Hi everyone, Shawn with jaspyscasebreaks.com here doing 2020 Panini Obsidian football 12 box case break pick your team number seven All-card ship incredible stuff looking for case hits like this white contra or the color blast parallels All-card ship it all looks great. So Let's do it. Here is our correct list Last spot mojo Patrick Cologne with the Jaguars There we go, you know Bradley You just watch out my chargers are gonna take it.  I went from hoping for Penaece. Well, it's hoping that we could get Jamar Chase Now just hoping that we don't somehow move out of the top 10 draft picks Come on Why do you want to stay in there? All your friends are out here There we go. Cool. We're gonna do six and six You know, it's funny brand. I didn't listen to any Christmas music at all this year. I It's weird. I Usually drive in my car with like the radio on silent Like not even playing my my phone music or anything like that just radio on silent I mean, it's not like he went to a lot of malls and department stores to shop this year either You know what I mean So I didn't I didn't come to any Christmas music kind of strange like off like nothing Nothing playing just silence Just driving the kinks father Christmas. I'll listen to it Sounds like something I like Why do I need radio on I love not using my radio? Oh, I always have odd it has to be odd number for me, Walter It's either 13 17 or Depending on how loud I want 27 or 31 Odd number all the time Ricky. I just saw your mo your post up above It's not very serial killer ish divisible by five Okay, now you guys are all the weirdos not me No, Ricky. I literally just sit there and just drive It's super peaceful. I love it. Absolutely love it. I think about stuff. That's where I do all my thinking Sometimes okay, so Ricky I used to I Used to just use that time From traveling like from clients to clients and stuff To make sales calls. So I'd like pre-program their phone their numbers and my thing I just call make sales calls the whole time. I was driving from Place to place Neville Gallimore Dallas Cowboys Michael Sclafini, there's Sclafani to 50 La Michael P. Rhine for the New York Jets Adam Cupperman 35 out of 100 Jake Fromm for the Buffalo Bills Joshua Browning No numbering on that Darrington Evans for the Tennessee Titans Cory DeRall 25 out of 100 Aaron Rogers for the Green Bay Packers Jordan Krabat Krebbosch 24 out of one out of 50 Claiborne Cheson Jacksonville Jaguars last spot mojo Patrick Cologne 27 out of 150. I really like his signature Looks good Van Jefferson dual relic and auto for the Rams Matt Bronig 94 out of 150 Travis Kelsey Kansas City Cheese 9th Bond 20 out of 100 Joe Mixon For the Cincinnati Bengals Sean Mattick 21 out of 25 DJ Dallas The Seattle Seahawks Mike Cotey No numbering Joshua Kelly For the Chargers Knight Bond 68 out of 100 Jerry Rice For the 49ers Jose Reyes Perez 14 out of 50 LaMichael Perine For the Jets Adam Cupperman 44 out of 150 Another one for the Jets Denzel Mims nice patch there too 23 out of 50 Jets Adam Cupperman Chad Johnson For the Bengals Sean Mattick 23 out of 50 Andre Johnson For the Houston Texans Jared Morling 67 out of 75 Carson Wentz Eagles Matt Bronig No numbering on that Christian McCaffery Galaxy Gear for the Panthers and Patrick Cologne 86 out of 100 Kyle Duggar For the Patriots Karen Steele Brad. I don't understand what that's what you're saying there It's very confusing. I read that twice still don't understand 15 out of 25 for the Patriots Karen Steele That's awesome Brian Edwards For the Raiders Robert Runkel 99 out of 150. Okay reading that first part without that second part I was like what and Nice patch here Anthony McFarlane Jr. For the Steelers And Joshua Browning 18 out of 25 No, you're good. You're good. Did they have to escort him out? Or get a medical attention AJ Eponesa for the Buffalo Bills Joshua Browning 74 out of 75 Rob Gronkowski for the Buccaneers Karen Steele Oh, that sucks 84 out of 100 Tommy Stevens For the Saints Jimmy Cornwell Troy Aikman for the Dallas Cowboys Michael Sclafani 7 out of 30 We got points 400 points So that'll be randomized at the end of the break to one person any additional points we get will all be combined and randomized Gabriel Davis for the Buffalo Bills Joshua Browning 57 out of 75 That's funny Brad Michael Pittman Jr. Dual Relic and Otto for the Colts Derek Disser 6 out of 150 Marquise Brown for the Baltimore Ravens Joshua Browning 25 out of 50 Patrick Mahomes tunnel vision Kansas City Chiefs Knight Bond 10 out of 35 Dorell Taylor for the Seattle Seahawks Mike Cody Lynn Bowden Jr 11 out of 100 Four of the Raiders Robert Runkle Nice three-color patch for Nick Chubb and the Browns 11 out of 25 Knight Mike Kobe Ross Blacklock For the Houston Texans Jared Morling 45 out of 150. I'm not sure Ricky Two three-color patch on the bottom For the Dolphins and Walter Lutz 16 out of 50 Walter Congrats very nice one there. Yeah, it's solid, huh? And box six Brett Favre For the Green Bay Packers 33 out of 75 I'm not gonna do anything other than just take that card and put it right here for a second Max Crosby for the Raiders Robert Runkle Tri-Effect Aurelic Jalen Régor Philadelphia Eagles Matt Bronig 53 out of 100 Cortland Sutton Lightning Strike Auto for the Denver Broncos Bradley McKissick 80 out of 100 And Alex Heisman For the Pittsburgh Steelers and Joshua Browning One out of 150 Patches on this DeAndre Swift Detroit Lions Collin Adams Three colors on top four colors on the bottom Six out of 10 Arson check the notes in that break. We already put another box in there So there's a secondary video follow up on that So if you go to the uh, if you go to the description of that that video You'll actually have a link to a second one six out of 10 jersey number hit Detroit Lions Collin Adams Joe Montana Colorblasts San Francisco 49ers Jose Reyes Perez That's kind of cool, huh Ricky? Honestly didn't expect to see any veterans on here. I have not looked at the colorblast list. That is super cool Next six boxes guys Um, I couldn't understand what you're saying Ricky I I choose to disagree with you Based on two reasons one the rarity and two For some reason that white background with all that color Oh That stuff just pops I know I you're not it's not unpopular a lot of people honestly think that Ricky But like I've seen them. I've seen both in person now One obviously more than a lot and a lot others, but I don't know what it is man, but that white background just Whatever the hell's going on in that foreground just looks so good The black does look really good. Yes Let's agree that they're both amazing cards Oh, we got one of these vertexes these things are sweet I've only seen two of them and each one's number to 15 And they all are like it's only like incredible players on these two I think that's why I like it though.  You know what I mean? It's colorblast. It's got to be pow in your face This isn't this isn't nice walk on the beach Touch of color This is bam Take that Twice to the face This isn't color fizzle colorblast Good luck everybody Josh Jacobs For the Raiders Robert Runkel 41 out of 50 Gardner Minshew for the Jaguars Patrick Cologne See Brad knows 13 out of 75 AJ Appanessa for the Buffalo Bills Joshua Browning Brian Edwards for the Raiders Robert Runkel 49 out of 75 Tri-Fecta materials Tua Dolphins Walter Lutz Dick Buckkiss For the Bears Jason Styles 3 out of 25 Denzel Mims For the Jets Adam Cupperman 9 out of 99 Jerry Judy For the Denver Broncos Bradley McKissack 42 out of 75 Jonathan Taylor for the Minneapolis Colts Derek Disser 39 out of 100 CJ Henderson for the Jacksonville Jaguars Patrick Cologne Washington Marc Majurt 27 out of 75 We got more points So 800 points now being randomized to one person in the break Brandon Cooks For the Houston Texans Jared Morling 5 out of 50 LaMichael Pirine For the Jets Adam Cupperman 31 out of 50 Mitchell Trabisky for the Chicago Bears Jason Styles 64 out of 100 Tanner Muse For the Raiders Robert Runkel 8 out of 10 K.J. Hamler Denver Broncos Bradley Bradley McKissack No numbering on that Chase Claypool 2 color Relic For the Steelers Joshua Browning 4 out of 25 Joshua Browning 4 out of 25 We do have a redemption Lance Briggs For the Bears Jason Styles 93 out of 100 Dual Relic and Otto Devin Duvernay For the Ravens Joshua Browning 54 out of 150 Let's see who it is We got one guest for CEH Rookie Autos Card 112 C L.Y. CEH Clyde Edwards Iler Kansas City Chiefs That is for Knight Bond There we go Juju Smith Schuster For the Steelers Joshua Browning 25 out of 25 Vitrious Josh Jacobs Raiders Robert Runkel 15 out of 25 Super cool looking die cut Jack Tomorrow I'm doing Tomorrow and Monday Christian Fulton Tennessee Titans Corey DeRall Marlon Mack For the Colts Derek Disser 8 out of 25 Michael Pittman Jr Also for the Colts Derek Disser 2 out of 10 Tonight or Tomorrow Jack Tomorrow I'll start at No later than 2 Tonight it all depends on what's happening over here Laundry Tag Daniel Jones New York Giants Josh Styles We're going to go too big and then just tape Nice signature too 4 out of 5 There you go Giants Josh Styles And Jersey and Otto Darrington Evans For the Titans and Corey DeRall 93 out of 150 Tua Tagavilo For the Dolphins Walter Lutz 59 out of 75 Nice Tua there Joe Reed For the Chargers Knight Bond 77 out of 100 Linda Nucci Michael Spliffani No numbering on that And Keyshawn Vaughn For the Buccaneers Karen Steele 66 out of 75 Henry Ruggs For the Raiders Robert Runkle 11 out of 100 Jersey Numbers 11 John Lynch For the Broncos 32 out of 50 And 3 color patch on top 2 colors on the bottom T. Higgins For the Cincinnati Bengals 3 out of 50 Sean Mattick Jimmy Garoppolo For the 49ers Jose Reyes Perez 14 out of 100 Andre Johnson Houston Texans Jared Moerling Tri-Fecta Jalen Régor For the Philadelphia Eagles 42 out of 75 Matt Bronning AJ Epeneza For the Buffalo Vils Joshua Browning 121 out of 150 C. D. Lamb Jersey and Otto Dallas Cowboys Michael Spliffani 16 out of 150 2 color patch on top Solid on the bottom Jonathan Taylor For the Colts Derek Disser 10 out of 10 Nice low numbered ones Tom Brady Tampa Bay Buccaneers Karen Steele There you go Very nice And that's it Let's give away these 800 points No, David There was a Joe Montana as well Cool. So we're going to give away 800 points to one person in the break Good luck So here is the List of teams I'm going to post this here Washington back up to Arizona Dice Roll team on top after 6 out of 5 11 times gets those points 11th and final time Congratulations to the Detroit Lions And Colin Adams You got yourself those 800 points Along with that Very nice Who was it What can I think of his name right now? Deandre Swift Patch Auto out of 10 There you go Nice going to the Detroit Lions There you go Congrats And that's our break That was 2020 Panini Obsidian Football 12 box case break Pick your team number 7 from jaspyscasebreaks.com I'm Sean jaspyscasebreaks.com Thanks for hanging out and we'll see you next time


