and make better blacklist and whatnot. But like every time I get an ID RSA off of a Windows box, I just kind of smile a little bit because, you know, it's kind of like, this cool. So there was like a surprising number of Windows machines out there. And a lot of them were misconfigured in this manner to, you know, to facilitate all the secret exposure. So lots of Windows disks, just some really cool stuff there. And yeah, and, you know, I'm sure that there's a lot more out there. You know, I was pretty time boxed on this research because, you know, it started in January.  But then I realized like how widespread this is and wanted to start looking at it more and more in detail. So, you know, there's still a lot out there. I was only able to like look at text files and whatnot. There still could be like database files and lots of other interesting information. And I also only, you know, I kind of limited myself to disks that were under about 100 gigabytes. So there's still like more attack surface. And the cool thing is new disks pop up every day. There's about five or ten disks that pop up every single day.   So just kind of some conclusions here. I manually validated about 50, you know, sets of credentials. And then after that I was like, all right, dude, I can't do this anymore. Like my eyes are bleeding, you know, from like grepping out creds and testing them on like a million different things. So I would just kind of give them to Amazon and let them deal with it. I kind of estimate there's about 750 to 1200 50, you know, high and critical exposures across all the regions. And this is just kind of a direct extrapolation from my, you know, my regions and the disks I was able to look at in this time. And there wasn't really a pattern for, you know, who was impacted. It was just kind of like random software, government contractors, healthcare, everyone, everyone just kind of random. So not really a whole lot of patterns there. And overall it would cost about $300 plus R and D time. So it's a very cost effective attack, which is not my assumption. It would not, it wouldn't not have been my assumption and it wasn't my assumption when I first started this because I thought, you know, spinning up all these hard disks would actually be pretty expensive. But it turns out if you destroy them pretty quick after you've scanned them, it just doesn't cost that much. So it's a very cost effective attack. And because you can kind of do it passively, you know, over time and when a new snapshot pops up, you just go scan it really quick and turn it off. It's pretty cheap to do, which I thought was great. You know, getting a set of root keys for $300, it seems like a pretty good deal, you know, along with all the other stuff. So, you know, the research and development time of course. And yeah, and that was basically, you know, just a really cool aspect of this that I really liked. Just super cheap pre-creds. What could go wrong? Yeah, so that's pretty much it. You know, I just want to thank you guys again for coming. I want to thank these people as well. And thank you so much for coming here today. That's pretty much it. So, yeah.  I'm going to hit the bar and I'll probably field some questions outside if you guys want to chat with me. I would love to talk about this stuff and any ideas you guys got. So yeah, have a good one. Enjoy. Thank you. Thank you.


Hi, my name is Erica Lu. I'm from New York City in the United States and I'm the developer of Energy Tycoon. I used Scratch to make this game and it wasn't my first time making a video game because I've been using Scratch for at least three years to code. I started learning Scratch in sixth grade and I've improved a lot since then by looking at tutorials made by other Scratchers and by making my own games and getting feedback from the community to figure out how to improve. My game's name is Energy Tycoon and the goal of the game is to gain as many energy points as possible by buying machines and buying upgrades. My favorite video game right now is Among Us and it might be my favorite game of all time, but I also do like playing Minecraft and playing Tetris.  I also like spending time with my family and my friends.


The CVQs, or Caribbean Vocational Qualifications, are certifications recognized by CARICOM and administered by the Caribbean Examinations Council CXE that are grounded on the fundamentals of particular fields of labour. The certification well-recognized throughout the region enables a recipient to work anywhere in the qualified field within CARICOM in order to prepare for the mammoth task of training 3,000 secondary school students under what their CVQs. A preliminary meeting was recently conducted by the Human Capital Resilience Project, with all major stakeholders held at the Mount of Prayer in Cobra Rail. According to Project Manager of the St. Lucia Human Capital Resilience Project, Dr. Rufina Federick-Felicinier, the project funded by the World Bank, is expected to transform the TVET sector in St. Lucia from a supply-driven to a more demand-driven sector. Through this project, the government is seeking to strengthen resilience of its population and address issues of poverty, vulnerability to shocks, youth unemployment by pursuing a two-prong strategy focused on improving labour market relevant skills. As part of its TVET thrust, the Ministry of Education plans to transform four secondary schools on the island into model TVET institutions. The management of TVET nationally as well as the administration of the CVQs is being handled through the St. Lucia TVET Council, an important aspect of obtaining a Caribbean vocational qualification. According to the Quality Assurance Specialist with the St. Lucia TVET Council, Dr. Catherine Clifford is the assessment component. You can't be assessed without having evidence that you actually did that training and you took part in all the activities or the competencies of the occupational area. So that is why you must have a portfolio and that portfolio is not an afterthought. After you were trained that you're going to just whip things together or copy and paste from the internet or just go out there and take random pictures. That's not what it is. Officials say disadvantaged students can receive financial assistance to benefit from the program and earn a CVQ. Jackie Mills, who is the social and environmental specialist with the Human Capital Resilience Project, says this will extend to students receiving transportation support as well. We have to ensure that they get to their centres and get back home safe. We also provide meal allowance. Child care support is also provided in terms of we don't want anybody who wants to say, well, I have kids. I need this support to ensure that I can pursue my food and my education. So this is in place. We provide supply materials and tools. This component of the project will be facilitated by teachers already trained through the Immersion Program of the Human Capital Resilience Project. It is hoped that coming out of this meeting, a clear plan will be formulated to promote and expand the offerings of CVQs, not just to secondary school students, but the wider St. Lucian community. From the Communications Unit of the Department of Education, Innovation and Vocational Training, I am Chris Satney reporting.