In the past years, we've seen a lot of talks about how to act devices that allow us to authorize access to a building. We've seen lockpicking, we've seen how to break into RFID doors, but we haven't seen how to break into intercom devices. And Sebastian here today will tell us more about that. He's a security researcher and he's really interested into radio. So give him a big round of applause. Thank you very much. And thank you for taking this presentation. So we talk about intercom hacking, but let's start about me. I'm working for the Sinective company. I'm interested in radio communication systems like Wi-Fi, RFID, GSM, PSE and so on. At Sinective, we're doing a radio test. A radio test includes spearfishing, remote and physical intrusion. And speaking about physical intrusion, why we introduce it into a building? It's to plug the malicious device or to dump computer memory, or also to let malicious USB keys into the building to be less suspicious. But the main problem when we want to enter to a building is we always need a way to enter to this building. So how to do that? We know lockpicking tricks, we know RF attacks, we know social engineering, can be also helpful. But what about how intercoms? Rating tests with these precedent tricks work sometimes, but sometimes we get spotted. Intercoms could be very interesting because if we want to not be spotted every time and want to enter to a building at night, what we want is to enter to a building like a ninja. So we can maybe hack this kind of system to enter to this building. Also, intercoms can be used to spy on conversation in the street. We see that we can make money out of it. It's a bit strange, but you see it's very firm. And also have a lot of fun with this kind of device. Also, I should warn you that this talk is applied on practical attacks on intercoms. It also includes other devices which use the same system, the same techniques as new intercoms use today. So intercoms today provides a lot of features. You have passcode, RF tag access, you can also call a resident to open the door. But nowadays we can see that a resident can be called on his mobile phone. And when he is called on his mobile phone, the intercom is using a mobile prefix to call the resident. That means that the intercom is using the mobile network to call the resident. So by curiosity, we were asking about would it be possible to play with this kind of device? So we tried to directly call the intercom, but nothing happened. After that, I thought about maybe we can dump and modify the flash, but just imagine that we have to do it in front of others in the street. It's not ninja things. Or we can use mobile attacks because the intercom is using the mobile network. And so I will present now the intercom. The intercom do for awesome to call it as you want. It's a voice communication device within a building. The term numeric refers to intercom that use the mobile network for our case. So they use a sim and a sim card. And it allows to call a resident to open the door. And different types of intercom exist. You have convolutional, simplified numeric. The main difference, just look at the right, is that the numeric don't need a wire for each resident. The main difference is that it only use two wires for power, two hours for the dual system. After that, no wires for each resident. That's why they are used because it avoids complicates and cables. And wires can be replaced by GSM 3G 4G or Wi-Fi. For our case, we will only focus on the GSM 3G and 4G. The simplified architecture of the numeric intercom. There are two. This is the first. The first, as you can see in this architecture, the intercom is connected to the mobile network through the BTS. And if a visitor want to open the door, he call the resident using the intercom. The intercom call the resident on his phone. After that, the resident answer to the call and open the door and the visitor can enter. Another architecture is quite similar to the precedent. The only difference is that if we want to manage the intercom, we use a centralized server. Because in the previous case, if the resident want to manage the intercom, he only use his phone, send a command and send a command to modify or add a resident to the intercom. But here, in that architecture, the one administrator can use a website, for example, to add or manage the intercom. So that's the main difference with the simple intercom and the intercom that use the M2M matching-to-matching architecture. In France, we have five brands that are very well known. It's like Comelit, Infratour, NoirC and Hermet Captive. They cost a lot of money. It begins with €2,000 and after that, more buttons you can ship, more it costs. For our first case, we choose the Lincoln IDP GSM, which is also commonly used in private residence in Paris. So we will focus just in the first time we will focus at Lincoln. But after that, during this presentation, we will also focus on the 3G intercom, which is used in a lot of buildings today. So, also, I talked about the numeric intercom, but how to recognize it? Maybe a spot in your nice LCD screen or new steel case, but sometimes you can get very lucky and see that there is a 3G module, which is sometimes outdoor or indoor. And this 3G module has like three or four LEDs indicating the quality of the reception of the mobile network. So with that thing, we can see that it's maybe using the mobile network and it's likely a good to know because maybe we can do some attacks on it. Also, why I'm doing this presentation? Because mainly publication about intercom are nearly non-existent, but as we know, they use the mobile network to communicate with the residents and to allow the residents to open the door. So that's why we can, for example, use the previous publication on the GSM 3G and 4G. And also, the tools that are very affordable today, for example, the Blade RF that costs only €370, and the software is free. You can get open BTS for free and start your own rock-based station, as you probably know. So with that tools, we are about to build our rock-based station, our GSM and GPRS rock-based station. And the interesting fact is that GSM and GPRS, you have a weakness. The weakness, as you probably know, is because there is no mutual classification between the mobile and the network, the mobile network. So only the network is aware about if the mobile phone is legit or not. But the mobile phone is not about to check if the mobile network is a legit one or a rock-based station. Also another good thing is the end-over for an attacker, because stronger the signal is with the rock-based station, and much likely we are able to trap the mobile, the intercom, into our base station. So for an example, if the mobile phone is always looking for the strongest signal, so if the mobile phone sees that one base station is sending a stronger signal than the older one, it goes directly to the new base station. So to summarize, there is no mutual classification in GSM and GPRS. We can also use a lot of attacks on FA1, etc. The signal in China is not encrypted, so interception is possible in GSM and GPRS. But to overcome that, 3G and 4G are more secure because they use mutual classification, they use signal activity, they use a better encryption. So if I'm doing a rock-based station in GPRS and GPRS, or if I want to run, sorry, a rock-based station in 3G or 4G, if the intercom is using the 3G or 4G, I'm screwed because the mobile phone will try to do the metro-artification and we'll see that my rock-based station is not a legit one. But to overcome to this program, we can use downgrade attacks. To do that, we can see if we can perform some protocol attacks, but it's very difficult because we have always to... The protocol attacks are sometimes only focused on one specific base bound and one specific version, and it takes a lot of time. So in general, if we don't know the base bound, the base bound version and so on, the better way is to do jamming attacks. And jamming attack is very simple because it's just a simple Gaussian noise in targeted channels. For example, at the left, we can see that there is a GSM channel, the beginning of a GSM channel that mobile phone is supposed to see. And after the jamming, we see that this channel is flooded by a random Gaussian noise. And that means that the mobile phone doesn't see any more the channel. That means that it cannot reach it. If, for example, this channel is a 3G channel and it's the only one, the mobile phone is supposed to fall back to 2G in a dog-grade attack. And in intercoms, it's likely to be like for mobile phones because we found in a public documentation that if the 3G network is not reachable, the intercom will use the 2G instead. So it's good for us because if we perform a dog-grade attack from 3G to 2G and emulate, create a rugby station with a very strong signal, we are likely to trap the targeted intercom. To jam a 2G channel, we can, for example, buy a jammer in internet. You have a lot of Chinese jammer you can find on eBay and Alibaba and so on. You can, after that, disable the 2G to allow your rugby station to transmit signal. Or you can use some tricks like I do, is to enumerate the list of URFCN close to the interceptor. After that, you translate these URFCN into centrifugal lenses and sends Gaussian noise into each detected channel. But if you want to enumerate URFCN, people in GSM, for example, for IFCN, use the Osmocon BB, for example. But Osmocon BB, for that case, because it's 3G, for example, cannot work because Osmocon BB only works for GSM. So to do that, you can use a solution. You can use, for example, another waveform that has X-Gold based on and use the provided jack interface, which is exposed. And use the X-Goldmon tool to, after that, capture all the messages and capture the RFC messages to get the URFCN, which means the download the URFCN, the index, which is used for downloading. In that way, if you use that URFCN and Fluid with Jam, this channel, the mobile phone will not see the channel anymore. For other basements, like Qualcomm, you have sometimes other interfaces. But if you have a very new device like Samsung, Samsung have an universal method to get a list of URFCN. And to do that, you use the service mode with a special code for Samsung, for your Samsung version. And with that, you can see in LogCats that the URFCN are present in LogCats, like typing with ADB, the common LogCats. You can see that when you are in the service mode and when you're trying to register to an operator, you'll see all the URFCN that the mobile phone tried to reach. And with that, you get the list of URFCN, and you are able, after that, to know which channel you want to jam exactly. And to do that, let's see a little demo with a simple hackereff. So, up. It's not that. Okay, so I don't know if anybody can see, but here I'm calling the answer machine. And at the top, on the right, you see a 3G icon, which means that I'm calling it 3G. And there is my hackereff. And with this hackereff, I used a new radio schema to send Gaussian noise. So the hackereff now is trying to send Gaussian, random Gaussian noise to some targeted channels, 3G targeted channels. And as you can see, the icon, the 3G icon disappeared. So that means that now, when I'm calling, I'm calling 2G. And as it's possible to do that, I can come with a rugby station with a stronger signal. And the mobile phone will end over to my rugby station. So, now let's set up our lab. Our lab consists of a bladeereff, yet BTS software. And what I want is to trap the intercom into that rugby station. And it only costs 400 Rio with all the antennas and so on. Also, let's set up our intercom using the best documentation and all suggestions about the security. And we can see that there are three ways to configure intercom. Like programming the interface with the manager, with the SIM card reader and programmer, or with SMS messages. So that means that maybe if we know the number to contact, maybe it's possible to send commands to edit, to modify, or add a resident number. But after that, in the documentation, it's precise that if we want to administrate the intercom with SMSes, the first admin one number has to be set up. So, our first impression is that if we want to send commands to the intercom, we have to impersonate the number or find a way to bypass it. Or after that, when we can impersonate the number, we can open the doors and command and so on. And a good indicator when you send commands to the intercom is that you have an acknowledgement. Like, for example, if you want to write or update the number of the resident one with the command write, and the number of the resident two to associate with, you get an acknowledgement like write, that means that the command was successful and you were able to modify or update, or add a number. So, our first hypothesis, let's do some hypothesis. We don't know the mobile operator. We don't know the intercom's number. The commands, for instance, can be found in public documentation or a documentation or performing a firmware analysis on it. So, as an attacker, our steps are to recognize the intercom operator to trap it, leak our guest number to impersonate, reduce our phone as the leak at the resident number, call ourselves and open the door. And to trap the intercom, we can brute-force the four, for example, in France, the four MCCMNC. It takes like five minutes each with a strong signal. And by pushing the button in the intercom, if we see that the call was intercepted, it is a success. So, when activating the GSM taping in YETBTS and seeing the message in Wireshark, we can see when pushing the button, when after trapping the intercom, that's a call setup message was sent. And in this call setup message, you see a field that contains the number of the resident. You were trained to call.  And after that, you are able to open the door. What's next? If you are able to leak the admin number, you can, for example, if you can send a comment, but if you cannot, you can try to find other way, like trigger an alarm or maybe do some social engineering tricks. But if you are able to find the admin number and impersonate him, you can send comments like read, write, call 80. And two comments are very interesting because one is for updating. We already saw this comment, but the other comment is call 80. And why it's interesting? Because call 80 interacts directly with the basement. So we can, for example, try to retrieve SMS messages, but I try that with the link on the IDP. I get one SMS and after that the intercom was completely not working. So it was a little bit strange. But it works like a leader. You can also spy on building new conversation sending an ATS0-1 number, that means the auto-answer feature, which is used for, for example, if I'm enabling this feature, if I'm calling the intercom, I'm able to, the intercom will ring just once. And after that, I'm able to listen to the conversation of what happened around the intercom and so on. So there's plenty of fun features in 80. And let's do some demo right now after trapping the intercom. Okay, so as you can see, there is my GSM lab here. We will receive the intercom. We see also here the attacker's phone. And here's the Blade RF. So what I'm doing here, I'm trapping the intercom. After that, I'm able to intercept all the communications so I'm pushing the button of the resident one exactly. And with Wayo Shack, I'm just reaching for the call setup message, which contains the resident number I want to leak. And with that, what I'm doing, I will associate my SIM card, the SIM card of the attacker's phone with that leakage number, with this small Python script. The Python script is communicating in Ternet with YET-BTS to also refresh YET-BTS configuration after the modification in the configuration. And after that, when I'm pushing the button, the intercom will try now not to join the legit resident, but the attacker's phone. And since we just have one number, let's suppose it's the admin number, I'm about to send commands, send call AT command and so on. But also, if I have an admin number, if I can impersonate a number, we can replace the number with a primary rate number like HelloPass, Optello and so on. So it could be an interesting thing if we want to earn money. Now, let's do some attacks with intercoms using the M2M. Intercom using M2M architecture are using CheapIt's SIM cards that are legit, that have more than 10-year subscription. So the mobile network, the mobile operator, for example, T-Mobile or Orange or so on, for the manufacturer provides a virtual network to manage the intercoms. That means that there's these intercoms connected all together in a virtual network. Also, this intercom uses the UMTS to be reachable. So we know that this intercom is managed by a server, so that means that it introduces new vectors of attack. We saw already the 3G downgrade and GSM interception, but it introduces also the vulnerability that can be found while using the SIM card to try that with the intercom, but also the vulnerabilities in services like web, Skype services and so on. So let's talk now about website vulnerabilities. In website vulnerability, we have to know that websites, the centralized server is used to manage not just one, but multiple intercoms that are connected in the network, in the virtual network. And because it's web, some vulnerabilities can be found. And we can find lots of Accum-Gasin plus brute force, authentication bypasses, SQL injections, LFI and so on. So we tried with one product, one very used product in Paris. It's a 3G intercom that is provided with an M2MC card. And let's call it also product A, because I don't know if all the things are fixed also. But the first vulnerability was the authentication, no, sorry, the identification. Because product A website doesn't enforce a password to manage the intercom. That means that if I know the number of the intercom, I can manage it with that website. But also we have to know a valid number. It's not a problem because if we try to do some animation with a very dirty script, we were able to animate 90 numbers in less than three hours on a specific prefix. And with that, we are able to manage not just one, but multiple intercom, and with that we can earn more money than a simple intercom, for example. So that means that we can change to premium rates, numbers for all intercom, and after that, get rich. Also, we can also open the door, but to open the door, we have to know the location. To know the location, it may be hard or easy, depends if in general, if people add their own number first or in the list. And with that number, you can use a reverse lookup directory and get the address and after that go to the address and open the door and after that do what you want, plug your major device and so on. Okay. We saw that. Now speak about the virtual network as a second attack vector. We said if we use the SIM card or use SIM card, we are able to to reach the virtual network which is provided by the operator. But in project A, use SIM card protected by pin codes. But pin codes, you know, if you have a SIM trace, it's not very good medication because you can use a SIM trace as a proxy between the SIM card and the intercom, and after that catch the pin which is typed by the intercom with thanks to the SIM trace. Get the pin code and after that use the SIM card into your phone. Optionally, change your IMAI. Set up the right APN. So APN also are documented for operators. If you use, for example, if the operator is orange, you can document yourself. Use the APN which is provided by orange and after that have a free internet connection. But if you want to find vulnerabilities in the virtual network which is provided for the intercom, you can also do some gassing and sometimes manufacturers use their name on the APN. So you can guess with that. It's a bit easy. But also if you enable the GPS feature and trap the intercom in your rugby station, you see that the intercom will try to join a specific APN at one time. So you can also do that tricks to have all the APN. After that, you tether the communication, use your computer, do some trust routes. After that you can see what is on the network, scan the virtual network, search for a vulnerable device, then exploit the device, hack the planet and so on. Also we were interesting about the SIP as an attack surface because we know that Project A has a mobile application to provide