What's up and welcome to One Take. I'm Gil and today I want to talk about a news story that seems to pop up every few weeks and that's the prospect of Tom Hardy's Venom facing off against Tom Holland's Spider-Man. And the reason this is popping up today is because Phantom.com recently interviewed Ruben Fleischer who directed the first Venom movie and he's currently making the rounds promoting Zombieland 2. He had this to say when asked about Spider-Man and Venom meeting. That's where it's all going to lead and that's the exciting thing because we changed the origin of Venom. In the comics he evolved from Spider-Man but because of the Marvel Sony thing we weren't able to do that. And so the thing I think it's building towards and will be exciting to see is when they actually do confront each other. Now this isn't the first time that people involved in the production of these movies commented on the crossover as though it's something pretty likely to happen in the future. In fact Kevin Feige recently said it's pretty likely. Now if I'm trying to predict what a movie studio is going to do the first thing I ask myself is is it going to make them money. And it seems obvious that taking Spider-Man and Venom crossing them over in a movie that's going to make Sony and Marvel a bunch of money. The question is will it make them more money than they're currently making with the status quo. Meaning Sony's making money off their Venom movies. Sony and Marvel are both making money off these Spider-Man movies. Will they make more money by combining those two characters. And I don't think the answer is an obvious yes. My feeling is that there's probably a pretty big overlap between the people who go see Spider-Man movies and the people who go see Venom movies. So when you combine the two characters it's not like you're taking two separate audiences and combining them to get a bigger box office draw than you would with solo movies. And I don't think that one character will give the other character a bump. For example if the Venom movies were struggling and Sony wanted to pick up the box office for them you could see why they'd want to pull Spider-Man into the next movie. But if you look at the box office Venom made 856 million versus Spider-Man Far From Home which made 1.1 billion. And I think it's fair to say that Far From Home got a little bit of a bump because people also saw it as sort of an epilogue to Avengers Endgame. So I think a more fair comparison would be Spider-Man Homecoming which made 880 million. Much closer to the Venom box office. Having said that it's clear that taking characters from solo movies and crossing them over into an event film can be a major box office draw. You look at any of the Avengers movies and they consistently make much more at the box office than the solo movies that their characters originate from. So I think Sony will definitely see that potential and want to create an event movie of their own. But I just don't think that Spider-Man and Venom alone are enough to do that. Now if you look at Sony's current slate of movies they have in production besides Venom they have several other Marvel characters they want to make movies about. The one that's furthest along in production is Morbius but they also have Black Cat Craven the Hunter and one they've bounced around for a while now is Sinister 6. So they could very well release a few other solo movies and then do a big crossover event where it's not just Spider-Man versus Venom but it's Spider-Man versus Venom versus Morbius versus Craven the Hunter maybe versus Black Cat. They could also go the route of having a couple of factions fighting against each other. All of Sony's movies tend to focus on anti-heroes. So maybe a few of those anti-heroes lean a little bit more towards the hero side of things to team up with Spider-Man whereas maybe a few of the other characters form a sort of Sinister 6 and then you have an interesting group of heroes against a group of villains. Speaking of Sinister 6 if Sony uses this as an opportunity to reboot some of the villains that general audiences are more familiar with like Doc Ock or Green Goblin that could be one more ingredient that makes this event film a big box office draw for more than just people who are interested in a Spider-Man or Venom movie. So the bottom line is that it seems pretty clear from the way people are talking that we're heading towards some kind of a crossover between Spider-Man and Venom. But at least my opinion is that it's not simply going to be a Spider-Man Venom movie but somehow Sony and or Marvel are going to find a way to make that a major event movie that really draws in general audiences. But enough about my opinion what do you think about all this? Do you think we're going to see a Spider-Man Venom crossover anytime soon? Do you want to see that crossover and would you rather see it in the MCU or would you like to see it on Sony's side of things in the Venom universe? Let me know in the comments and let's get a discussion going. And if you enjoyed this video make sure to hit the like button subscribe to this channel and hit the little bell icon to make sure you get notifications whenever we release more videos like this one. Thanks for watching.