video calls. But video calls to use that application we have to pay. We don't want to pay because we already pay for the intercom. So we try to analyze this application and we found some very bad new SSL checks. That's cool. The most interesting thing is that the SIP credential are called in the application. So if we use, for example, this credential, maybe we can connect to the SIP server and maybe try to call someone over intercom. First thing, we register this credential, we register to the SIP server, but badly the results are not satisfying because we only are able to contact the simple user, like user or root, but it's impossible for us to reach an extension or an external extension or an internal extension. We don't know why, maybe because the number needs to be reached as a premium extension. It's a kind of mystery. Maybe we have to take the premium option to have some more information on that, but I have a question for you and you can answer after that. If someone knows if it's possible to find a valid extension without having to flute in SIP with invite request, it'd be very interesting for me because I'm trying to if it's possible I'd be very interested. Okay. So, now the part of our recommendation. So, with M2M network, enforce a pin code and SIM card, like product A, white list in my AIS, audit and pet test regularly, the management website and the restrict action and request on APNs, firewall the virtual network and do some segmentation, audit and test the virtual network against network attacks, monitor and also block using card that have suspicion behavior, which is not the case with product A because I was able to have a free internet access, I was able to scan to do some NMAP, so for me it's a little suspicious behavior because in this networks, we just have to call someone or maybe send commands to the intercom. So, as a conclusion with JCM intercom who can open a door, corporate number, spy on conversation, the intercom use the same flow as mobile phone have. Overdevice also are affected by this kind of attack, not only the mobile, that's why I was saying before. And M2M intercom introduced new attack of vector because they expose a lot of services. And also in this subject, there is a lot of things to do and we have also further works, like find a solution for the site vector problem. We have also to start attacking intercom basements because it's also interesting and interesting subject. And also reduce our lab to with a small device or another alternative. But for me at the moment, we have a lot of work also to do on that subject. So, thank you for your attention and if you have any question please ask. The English one. So, just line up in front of the microphones in the meantime for those of you who are leaving, there was a battle concert all over the talk. If you could just take your trash with you when you leave or if you don't have trash, just pick the one that's next to you please. In the meantime, please go. Regarding the attack vector of downgrading the connectivity of the intercom, you tried with the various radio attacks. Have you considered just using a plane attack like covering the intercom in the metal box to block all communications except your mobile? It's possible also to cover it with a metal, like a sugar metal cover. But what we wanted to do is also to use the state of the art attacks to do that with Jamie for example. But it is possible to use metal box to block the radio? It could be possible, but I don't know exactly how to say that sorry. The material? How thick it is? How thick the box has to be to isolate the intercom from the network. I don't know if it's possible to do stuff. Please leave quietly. I'm interested in the downgrade attack of UMTS because I was under the impression that the UMTS uses CDMA which should be pretty hard to jam with just using random noise. So my question is if you use any kind of special magic there? There's no special magic. If you're all the RFCN, with that list, I have the central frequency I want to jam. And what I did with the RQF is to, with that list, I jam like not rudently but following the list. And for some seconds on each RFCN. But also it's out if you have a large list of RFCN. In that case I had only 4 RFCN to jam. But with that list it's possible but if the list is very large, I admit that it would be very hard to jam. So I wanted to ask whether the picture of an intercom in one of the web management interests you had, was it a picture of a product A? Yeah. It was the picture of a product A. Thank you. There is one from the internet which is the guy over there. Hello? Okay. The internet wants to know if when you did sip attack or enumeration can you repeat? When you did the sip enumeration did you consider using options or register or other sip methods? No. Do you need two SDRs in order to have one jamming and the other one acting as a base station or would you be able to deal with say one blade RF? One blade RF is not enough because if you want a stable rugby station you don't want the blade RF to do that completely. So to do jamming attack I use the AKRF to do that. Cool. Okay. Thank you. Thank you very much.


Hi, I'm API. Hi, I'm API. I brought you by DigiKey, an age of fruit. Every single week we have something cool that's new this week from BeagleBoard.org, the open source hardware provider, one of your favorite small board computers. I think it's one of the only true open source hardware single board computers, which I give them a lot of credit for. We'll talk about that. They have a board that just got released this week. So it's perfect timing, because this is not a DigiKey. Beacon of. It is the Beagle Fire 5, or Beagle 5 Fire. Sorry. This is fire. It's fire. This is fire. And it's called that because it features a polar fire processor. So it looks a lot like the Beagle Bone Black, if you guys remember that. And they also have the Beagle Bone Green, multiple versions, and the Beagle 5 ahead. This is the new Fire, which comes with lots of hardware accessories, the same pinout compatibility works with accessories that have already been created for the Beagle Bone Black and Green, but it has a new processor core. Let's just look at the back real fast. It's got this new Sizzigizi connector, which is kind of neat, micro SD, and lots of passive components. The top is what the exciting part is, because it is featuring a polar fire SOC FPGA from Microchip. And that's where the fire comes from. The five is because it has Wisk 5 core, and the fire is from Polar Fire. So what it's got on the inside is a core. And this is interesting, is I thought it was like, oh, there's a processor, and there's a separate FPGA. But it's actually like a, yes, it's a FPGA slash processor, but it's combined, actually, it's in one chip. It's from the Polar Fire family, which I will admit I should have written down the exact part number. It's in the text that goes with this video, I don't recall it. But the Polar Fire family. And inside are five processor cores, four of which are fast enough to run Linux. And one of them is like a monitor core. So like it's a lower power micro controller core that could probably be used for monitoring the system and doing a low power sleep mode type stuff when you want to shut down the main core. And this is very interesting because originally the Beaglebone was ARM Cortex A8s and family, and now they're moving more to risk five. And as we know, risk architecture is going to change everything. Yeah, risk is good. Risk is good. So the risk five core processors inside, like I said, it's a quad core. It's based on the risk five specifications. So it does not have an ARM core instead. And this is not implemented on the FPGA, these are actually separate and on the same die or whatever on the same package as the FPGA. But you're not emulating the risk five. The risk five is like there, it's in ROM silicon, whatever, it's not emulated and are implemented within the FPGA and it follows specifications and it's a core that they have even ported Linux to. So it does like most Beaglebones boot into Linux Ubuntu. And it's interesting because a lot of people are, as I mentioned, ARM has been looking to maybe update their pricing for core or device, you know, royalties. You're interested in designing, you know, custom silicon. Normally you would go straight to either an 8051 or you'd go to ARM. But now there's kind of like, you know, a third party is entered the chat, risk five. And this chip would mean an interesting way for folks who want to take advantage of using the open and unlicensed risk five architecture but also want to create additional hardware interfaces that may not require you to necessarily come up with your own silicon, right? You get the benefit of custom fast hardware interfacing without the silicon because the risk five core parts take care of for you and you do the FPGA part for the extra and at no point do you pay ARM anything which is, you know, a nice benefit. All right, so this is the part number. It's the NPF S025T. So this is, you know, the polar fire core that again is the, it's the system on chip slash FPGA that is the heart and runs Linux on the Beagle Fire. It's got the hard CPU and the FPGA addition. The FPGA fabric, you know, I've got the specs down here, 23,000 logic elements, four input LUTs, 68 math blocks, 2.7 gigabit per second, serdes lanes. And separately, if you see the microprocessor sub system, there's also one 64 bit, WISC 564 iMac monitor boot core and four WISC 4, WISC 5 GC application cores. And that's what's running your operating system and talks to the FPGA.  