In this video, I'm going to talk about identifying adjacent angles. A little bit more than that, I'm going to talk about adjacent angles and I'm going to talk about adjacent angles and linear pairs and angles that in fact are not adjacent. This is going to be kind of a vocabulary rich example here. The first thing I'm going to go over is adjacent. So you've got all these angles down here, lots of different angles. Are they adjacent? Well, adjacent means just in regular English vocabulary, adjacent kind of just means next to. What are the angles next to each other? A little bit more than that, if you dive into what adjacent means for angles, adjacent means that they share a vertex and they share a side. So just keep that in mind when we're talking about adjacent angles. So adjacent and form a linear pair. Linear pair means that if you have two angles, if you have a pair of angles, they form a linear pair, they form a line. That linear word just simply means line. So two, a pair of angles that form a line. So that's what a linear pair is and then or the angles themselves are not adjacent. So they're just two angles. So now that we've gone over some of the vocabulary, let's dive into the problems themselves. Three different problems. So I got to identify these angles here. So angle A, E, B and angle B, E, D. So I got to figure out where those angles are at first. So A, E, B. Here's our first angle right here. Here's our first angle right here. No, let's just use arcs. Let's just use arcs. So here is my first angle right here, A, E, B. And then my second angle is going to be B, E, D. It looks like it's a little bigger, so it's going to be this angle right here. Now notice I used one arc for one of them, two arcs for the second one. Notice to note that those are the two arcs that I'm talking about that I want to look at. And in fact, the arcs tell me that they're not the same measurement. All right, so anyway, let's see. We are trying to figure out if they are adjacent, if they are adjacent in form of linear pair, or not adjacent at all. So let's go over the adjacent part of it first. Do they share a vertex and do they share a side? As I look at these two angles, I got a vertex right here of E. So A, E, B, and B, E, D are my two angles. They both share, over here, they both share that middle point of E. They both share a vertex of E. So it looks like they have the same vertex, so that's the first part of adjacent. First part of adjacent. Second part is that they have to share a side. They have to share a side. So I have A, E, B. So here's a side of B, E. And then I also have the angle B, E, D. So there's another side right here. B, E is the side that they seem to share. So that right there, that tells me that in fact those two angles are adjacent. They are next to each other. So that works. Now what I have to figure out also is whether or not they form a linear pair. Do these two angles form a linear pair? So if they're next to each other, do they form a line? As we see, A, E, B, B, E, D, together they form A, E, D, which in fact is a line. It looks like a line, so it is the line. So there we go. They do form a linear pair. So actually this first example that we have here, this first example that we have here is adjacent and is a linear pair. So not only are the angles share a vertex and share a side, but then the angles also, the pair of angles form a line. So it's also a linear pair. So there we go. So that's an example of actually both of them. All right, so let's take a look. I'm going to go a little bit faster through these next examples. I'm trying to get heavy through the vocabulary, so I'll go a little faster this time. So now we have A, E, B, which is this same angle right here. Because I got rid of my marks, I can make new ones. And B, E, C, so B, E, C is this angle right here. Again, make it two marks for that. All right, so right away I see that they share vertex E. I see that they share B, E, this side. So that tells me that they are adjacent. But the thing is they don't form a line, they don't form a linear pair. So for this example, they only are adjacent. So for that example, they're only adjacent. Let's mark that off a little bit. So the first example was adjacent anilinear pair. The second one, those two angles are just adjacent. So we might be able to imagine what this last one is going to be. Let's look at it and see what kind of angles we got. All right, D, E, C. So we're going all the way over here. D, E, C. You don't have to go in alphabetical order. You don't have to say C, E, D. You don't have to go. Start with what would be the closest to A, I guess. You don't have to go in alphabetical order. You can go with D, E, C. It doesn't really matter. But anyway, there's our first angle. And then we have A, E, B. A, E, B right here. So there's our second one. Now as I look at these two angles, are they adjacent? Well, they do have the same vertex right here. But they don't share a side. Here's a side, B, E. And here's a side, C, E. They don't share that side. A, E is another side over here. E, D is another side over here. They don't share that side. That's not the same side. So these two angles, yeah, they share a vertex, but they don't share anything else. So this would be an example of where two angles are not adjacent. So this is a not adjacent type of problem. So that gives you three clear examples of the differences between angles that are adjacent, adjacent and form a linear pair, and that are not adjacent. This goes over the vocabulary that goes with that. Hopefully, this video was informative. And hopefully, this will help you identify the vocabulary of different angles a little bit better.


Stories from Parliament. Votes for Women. Part 1 Deeds, not words. That was our cry. That day in 1909, we suffragettes were marching to Parliament to demand the vote for women. But women, as well as men, should be allowed to vote in electing our government. Our Prime Minister, Mr Asquith, had promised it should be so. But now he'd had second thoughts. He feared that too many women might vote against his party and bring his government down. So he did precisely nothing. That cry of ours meant two things. Instead of mere promises that the vote would be given to women, we wanted the government to do as they'd said. And if they wouldn't, then we were willing to act as well as speak in protest. We'd come from our meeting in a nearby hall, and the words we'd heard from our movement's leader, Mrs Pankhurst, were still ringing in my ears. We shall be marching to Parliament, not as law breakers, but because women should be lawmakers. My name is Constance Lytton. My full name is Lady Constance Bulwa Lytton. Some people thought it strange that I, from a family of the ruling class, should ever have been a part of such a crowd. But Mrs Pankhurst was a well-born lady too, and listened to what she said next. A society that allows women no part in decision-making cannot flourish. Beyond the home, what lives are we permitted? Important posts are barred to us in all professions. Posts in government are just for men, yet all their decisions affect women. They must either do us justice by giving us the vote, or do us violence. When we reached the Houses of Parliament, lines of policemen barred our march. Some women broke through and chained themselves to the railings by the entrance. Meanwhile, I was still outside, wedged by the crowd behind me, nose to nose with a policeman. Back! Back! Keep back! I'm only doing my duty. Yes, and we are doing ours. You should be ashamed of yourselves.  Like women? Yeah! Get home and do the washing! I must see Mr Asgrith. I mean to see the Prime Minister. I don't think so. You're coming with me! And I was marched to the nearest police station, and from there to court, where I was sentenced to a month's imprisonment. And it was there, in Holloway Prison, that I truly realised why our cause was so important, why women had to be allowed to vote to change things.  I remember on my very first night, the prison chaplain came to my cell. I'm surprised that a lady of your class feels the need to interfere in politics. I am a woman. What women face in life is not understood by men, yet men are the only law makers. So they are. So women's concerns are always put to one side, forgotten. I didn't come here to discuss your views here. I'm told you may have these. What? Letters from my family? Indeed. But prisoners are not allowed to have them. Oh, I think we can make an exception in your case, my lady. I want no privilege. You prefer to stay in all this stink? Stink. Yes, that is the right word. There's no air in here. Indeed, there isn't. How will you bear it, my lady? I'm not sure I will. And we're condemned to this merely for demanding the vote. Votes for women! Votes for women! But I have a confession. Because I have a heart condition, I gave in. I finally accepted the offer and spent most of my month out of the stink and in the prison hospital. I was ashamed of myself. I decided that as soon as I was released I'd be marching with the suffragettes again. And if it landed me in prison a second time, I'd make sure I was offered no special treatment. I would suffer whatever the others suffered. For I would go not as Lady Lytton, but as an ordinary working woman. My treatment so far had been bad enough. But worse, much worse, was to come.


What the f**k happened in crypto this week? Inflation numbers came in at 6% exactly what the market was predicting. This shot Bitcoin up to its highest price since June of last year. Bitcoin broke $27,000 this morning and it's currently up over 32% in the last seven days in the midst of all these banks collapsing. So is Bitcoin a hedge against inflation or a hedge against banks? Next week we have the Fed interest rate hike decision which could open up the door to hit $30,000 this month. Speaking of the Fed, has quantitative easing begun? The Fed added $300 billion in assets to its balance over the last week. The last and only time that they added a larger amount over a single week was shortly after the COVID dip in March of 2020. Bitcoin 15x'd within the next 12 months. Is this a spark that Bitcoin has been waiting for? Don't forget to like and subscribe for more videos just like this.


What's good Joshable Ross back again with another video so we're gonna check out what made the 2015 royal rumble match the worst in history By none other than wrestling flashback.  I broke it. I don't even know how I broke it But one of the legs was messed up. So I got me a new tripod a much sturdier one So I had to switch up the position of where the camera is. So if you like this angle, let me know down below Wanted to make sure all my equipment in everything that I use to make the videos or Top notch and the best quality possible. So if you like this angle, let me know if not, maybe I can possibly switch it around That's better for you guys, but we're gonna check this out man 2015 royal rumble was just a it was just a mess When you got Roman Reigns being booed to oblivion And then you got the rock coming out there and not even a rock could save him That's when you know it was just a disaster man. Hopefully this year's world rumble does not end up that way But we're gonna check this out appreciate all the love and support wrote to 70 K and let's get right into it the 2015 royal rumble match was the worst rumble match in history Now we have all seen our fair share of bad royal rumble matches over the years For example 1988 although revolutionary was incredibly boring 1996 was filled with ridiculous gimmicks and had no real star power and 1999 had some outrageous antics and was topped off as Vince McMahon claimed the victory for himself But in recent memory, there are none that stand out as plain awful as much as the 2015 rumble What were they thinking with the booking of this match now if you allow me to set the scene for a minute the year before at the 2014 rumble fans were clamoring for either CM Punk or Daniel Bryan to win it the WWE universe were on the edge of their seat Expecting Daniel Bryan to walk out at number 30 after delivering an outstanding match with Bray Wyatt Fantastic match