It's more specifications. So the core has, you know, it has onboard memory, which I thought was, sorry, this is the specs for the Beagle 5 itself. So in addition to that FPGA SOC core, which has your microcontroller, where your microprocessor and your FPGA, it also has, you saw, SDIO slot, quad SPI has, NV RAM, which I think you could probably use for storing like, you know, FPGA configuration. So it looks like EEPROM NVM, maybe SRAM NVM. It's got two gigabyte of LPDDR4 memory, 16 gigabyte of onboard MMC. So, you know, you want to use the SD card, but you don't have to. You can boot directly from the built-in MMC memory and SPI flash, I bet the SPI flash is for the FPGA configuration. And all the hardware that is, you know, standard, I mean, they've packed a lot more hardware than usual. You know, now comes with M.2 key. So you can do PCIe, SDIO, has a CSI connector, has Ethernet, gigabit, USB-C high speed, and of course the, it has tag connect for JTAG debugging. And it has those like two by 20 headers for connecting capes and other accessories that would be designed for the Beaglebomb. I put this here just because it's like, you know, a lot of details about the PolarFire SoC. I've never worked with one of these processors, but I think, you know, I think what's interesting here is you get the benefit of, you know, if you don't want to, you want FPGA for, you know, hardware interfacing, you want to drive specialty machinery, robotics, motor controllers, LED displays, you know, TFTs, whatever, you do that on the FPGA side, but you're the part that you don't have to worry about the Linux kernel, device drivers, memory management, that's in hardware and taking care of for you, but you have a very tight connection between the two because they're on the same chip package. The chip itself is 75 bucks. So if you're just buying this just as a dev board for the PolarFire, it's actually a pretty good deal because you get, you know, the whole thing 450 and you get all those other accessories and it's fully assembled and tested. Compared to most FPGA dev boards, this is a really good deal. Most FPGA dev boards are like in the couple $100 range. This one has everything, and like I said, you turn it on and it really boots into Ubuntu. Quite nice. All the accessories built in, one nice thing I noticed that they have screw terminal power, because that can be nice for industrial applications and robotics. They do have a JTAG tag connect. They've got the Cape header, built in memory, built in flash, camera connectivity. The PCIe camera and Cape headers do go through the FPGA. So that's where you would, if you were gonna program that hardware interfacing, that's where they would come into. LEDs on off button, built-in Ethernet driver that's kind of handy. Notice that there's no Wi-Fi or wireless, but I think what they're expecting is people would use this with, if you're using one gig of Ethernet, you need high data transfer bandwidth. And so you wouldn't necessarily use Wi-Fi. On the back, this is a gizzy connector. It's interesting. I was like, is this a standard? It's something they came up with, but it's basically like you have M.2. This is like another M.2-like thing where you have a bunch of fast lanes. If you need to connect to some hardware that requires very fast differential signaling. And as I mentioned, one of the nice things is because it's the same size as the Beagle-Bone Black, you can use stuff like our case, which is in stock at Digi-Key. Thank you, Jason Kredner, who mentioned this at their event. They just used our case, which has a nice clear top and pops the Beagle Fire in and it fits just fine because it's exactly the same physical layout as it was before. And it does have CAPE compatibility. So you can plug in existing hardware that you've designed for previous versions of the Beagle-Bone and I think we still stock our prototyping CAPE, so you can use that as well. For talking to the FPGA, so obviously, the WISC-5 part, you put the Linux image, you burn it in over USB or whatever, or you have it on SD card, you're good to go. But if you want to program the FPGA, you're gonna have to use Libero. It looks like a lot of people wanna use Yo-Yo Assist, but it's not available. Again, I don't know a ton about the different open-source tool chains, but they do provide tool chain and it looks like when you register the device with Libero, you enter the MAC address for the Beagle-Bored Fire and you get a floating license. So you don't have to, I don't not believe you have to pay for a separate IDE for the FPGA. And they're providing the gateway that will interface with, you know, MPCSI, so they have like the basics to get you communicating over that, as well as M.2. So, you know, when you're doing the FPGA, you're like, what is the hardware I'm interfacing with? Those are your hardware interfaces for the custom FPGA work that you might wanna do. And like I said, this is one of the few truly open-source hardware single-board computers. The files are up on their own Git repository, not in GitHub, they have their own private Git repo. They've posted the files, I love Schemax are there, the board files are there, Gerbers are there, you could run your own board if you wanna do. Available on DigiKey. Yes, you're actually in stock as of like today. So I wasn't gonna feature, I was gonna feature something else. Last minute, these came into stock. So check it out, you can pick one of these up. I think, you know, for the price, if you want to do Polify development and you want to have, again, the stability of having a well maintained Linux distribution of onto and then you have your robotics platform running on top of it, this is definitely going to be well, way more well integrated than taking a single board computer buying a separate FPGA and then like trying to merge them together. Like, yeah. If you're the type of person who likes buying dev boards, like to experimenting, please buy one of these and I'll tell you why. This is the most important thing I think. What? Beaglebone.org continues to do open-source hardware. Not everybody does, they do, they do a really good job and this is, you could say it, you could say you like it, you could say all those things by a board and... They're over the very, very few. I don't believe there's any other... And, you know, their origins came from Texas Instruments. This is really cool. So pick one up. That's this week's IonMPI. Hi, IonMPI.


The governorship candidate of the PDP in Tarabah State, Agbo Kifas, says its aspiration to become the number one citizen of the state is not for personal enrichment but to save the people of the state from calamity. On the other hand, the APC insists it has a candidate for the governorship election despite a court induction restraining INEC from recognizing the party's candidate. Take a listen. For the first time since the primary election of the PDP that produced retired Colonel Agbo Kifas as its flag bearer for the coming governorship election, the party and its candidates are here in Wukari, southern zone of the state with members from the north and central zones of the state to whom all supporters. The first spot of call is the residence of the new Akuka, the traditional ruler of Kuala Lumpur Empire, to seek its royal blessings. As the candidate says, his aspiration to become the number one citizen of the state in 2023 is not for personal enrichment. People have seen what is going to deliver them and because of the trust and the confidence that they have in me, that's what they took out in their numbers. I was touched, I was touched because right from Jalingo, I wanted to just come in quietly. The people in the northern part of the state and the central part insisted and they must follow me. I just felt that few of these follow but what I saw was beyond my expectation. The APC on the other hand, led by its governorship candidate, Senator Emmanuel Bacha, picked his campaign director, General Ilia Kurem as running mate. At an event to unveil him in Jalingo, the state capital, the deputy governorship candidate says his election has led to rest all speculations that Taraba APC has no governorship candidates. I want to say my coming today has dusted all speculations for the doubting Thomasis who still feel that APC has no flag bearer, who still feel that anybody will still come in. It is now done and dusted. Meanwhile, the support group of the Labour Party in Taraba state is appealing to its members to embark on an aggressive mobilization to ensure victory for the party in the general elections. What you can see here presently, this is major powerful outreach on the issue, on the nature, on how to make use of your voter's card and PVC in the proper dimensions. At the 5000 supporters' march in solidarity for the candidature of Mr Peter Obe in Wukari local government area, supporters urged eligible voters to vote wisely. The people of Wukari and Taraba state entirely, they are in support of Peter Obe and come shine, come reign 2023. They are going to stand in unity to vote Peter Obe. As the 2023 general elections draw nearer, residents of the southern zone of Taraba state appear divided on which of the political candidates to vote for. As candidates from the ruling PDP in the state and strongest opposition APC come from same zone. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Attention, Goldsmith residents. This is a community notification of a new sexually violent predator in your area. Please stay tuned to the following short program for more information. Hi, I'm Technician Ron Hackett with the Denver Police Department. The Sex Offender Registration and Compliance Unit at DPD is responsible for the registration, monitoring and tracking of all registered sex offenders and sexually violent predators who live in the city and county of Denver. Here's a brief history of sex offender legislation in Colorado. Our state laws trickle down from federal government mandates. In 1994, we had the Jacob Wetterling Act, which mandated that states would establish a sex offender list. Megan's law of 1996 said that the public would have access to those sex offender registration lists. The Pam Litchner Act of 1996 stated that some offenders might have to have lifetime registrations. And the Adam Walsh Act of 2006 unified sex offender laws across the country. In Colorado, the legislature has determined that sexually violent predators, by definition, pose a higher risk to the community at large and therefore mandated that upon their release from the Department of Corrections, the community must be notified. Sex offender notification in Colorado happens in two ways. The first is passive and ongoing through the sex offender registration process, which is a list maintained by local police departments. The second way is active via community notification for those offenders determined to be sexually violent predators by the courts or by the parole board. Most sex offenders in Colorado are supervised by the criminal justice system in our communities. Most sex offenders engage in crossover behavior, which means they may have been arrested for one type of crime, but be apt to commit another.  There is no typical sex offender, but all tend to be deceptive, manipulative, and secretive. 