However, instead of Daniel Bryan Ray Mysterio walked out at number 30 and the negative reaction Mysterio received was utterly shocking Yeah Ray Mysterio perhaps one of the greatest underdogs and biggest babyfaces of all time was being completely shit on He entered to a chorus of booze and his elimination via Seth Rollins received an enormous cheer And the rumble wasn't just a nightmare for Ray Ray was the ultimate baby face The ultimate baby face came out at the wrong time wrong situation crowd didn't care. It was just like yeah, you know what? We don't care. We wanted Daniel Bryan. You're not Daniel Bryan. Get the fuck out of here But also CM Punk that match was punk's last match in the WWE He entered at number one and fought all the way till the end only to be unfairly eliminated by Kane After the match punk actually walked out of the company Roman Reigns on the other hand Somewhat still considered as a young rookie at the time had a breakout performance as he broke Kane's 13-year record to register the Most Royal Rumble eliminations with 12 but in the final moments of the match Batista eliminated Reigns to win his second and here's the thing Around this time people were cheering for Reigns He was becoming a star at this moment cuz you know association with the shield He wasn't you know, he didn't really he wasn't saying too many cringe things like people was rocking with him So at this moment people were actually cheering him Because they didn't want the ladder of who else was left in the ring So Rumble match with the fans far from happy with the outcome So you would think one year on WWE would try to make it up to the fans and look at Rumble where fans could actually leave happy, right? Yeah, so if you know anything about WWE, that's not how they operate Instead what we ended up getting was much much worse The 28th Royal Rumble came at a time when WWE was trying to elevate new stars into the main event picture When the shield trio of Roman Reigns, Seth Rollins and Dean Ambrose split up in June 2014 After Rollins turned on his brothers to align with Triple H That meant all three men were on a similar path to the top of WWE Rollins won the Money in the Bank contract that summer while feuding with Ambrose a lot and Reigns was clearly the guy That WWE wanted to push to the main event picture The fans although cheering him the year before had now grown cold on the superstar from late 2014 to early 2015 Various critics raised concerns that Reigns despite not being fully ready was being pushed too hard too soon And I think that's what a lot of us fans were having an issue with I know people like to make the comment Oh, it's crazy. You guys were shooting on Roman and now you guys praise him That's because they were pushing him too soon They were shoving him down our throats as the guy and he wasn't the guy yet. I'm sorry Maybe if he had some cool promos, you know, it had a cooler demeanor. Yes, but his promos were overly scripted Hella cringe. It was awful and you knew majority of his feuds He was gonna win because you knew what they were doing is different when it's organic If you're gonna push someone that's fine But when you see it's not getting over with the crowd you need to pull in audible and maybe try to switch it up There's nothing wrong with giving in a shot, but clearly he was not ready He wasn't he just wasn't ready no matter how much Vince said he was Well, WWE tried to make him their next flagship star no matter how fans reacted in an interview with Crave Online Prior to the 2015 rumble Roman reacted to the negative reception from fans by saying that he only entertained criticism of his wrestling By people that were involved with wrestling Discounting negative opinions by critics that weren't wrestlers and who wouldn't understand how to lock up This of course added more fuel to the fire and didn't go well with wrestling fans at all It should also be noted that the WWE universe didn't reject Roman as a wrestler They rejected the push that he was being given time and time again They rejected the fact that WWE was trying to push something down their throats despite their disapproval fans didn't want to see it They were more enamoured with Brian, CM Punk and even Rollins guys who were terrific in-ring performers and had earned the respect of the Audience through years of working on the independence nevertheless the Sammy winner for Superstar of the year in 2014 Had his eyes set on being the last man standing in the 2015 Royal Rumble before we go on I do want to caveat that although the American audience were rejecting Reigns This created this illusion that he was hated by everyone, but that's simply not true Roman Reigns was very popular around the world and his merchandise sales proved that he was a star Which is why WWE decided to run with him However, on the American side of the pond, he was definitely polarizing with a lot more detractors and supporters Going into the Rumble, WWE had Daniel Bryan make his triumphant return after being forced to forfeit the World Heavyweight title due to injury So naturally, he was the fan favourite As well as Bryan, there were a number of other popular Superstars going in Such as Bray Wyatt, Dolph Ziggler and Dean Ambrose Who had they won, the audience probably would have left somewhat pleased with the outcome Also, it's worth knowing that the Rumble was taking place in Philadelphia, Pennsylvania There's certain places, certain places in the States where it's like, they're wrestling cities So you know the crowds there, they're gonna let you know how they feel And, um, Philly was not okay with how things ended Ooh, home of ECW And it's widely regarded as being one of the most vocal crowds And one of the quickest to voice their displeasure for what they don't like You can always count on a Philly crowd to be a major talking point after an event Going into the show, we also knew that The Rock was going to be there He gave it away on social media and what he would end up doing would become clearer in the Rumble match Now onto the match itself It started out with The Miz and R-Truth, which was a nod to their former partnership back in 2011 The number 3 entrant was Bubba Ray Dudley, who returned for the first time in 10 years It was amazing and the fans popped huge for him The Philly crowd cheered the hell out of him, and he did some of his signature spots And loud ECW chants would erupt from the arena He got true to do the- On Miz, and he even told True Teh It was a terrific start for the match, but it would soon take a turn for the worse Luke Harper, Bray Wyatt and Eric Rowan would enter shortly after Where we saw a brief Wyatt family reunion Until Bray Wyatt took control and eliminated both of them As well as each and every other wrestler coming out one by one Including a returning boogeyman To be fair to them, they built it up quite nicely Up until the number 10 entrant Daniel Bryan showed up Who received a thunderous ovation And that was cool Because we know Daniel Bryan, Bray Wyatt, had their thing going on Had their issues the year prior That was cool You see the crowd go crazy I'm getting goosebumps just looking at the footage Because it was such a momentous moment to see him back Doing what he loves It was clear to see who the overwhelming fan favourite was at this point More and more entrants came out and the rumble was actually going pretty well We even got a returning DDP Who received a fantastic reaction from the crowd It was all going well until the fateful moment that Wyatt eliminated Bryan After just over 10 minutes of him being in the match The fans won- That was a travesty only because he was only in there for a few minutes, bro Such a travesty, bro Did Daniel Bryan to be their main eventer? But WWE were not listening They had given the fans their Bryan moment at WrestleMania 30 And they had no intention of giving them another one To add further insult after Bryan was eliminated WWE decided the next entrant would be Goldus With his signature shattered dreams icon on the tron If the fans weren't already riled up That would surely get them Classic rib from WWE there But whoever it was that decided to make this booking decision Made a pretty bad call As it would lead to this rumble being considered as one of the worst in history Not just because Bryan didn't win I'm okay with that But with how early he was eliminated Surely they could have at least kept him in the final four At least to give the fans some hope and keep them hot throughout Surely they would know that the crowd would just completely shit on the rest of the match Which they indeed proceeded to do We would hear boos throughout WWE, I'm sorry man Vince McMahon The writing was on the wall If you didn't want him to win it Which I think that would have been the ultimate thing to do for the fans You could have at least let him last to the final four Maybe the last to the final two Something But granted if Roman was gonna win it anyway Then it would have been nuclear heat So I don't know Things got even worse when Roman Reigns came out as entry number 19 And he was greeted with one of the worst receptions of any Royal Rumble entrant ever The boos just wouldn't stop as each entrant came out There was a small respite in the crowd as the popular Damien Mizdow came into the ring But that didn't last long as he was eliminated by Rusev in just 18 seconds Then after Ryback came out at number 23 Chance of Ran through the arena Probably a tip to CM Punk's tell-all interview with Colt Cabana in late 2014 Where he heavily criticised Ryback for his in-ring work There seemed to be no light at the end of the tunnel Until Dean Ambrose entered at number 25 At least fans had someone in there that they could actually cheer for now In terms of Reigns, WWE's attempts at getting him over through this match was terrible In the 2014 match, they were able to make Reigns look like a badass By having him tear through most of the roster Here? He gets a couple of eliminations then lays down for the rest of it They even had him and Ambrose try to break the record for the quickest elimination ever against Titus O'Neill But they couldn't even get that right There then wasn't much for the crowd to get overly excited about Until the final entrant Dolph Ziggler entered the fray Now this is where things got really bad Instead of pushing the young talent to the top WWE had Kane and The Big Show dominate the entire rest of the match And eliminate the crowd favourites such as Dolph Ziggler and Bray Wyatt The Final Four consisted of Big Show, Kane, Reigns and Ambrose And once Ambrose was eliminated, the crowd well and truly checked out I suppose the idea was to have Big Show and Kane snuff out all the popular acts To leave only Reigns as the only choice left Surely everyone will have to love him then Only that doesn't work at all Because he done absolutely nothing to endear us to him in the match And if you think the fans were pissed when Bryan gets eliminated Wait until you hear their reaction to Roman Reigns battling Big Show and Kane at the end The crowd proceeded to chant Eventually Roman ended up eliminating both men But he didn't even look cool taking them out They take an exact spot from 9 years earlier Also with Kane and The Big Show And replace Triple H with Roman Making him look sneaky instead of powerful As Big Show and Kane attacked Reigns after elimination The crowd began to chant As he hadn't actually been eliminated and was laying on the floor outside the ring Meanwhile, The Rock returned And came down the ramp to save Reigns from the ongoing onslaught from Big Show and Kane But even that wasn't enough to change the fan reaction The crowd legit booed Dwayne The Rock Johnson Because he helped Reigns win the match They would go on to cheer on the final threat Rusev for the very same reason They cheered on Reigns over Batista a year earlier Reigns ultimately won the 2015 Royal Rumble To one of the worst receptions in living memory Even The Rock raising Reigns hand did nothing for the former shield man WWE were forcing The Big Dog on the fans And they did not appreciate it Even the Rock was perplexed She's like yo God damn they don't like you She didn't care for the reactions They established Reigns as a top guy And a baby face to boot Whether anyone liked it or not Honestly the fact that Roman Reigns won the Rumble Wasn't the absolute worst part of the match Although it was certainly a terrible decision And extremely poorly booked The biggest issue was that most of the fan favourites Were thoroughly dominated by the aging and largely unwanted duo Of Kane and The Big Show As a result the match was insanely dull and plodding With most of the talented wrestlers being squashed There were multiple opportunities for WWE To change plans and actually save this match But for whatever reason they chose not to And the result was one of the worst Rumble matches ever Shortly after the event Hashtag Cancel WWE Network became the top Twitter trend