80 to 93 percent of sex offenses are committed by someone known to the victim. Sexual deviancy begins in mid to late adolescence. Sex offenses are not impulsive.  The community has a vested interest in helping offenders to be successfully managed in the community. Sex offenders have the same need for housing and employment as any other citizen. Any citizen who uses sex offender information to harass, threaten, or intimidate an offender will be subject to criminal prosecution. There are approximately 16,500 registered sex offenders in the state of Colorado. About 65 percent of convicted sex offenders are placed in the community on probation. The remainder are in the Department of Corrections or Community Corrections. Offenders may be caught for one type of offense, but be at a high risk to commit another type. Crime of conviction is only one indicator of risk.  The offender's residence must be verified quarterly by the Denver Police Department. The full Sex Offender Registration List is available by calling the Denver Police Department Identification Bureau at<PHONE_NUMBER>. Convicted felons and those with multiple convictions are posted online at denvergov.org-police.   Now, here's a look at the newest sexually violent predator living in Denver. Here's an overview of the registered sex offenders currently living in Denver. There are 2,579 total living within city limits. In Denver Police District 3, there are 316. Precinct 323 has 59 registered sex offenders. Of those, 38 have felony convictions and 21 have misdemeanor convictions. Charles Joseph Stout is a sexually violent predator currently living in Denver. He's 50 years old and was born on June 4, 1971. He's a white male 5 feet 10 inches tall, 165 pounds with brown hair and blue eyes. He's currently living at 2375 South Linden Court number 211 in the Goldsmith neighborhood of Denver. Schools located within one mile of this offender include Rocky Mountain School of Expeditionary Learning at 1700 South Holly Street, Highline Academy at 2170 South Dalia Street, Holly Hills Elementary at 6161 East Cornell Avenue, Rocky Mountain Prep Creek site at 7808 Cherry Creek South Drive. Parks located within one mile of this offender include Ashgrove Park, Quebec and Wesley Park, Cook Park, Highline Canal, Colorado to Parker, Bible Park. Recreation centers located within one mile of this offender include Cook Park Rec Center at 7100 Cherry Creek South Drive. Bus routes located within one mile of this offender include Route 65, South Monaco Parkway and Isle of Avenue, South Monaco Parkway and Baker Place. Route 21, East Evans Avenue and South Layden Street. A brief history of charges against this offender. Sexual assault on a child, position of trust, victim under 15. He's currently on parole and registered with the Denver Police Department on September 28, 2021 to 2375 South Linden Court number 211 in the Goldsmith neighborhood of Denver.  Charles Joseph Stout has been determined as sexually violent predator after meeting the following criteria. Criteria 1, age 18 or older on the date of the offense or under 18 and tried as an adult. The offender was age 30 at the time of the offense. Criteria 2, the crime must have been committed on or after July 1, 1997 and convicted on or after July 1, 1999.  The offender was convicted on February 8, 2002 for sexual assault on a child, position of trust, victim under 15. Criteria 3, the relationship to the victim was one of the following. Victim was a stranger to the offender or the offender established or promoted a relationship with the victim primarily for the purpose of sexual victimization. The victim was an 11-year-old male. The offender was the victim's stepfather. Criteria 4, positive results or the passing of a risk assessment instrument administered by probation parole staff and a qualified treatment evaluator. Positive results include an assessment for the presence of a mental abnormality, a level of denial regarding the offense, treatment appropriateness and motivation, presence of sexual deviant interests. The offender was evaluated by the Fremont County Courts with positive results, determining him to be a sexually violent predator.


A recent study has found that Irish people between the ages of 16 and 29 rank among the most religious in Europe. The study, conducted by St Mary's University in London and the Catholic Institution in Paris, found that 54% of Irish people in this age bracket identify as Catholic. Overall, 61% of those surveyed identified as religious, a statistic which has come as no surprise to D.C. Chaplin, Philip McKinley. When you look at all the analysis, 18 to 25 years at the lowest level, levels of religious practice. So I was expecting, you know, that this is a post-religious context and therefore I probably arrived here as a pessimist. And because of that, I've actually been very pleasantly surprised in some ways. We've got an interfaith centre here. We have, we make 200 cups of tea and coffee every day. We have 400 users every day. And I mean, certainly on my to-do list, I am burning the candle at both ends and the level of engagement is really, really high. So I've been very pleasantly surprised. But there's also that huge diversity of religious tradition. There's a huge range of world religions here and people that practice world religious beliefs. So there's something really exciting about the new diverse contexts that were in D.C. was particularly diverse university. With the secular trends becoming more popular in Irish society in the last decade, many students on campus were surprised by the studies revelations. I think with like the interfaith centre and the church down in Patts and everything in all Hallows, I think people are kind of practicing doing things that are like more meditation stuff, but they call it Catholicism and they call it that they're faith. But I don't necessarily guard statistics. I wouldn't be shocked if you told me not statistic because especially university like D.C.U. tends to be a fairly liberal population in a sense, you know. I wouldn't imagine that they're practicing and if that is like that they say that they're practicing it's probably just Easter and Christmas, I would imagine. Even though societal trends do not reflect statistics shown, it is clear that religious practice still plays a vital role in young Irish people's lives. Michelle Townsend, D.C.U. TV News.


Everybody forced here ripping 20 22 tops tier one baseball 12 box case number 29 pick your team style Alex W twins Austin S. Marlins Charlie C Giants David a Cubs Edgar B Dodgers Frank V Royals Gilbert D A's Harper B Yankees Johnny H Brewers Johnny a Red Sox Joseph C Cardinals Keith J. White Sox Ken I D Bax Kevin C Tigers Astros Matthew R Mets Nick N Blue J's Noah B Mariners Rich F Phillies Richard B Padres Rays Ryan M has the Nationals Sean T Orioles Teddy K Braves Thomas S Angels Tony N Reds Guardians Rockies Rangers and Wenchu with the Pirates. Thanks everyone for joining and good luck All right last tier one of the day guys got some Revolution team all after this first. I've ever opened a revolution team. Oh, she pulled the Kevin De Bruyne last night out of three Oh, yeah, I saw that she sent the picture to us That's a very big card at first. I thought I was Hollins So I was like, oh white guy on Man City with very light colored hair No, no, I was like, oh wait. No, that doesn't make sense Jersey card for the Blue Jays Boba. She had the 299 She and I I was told that I look taller in person by like three different people Rangers Ricky Otto Joe Barlow to 299 and Brewer's Otto Christian Yelich to 149. We just keep separate stacks for relics I don't think I'm gonna I was like, Jake, I dare you to turn the TV on Dodgers Jersey Clayton Kershaw to 249 When I got that text, I was I was like what I don't even know how to respond anymore Mariner's Otto Kyle Seeger to 299 retired Kyle Seeger and National's Ricky Otto Josiah Gray to 299.  No, I have not Blake. I saw it's very interesting what they're doing Dodgers Otto Gavin Lux to 199 It's having a nice season and Red Sox move on Otto to 200 I'm not quite sure how I feel about it I'll check it out when I get home So like the Pokemon or like RPG sort of thing, you know, okay I I I like the idea of that but like in practice will it you know what I mean? Yeah, I'll have that pre-ordered for sure exactly which which version are you getting Blake? That's the real question Rocky's Jersey Todd Helton to 299. Why did you know facial hair looks so weird?  Yeah, the real question is which version is everybody gonna get Astros auto Alex Bregman to 125 I might do both even growing up. I used to always get both and now I regret like Not having held because of what the games I still have a blue lane around somewhere Oh, I just wish I'd like kept the box Orioles the Cal Ripken Jersey to 299 Red Sox Alex for do go auto to 199 Him in a fam are gonna platoon Or if he's gonna get asked to join a fantasy baseball league or fantasy football or whatever Yankees Jersey auto Joey Gallo to 99 Lane manifested this card He the Dodgers Yankees gonna play in the World Series. He's doing a World Series MVP or something like that One of my Dodgers friends is like watch it's gonna be like ninth inning down three bases loaded to outing Gallo is gonna come up and hit a grand slam That's how it works, right? Yankees Jersey Garrett Cole to 399 Blake that's how I was to with my friend That way the the in-game trades and all that you could always do no matter what Giant Jersey card Chris Bryant to 399. I think we'll have enough people here with either version that I won't be a huge deal But everyone that works here gets the same version. God. I'll be so mad Is Adam Miguel Tejada to 299? And Cardinals I know Scott Rowland to 299 probably probably kill it, right? I don't know Sounds like Blake wants to strike that strike out of Joey Gallo, right? Twinge Jersey card Byron Bucks in the 349 White Sox silver ink. That's nice Andrew Vaughn auto to 10 Silver ink on the White Sox cars is sweet. Hey Yankees auto Dave Winfield to 99. Yeah, I was reading that. That's insane, man I'm I mean, I'm sure everybody involved is glad he got traded. Hey, man the Yankees Why would they do that there was serious talks about them moving Jersey card Royals Salvador Perez at 249. He's like their only good hitter outside of yeah, judge and stanton I mean the Mayhew solid too, but like who else can you count on consistently, you know Sheffield auto with the Dodgers to 299 And silver ink auto Yankees done madding Lee to 10 Donnie baseball