worldwide While PwInsider.com reported that the WWE Network online cancellation page had crashed And that some subscribers who would call WWE to cancel their subscription Were told to call back the next day As there were too many people attempting to manually cancel their subscription Later in the month WWE chairman Vince McMahon Responded to hashtag cancel WWE Network in a conference call Saying that the controversy was good for WWE McMahon labelled it as a vocal minority upset that the babyface did not win And Santa Claus didn't come on that pay-per-view But he expected those who complained to continue watching WWE anyway Roman Reigns responded to the backlash by fans saying I don't think I'm headbutting with hardcore fans I feel like they're headbutting me One thing that kind of confuses me is that it's a performance It's a show There is a storyline When people start doing the he deserves this He deserves that Really? Did Brad Pitt deserve to be Achilles in Troy? This eventually led to both Lesnar and Reigns being booed by the fans At the WrestleMania that followed Only for Seth Rollins to save the main event And cash in his Money in the Bank briefcase To the joy of all fans watching So all in all it ended up leading to a pretty solid WrestleMania But if we're talking about the match by itself It surely has to go down as one of the worst Royal Rumble matches in history I'm going to link down his channel Well, the video I'm going to link the original video down below So you guys can go subscribe to him This was very dope, man Very... It brought back memories It brought back some good memories And it brought back some not so great memories, man Who remembers what they were doing when watching this Royal Rumble? Comment down below Let me know Were you guys... Were you part of the people that were saying cancel the WWE Network? Or were you part of the people that was like Indifferent, didn't really care? Or were you part of the people that were okay? That Roman won this Royal Rumble? Comment down below Let me know I want to get your thoughts and opinions For those who remember this when it happened live Also, we will be live streaming the 2022 Royal Rumble On the In the Clutch page this Saturday So make sure you guys check out Don't want to miss that out Don't want to miss out on that But appreciate all the love and support Roll to 70K Appreciate y'all kicking in me See y'all in the next one Peace


Hi, I'm part of the new Hatchimals Collectibles range with super cute collectible Hatchimals and we come in these speckled eggs that you can hatch and collect. I come in a pack like this one with four of my friends that you can hatch. Each family of characters in Hatchetopia has different coloured speckles so you can see which family your collectible belongs to. This means that you can trade the unopened egg with your friends if you already have the whole family. You hatch just like this. See the purple heart here on the egg? Rub it until it turns pink. Now it's ready to hatch. Here comes the exciting part. Press the heart and hatch your new friend. Wow, how adorable! The latest addition to your collection. Look at the glittery wings, just like mine. We all have wings that sparkle. Aren't they just the best? You also get this map. In season one collectibles there are over 70 of my special pals to collect and swap with your friends including exciting special and limited edition characters. The map shows Hatchetopia and you can use it with the checklist to keep track of your collection. Is your new Hatchimal from Giggle Grove, Lilac Lake or limited edition Cloud Cove? Let's see who's inside these eggs. You can use the bottom half of the egg to keep your sweet new Hatchimal in. You can get single packs or if you get the pack of two like this one it also comes with a nest. Oh, too exciting! Perhaps you can use the nest for your favourite ultra rare or even limited edition collectibles. We're all heading over to Crystal Canyon for a fabulous party. Can't wait to see you again soon. Roll your mouse over the screen and click on the top right tank corner for more information.


This band in my head and yours is pretty silent until you attempt something that gets their attention. So if the band in your head is getting louder and louder at the moment, it must be because you have agreed to do something, you have agreed to post something, you have agreed that speaking engagement and so now the band are getting louder and louder because you're now doing something that threatens their position in your mind, that threatens their control of you but it's a compliment really. If you reframe it as ok I'm doing something enough to get their attention, the band in my head feels threatened, maybe that's a good thing, yeah it is.


And today the schedule is we finish a little early compared to the previous two days. So we've been getting good numbers in attendance. So we've had approximately about a dozen or so people in the room here in Seattle and around 80 or so typically online. So we have about 100 people attending and that those numbers have stayed kind of consistent throughout the day or the evening, early morning, depending on where you are. So given the circumstances, I think that's good. And it's been good for people to be able to present the work and the research that they've been doing. So this morning we will actually have a couple of talks on the ARM architecture, one with the memory tagging extensions. And then we'll have a talk on ARM virtualization and how it relates to security. And then after the morning break, we have some more research and this time from Penn State University on bug finding and analysis. And then we have live migration for TDX based confidential VMs. And so that's a topic that has come up a few times during the conference and seems to be hiding up the confidential computing side of things where the customer's workloads typically in the cloud are private to the customer and not known to the operator of the cloud. So it's interesting to see these trends coming. We have a talk on missing CVE fixes. And then finally we'll have James Bottomley and Mike Rubberport giving a talk on secret memory. And that will be an experiment with BBB, which people may be familiar with from Plumber's conference. And this will be an attempt to try and make a more interactive discussion based session, which is something we'll be looking at potentially for future conferences. So with that, I will get the next talk underway at 9.05.