Yeah, trade them a strange and the Red Sox traded Vasquez. I was like, oh, it's It's about to go down for the Red Sox. That's just the start of like that's just start of it And then it just got weird like I feel like they were trying to sell but it's fine deals. They like so they kind of just Know what we'll hold our kind of trades with the sake of trading That's kind of what it felt like a lot of like first place teams felt like sellers as opposed to buyers And a lot of like middle of the pack teams were the big buyers. They have Padres Jersey Blake sell the 249 The outside of the Soto deal was in like the hater deal, which was the same damn team. Like It felt very as soon as they got hater. It was like the writing was on the wall that Soto was going Yeah, if you ought to reds TJ Fridle to 299 You don't make a deal like that without Something else coming and cubs out of Fergie Jenkins at 299 It's a weird day Not a lot of the end either. I was a surprise by that Cindergarten the Phillies. I saw um a glaciers to Atlanta That's that sneaky good trade for them That's a good eighth and ninth inning out the glaciers and Jensen Phillies Jersey card JT Romuto to 399 That's didn't make any big moves, did they? No, nothing, but you know, they probably might have had the best acquisition jaco big rom Okay, giant Soto Mike is stremsky to 299 Mike Yaz And a pirate Soto Bill Mazurowski to 299. I think we pulled a Bill Mazurowski every single break today Come on last two boxes tier one for daytime Don't remind any national spin Blake The shorter one I get he was on a one-year deal with him anyway But like he's also just been Hitting home runs the entire two years, you know Dual relic Derek Jeter 14 of 25 Yankees. That is a nice three color patch up top What's up t-hop?  Yeah, very much competing He's hit a few cruise missiles for sure. Nice. O'Neill cruise wenchew with the buckos Tramansini bat relic for the Orioles to 399 I was a little surprised Orioles traded him honestly. I know he's expiring a deal, but That's a team that needs a player like that if they All those young guys Got a rangers auto with all this Garcia to 199 Yankees dual patch auto mark to share out to 25 Kenzie had never seen this name before And like said it like how I would have said it the first time And I was like text message No, that's a share. I know it's a text message. Yeah And I was like, yeah, that's how we all said it the first time we saw it when we were younger I used to love going to games and he'd hit a home run. There's a text message out to left field To share a nice hit Yankees. Good break Yankees once that guys do a recap Got revolution team all Start with our relics here a Tramansini Derrick Jeter JT Romuto Blake Snell Salvador Perez Byron Buxton Chris Bryant Garrett Cole Cal Ripken Walker Bueller Todd Hilton Giancarlo Stanton Juan Moncada Clayton Kershaw Boba Chet and all of our autos Adolas Garcia Tyler Glaznow Micah Strimski Bill Mazurowski Fergie Jenkins 2j Fridl Fridl Don Mattingly Silver Gary Sheffield as a Dodger Andrew Vaughn Silver Dave Winfield Miguel Tejada Scott Roland Cardinals Alex Verdugo Joey Gallo Yankees Alex Bregman Kyle Lewis Mo Vaughn Gavin Lux Josiah Gray Kyle Seger Christian Jellich Joe Barlow Mark Tashara And pirates rookie O'Neill Cruz Big card pirates that is going to do it guys. We've got like I said revolution team all coming up


So, in about 10 minutes we will talk about the spoken tutorial, apparently you had some questions. How many people had spoken tutorials, questions? Some people wanted to even set up. In fact, our objective is that every one of you will have as infrastructure set up to do spoken tutorials. So, what I have done is, what we will do is, let us play that video fully. How to do the recording through cam studio? And if there are questions, we have Nancy here, can you raise your hand here, who actually created that. So, let me play this first, because some of you had questions on audio video demonstrations can illustrate features with maximum clarity. Cam Studio is a screen recording software that records all activities which you see on your computer screen and allows you to play them back later on. Which means that you can use cam studio to demonstrate features of a new software, create audio video tutorials for schools and colleges, create video movies used in user training, show how to perform an activity, convert AVI files to flash files and many other uses. The uses of this little known software are limitless. Cam Studio can be used with Microsoft Windows 95, 98, ME, Nt4, 2000 or XP versions. All you need is a 400 megahertz processor, 64 MB of RAM and 4 MB of hard disk space for program installation. Cam Studio is an open source software and can be downloaded free of cost from the internet. Go to the site www.camstudio.org. This will open the cam studio website. Scroll down and click on the link to download. Follow the instructions and you will have downloaded cam studio on your PC. Once you have installed cam studio double click on the icon to run it. This will open the cam studio dialog box. You will see the main menu right at the top of the window. Under file you have the options to record, stop, pause and exit. You will find the corresponding buttons in the dialog box as well. The red button to record, the grey button to pause and the blue button to stop the recording. It is recommended that you set the capture region before recording by defining the area of capture. Under region there are three capture options. If you select region and click on record then you can draw a rectangular region on your screen within which the capturing will occur. If you select fixed region then you can specify the capture region in pixels. If you select full screen then the entire screen will be captured. The enable auto pan feature is a unique feature of cam studio. If this option is selected the capture region will follow the cursor wherever it goes during recording. This has the effect of making the screen capture to occur at the region with the most action. You can also set the speed of panning here. Under options you have video options where you can select a compressor for the recording so that the video file size is small. By default the compressor is Microsoft video one but you are free to choose any of the compressors or codecs given in the drop down box here. Alternately you can even download the codecs from the internet depending on your requirement. Setting the video options allows you to optimize your video recordings by choosing between the file size, quality and frame rates of your video files. To set the values for keyframes, capture frames and the playback rate first uncheck the auto adjust button. Now you can set the values according to your requirement. To record this tutorial I have used Microsoft video one as the compressor with keyframes set to 5, capture frames set to 200 and playback rates set to 5. I have reduced the quality to 50. By trial and error and various permutations and combinations I have personally found these values suitable in terms of output quality and file size. Setting cursor options can help focus on the activity you are recording by drawing attention to the area where the action happens. Under options click on cursor options in which you have the choice to either hide or show the cursor. By default show cursor is checked. There are three choices of cursors here, the actual cursor, the custom cursor you can select from the drop down box here or you can load the cursor from the cursors folder present on your computer. Next you can highlight the area around the cursor by checking this box. You can set the size, the shape and the color of the highlight. Click on OK. You will not see any change in your cursor but the recorded video will have a custom highlighted cursor. Let me demonstrate this for you. By default CAM Studio does not record audio. You can record audio from the microphone a very powerful feature to make audio video tutorials by checking this option. You will need a sound card with an attached microphone to use this option. You can also record audio from the speakers attached to your computer by checking this option. There are other options like program options which have these sub options. Use these options to customize the way CAM Studio behaves when it starts or stops recording. Ideally check the option to minimize program on start recording. This will minimize CAM Studio onto the system tray which is at the bottom right hand corner of the screen. Right now you will see two CAM Studio icons on the system tray. That's because I myself am recording this tutorial using CAM Studio. Record to flash options has these sub options. Your shortcuts is where you will set the hotkeys for record, pause, stop and the rest. You are free to choose any of these. So I hope I have given you sufficient information to get you started on CAM Studio. Use this software to make audio video tutorials and online visual learning modules of your own. Once you have mastered the basics of CAM Studio, you may want to watch the next edition on its advanced features. Till then, this is Nancy from CDEEP IIT Bombay signing off. Thank you for watching. Any Linux based recording software available? If you want, I want to explain some Linux program or anything. I can use it. X-Wit Cap is one that is available on Linux. X-Wid, VID, X-Video Capture, so X, VID, CAP. I played that Sylab thing the other day by a Gujarat student. She had used X-Wit Cap. This I think I showed some late take also. That was done using IShowU, which is a shareware in Mac OSX, which means I paid $20. Actually, you should talk to Nancy about what is involved in making it. I mean, one is technology that you have seen. But what is, you want to say a few things? What is the most difficult part in this or what are a few important things in this? If you can just take one slide and just add audio to it and demonstrate how exactly we do it, one PowerPoint slide. You saw that late take thing. What I did was, I have, of course, this is a different software. I took it to the top left-hand corner and of course I know the size. It should be 79 by 10. That is the size of the window that I have. Then I say CD, CD desktop. So I have this file, which of course I made it smaller. You need some initial work to do. You have to arrange things. So I arrange them like this. Suppose I just want to start like now. Let us say I want to compile this late take. So I have something called, so I have the hot key for this. Now whatever I am going to say is getting recorded. Of course in this, you see this red line that is coming up. So what I will do is, I will, using the hot key, I will terminate it. So this is the MOV file. Let us capture the whole screen. Whatever that came within this stuff has come. See this.  