YouTube is a long and hard climb and sometimes we need a little motivation to keep going. I have some from a channel with 3.2 million subscribers giving you advice. Let's roll it from Jesse McNugger Juckets. McJugger Nuggets. Sorry. Roll it! If somebody told me, Jesse, you should put more time into your YouTube channel. And I'd be like, I'm already creatively dedicating myself to it and be like, no, no, you need to treat it as a career because you could be making money off of it.  This is an incredible opportunity that our generation and other generations have been given with YouTube and just this online generation. What Jesse is trying to say is he went from nothing to a channel with 3.2 million subscribers because he never gave up and someone told him, slapped him on the face and said, dude, no, build your channel, upload videos, take it seriously, you can make real money. And now Jesse is full-time YouTuber. He has no worry about income. He makes more money than he can spend, I bet. And if you want to see the full video, click the link down there in the description below. But what are we watching? What is the fastest way to grow on YouTube? Collaboration. And Sealdrop behind me just demonstrated collaboration level one with me, George. Do you want to get featured on the George show just like Sealdrop? Click that I to learn how to. About all the levels of collaboration one through four. And the best way to collaborate is through voice. Here is our Discord server, which is level five collaboration. Today I met some of you. I was in chat. I got to speak to about five of you, Freedom Family, and I will do this more often. So hop into the Discord server. You may find me. We actually have two Discord servers. This is the MGM Discord. How do you find it? Go to www.mgn.tm, the website behind me. Click Forum and then you will see Discord. Click that link and that'll take you to the MGM Discord. Or click the link down there in the description below for both the Freedom Discord server and the MGM Discord server, where MGM is for gamers. On the MGM Discord server, we have Albion Online. Let's say you're playing Albion. How do you invite someone? Click this button right here. That'll give you a link that you can copy to send in-game to whoever you want to invite. I did that today while I was playing Albion. Here's what happened. After I shared the Discord link behind me, he typed it in and he was in the Discord server and we were talking, collaborating, discussing, learning from each other. And that's how you can do it too. Any game you play, if you find someone you want to play with, send them the Discord link and get collaborating. Oh yeah, I'm going to dive into that. Yeah, that's bad. I have a ton of health. So if we walk this way... Yeah, I don't know if we can take that, but see that's like the where you need five, you know? Like you need one person per bat. How do you have a horse? How did you buy it? Like did you get the $30 pack or the Founder's... Oh yeah, I only got the $30 pack. I also met actress 27 behind me. She is Eva from Iceland. She's one of the people who caught me on Discord today and we had a nice voice chat introducing each other. And I was able to help her link her channel with freedom. She wasn't in our CMS and now she is. Welcome to the Freedom Family Eva. How many of you are using Discord? Tell us down there in the comments below your experience with Discord. What do you like? What don't you like? What are your good and bad experiences so we can all grow together as a family? Because that is the spirit of freedom. We all help each other grow together as a family. So click that I, well I guess it's there way, that I to partner with freedom in case you haven't already so we can all grow together as a family. Some of you suggested I do a live version of The George Show. Live stream The George Show. Do you want me to do a live version? Tell me in the comments below. Let's hop into the Albion Online voice chat room and see what's going on. Hey guys, anybody here? Yeah. I am currently filming so be careful what you say. It will probably appear on The George Show. Oh, hello YouTube. Zoustfrags, hello. Hi, I changed my banner banner. Sorry, I had to do it. So Zoust, if you remember, had the channel banner called Banner. That's it. Just the word banner.  How about you send us a link to your channel now and I'll pop it into the browser so we can check out your new banner. And Freedom Family, this is what Discord is all about. Hopping into chat, seeing who's online, getting into conversations saying, hey, who wants to collab with me, offering help if you're a graphic designer and you want to help or asking for designs. This is what working together means, growing today. All right, here we are. Zoustfrags. Ooh, that's a very fancy banner. Is that from a game? Or is that like your in-game character? Yeah, no, that's a GTA character, I believe. Ah, GTA, very sexy. Yeah. And if you like this video, click that like button down there so I know what kind of content you enjoy. And if you like this show, subscribe to Freedom Central, youtube.com slash freedom, where you'll find a ton of videos, including Life in the Philippines, where I currently live. And who am I? I am George Sunpai, Papa George, and many other names you, the beautiful Freedom Family, has given me. I am George, CEO and founder of Freedom. Hope you enjoyed this video. You've been watching. I'm going to buy a bag though, real quick, because players own those and they're taxing you for it. Your house can have shops on it too, but you have to build them. You have to put like the time in if you want. Having a guild hall with like a bunch of stuff on it would be really cool, but I don't have the money right now. So it's going to cost 25,000 just about the island. And then I think it's like 50k to upgrade it the next time. And then like after that, it's like you can actually build shops on it and stuff. And we will grow together as a family because this is the Freedom Family. You are part of it. We are all part of it. And we're all growing together. So grow with us and partner with Freedom. That play now button right there on the video bar is all you need to click to get started.