So what I will do is, I will use the hot key, I will terminate it. So very simple. Let us show the CAM Studio. Let us do a small demo recording. As we had explained in the earlier tutorial that you all saw, there are three capture regions in which you can do the recording. If you do this, then you can draw your region, the capture region. Now the moment I leave the mouse, everything you will notice that there are four corners here. This shows the region within which the capturing is going to occur. If I do, if I want to record say a PowerPoint presentation, I will just open one which is here on this laptop. This is just for demonstration purpose. So I will go back to CAM Studio and choose full screen and click on record. Ideally, as I said before, please choose this option minimize the program on start recording. This will make sure that the CAM Studio window disappears the moment the recording starts. So the moment I press record, this window will disappear. Now whatever is there in the PPT will be captured. I will just save this on the desktop. I have stopped the recording. I will save the file. This is the default CAM Studio player in which you can view whatever you have recorded just now. So I will just play this. So I think she forgot to turn the audio on. I think the default is audio off. So you have to remember to, you want to say how long you took to create that, how to do CAM Studio recording? How to do CAM Studio took about a month to make. The reason being that CAM Studio was a new software to me. So I had to first understand how it works and every little detail that goes into it because there is no point in telling others to do something which actually does not work. So what I would recommend for any spoken tutorial is to study the topic that you want to show in the tutorial very well, make a very good script, do some recordings, go through your recordings, find out if there is any ambiguity, if there is any lose ends, you know, somewhere where the meaning is not being conveyed properly or if there is too much of information given on something or too less information given on some other detail. All that has, you know, you have to go through it. It is not, you cannot just do it like in one or two days. You have to take the time to do a thorough job. Kannan sir always is a very tough task master so he makes me do it till I get it right. But that is good, it is good because you can get a concise and precise tutorial to the point. We sometimes we need not say things, you know, which are not required at all. Let me just add a word of, it is not actually so difficult. I asked Nancy to spend a lot of effort in that tutorial, namely camp studio because we wanted people to use that, we wanted a lot of people to use that. So I wanted it to be as good as possible. I was also, we were also going to get it dubbed into many languages. So in view of that, we wanted it to be really nice. But on the other hand, if somebody is going to create one of how to do browsing, you know, you may not even dub it, it is available, anybody can go and listen to it. So that is okay. So anybody who is comfortable with any software, they want to talk about it, they need some practice but not months of, she actually said one month, actually she took two months. The thing is about what to put, what not to put, and what compression and so on. So for example, in one of the places she says, I chose five frames, I did this, I choose the quality at 50%, by trial and error, I arrived at it. How much time did she spend to arrive at that, days, if not weeks. But once it is given, a person who is picking it up, you set it up, it is going to come out good. So I believe that it is possible without too much effort to replicate this. Now that the spoken tutorial on how to create it is available, it is very easy for you to do that. I don't think it will take days, I mean months. Nowadays there are times when I create, it's a real time. You have everything right, you speak, finish it, it's over. According is done. Of course she has spent some time on editing. My spoken tutorials on latex, I don't do editing. It's one go, 15 minutes, just go through with this, finished, released. Not even editing. If you do editing, cut paste and so on, it will take time.


Welcome to the Sherwood Forest and this edition of the OTP presented by Far Bureau Health Plans, protecting Tennesseans for 76 years. Get a quote today at FBHP.com. I'm Mike Keith, Jim Yerdo, NFL Network. Welcome, thanks for taking time. Thank you. How do you like England? Sherwood Forest, that's a good reference. We're in the middle of a forest, we're watching a walkthrough. England is great. This is my fifth or sixth trip over here for an NFL game. I came previously with CBS and now my second time with NFL Network and I think every year the show gets bigger, the games feel like the teams are here that are more prominent, so it's awesome. I'm having a great time. All right, so the question I have to ask you first, I want to get the NFL Network people away. Do you miss the SEC? Everybody wants to know that because that's how they first came to know you in our part of the country. Yes, I do. I feel so lucky that I got my four years on the SEC because my goodness, every NFL roster is just riddled with those guys. I can't escape them. It's crazy the turnover the SEC has now. You know, Jason McCordy had an Alabama game a couple weeks ago. I think they played Ole Miss. I'm watching the game to, you know, support Jason and I'm like, who are these guys out here? One year removed from the SEC and I feel like the turnover on those rosters is so crazy. That's what makes college football really challenging in my opinion and it makes the NFL, you know, you feel lucky just to look at a, you know, a sheet and have 53 names on the roster. Well, but for us, though, the points you just made is really strong. Yeah. Knowing the SEC really helps if you're covering the NFL. It's true. I actually just asked your PR staff how Roger McCreary was doing so random. I know he's a second-string guy and working through his rookie season, but my memory of Roger McCreary is eating his baked beans and sugar packets before his Auburn games. Allegedly, the nutritionist has gotten a hold of him now and changed that tune, which makes me sad because Roger McCreary has always been the baked beans and sugar packet guy. All right. How is it different doing sidelines on the NFL and doing sidelines in the SEC? Or is it different? Wow. Is it different doing college and pro-side? Approaching, it is. Approaching the athletes is very different in my opinion because you have to remember when you're in college, as a woman in her early 30s, a mother away from Minnesota, I was working with 18 to 22-year-olds predominantly from the southeastern part of the country and, you know, just making sure they felt like they could share their stories with me, making sure I felt relatable to them in some aspect. That takes a different, I think, social skill set than it does guys in the NFL. You know, they've been through media training. They go to broadcast boot camps. I think they see all the different television coverage that NFL Network and all the other networks provide, so they kind of know the name of the game. So it's a little bit more accessible if you will on the NFL. The SEC, you're kind of like, I want you to tell me your story because we're selling you. You know, we're putting you on in conversation in the afternoon on CBS. So it is different and it changed my skill set, I think, in a good way. We talked to you right before you started Good Morning Football.  The door. Has it been what you thought it would be now that you've been doing it for well over a year? So to circle back, the challenging part of the SEC is there's so many guys, even though there are only 14 schools for us to keep an eye on. There's so many guys, there's so much change over so many storylines. Weirdly, coming back to the NFL for me was comforting because it just felt like everything was more uniform. You know, the teams are set, the coaches mostly stay put, the players stay put. There's just lesser guys to pay attention to. For Good Morning Football, you know, we really fly at a 3,000 foot view a lot of the time. So I've enjoyed just focusing on the NFL and getting back to that level. I've really enjoyed the fun we have on that show. I'm so proud and appreciative of the fact that Jason McCordie and I started on the same day. I think that's going to be one of the kind of timestamps in my career that, you know, he was new to TV and I was new to the show and we've really kind of forged this path together and then Peter and Kyle welcoming us into this brand that Good Morning Football had become. It's been awesome. It's been 14 months together now and this time last year feels very different. We feel just feel really comfortable and great around each other. From a broadcast standpoint, how big a factor is it in your mind that you and Jason started together to come in and sort of mold with the other two guys? It was huge. We, you know, we finally had this conversation a few months in last fall, which was, I said to Jason, you know, I really love listening and learning from you every day. The football perspective, I always say, we always introduce him as Super Bowl champion Jason McCordie, but he'll be the first one to say, you know, when I was with the Titans or when I was in Cleveland for that year, his range of humility and experience in the NFL is so incredible. And then on the flip side a year ago, he was turning to me and saying, I really enjoy watching you do television every day. He had no idea just the X's and O's of that and I have never received a compliment like that before. I've never, I mean, I'm nine or 10 years into television. I hadn't, at CBS, I was never the television veteran. I was still like the young book. So to be in a situation and in a working friendship with this person's looking at me and learning things was really cool. Not to leave out, Kyle and Peter, but you and Jason are almost the perfect partnership. Yeah. Yeah. We, I, and I just really respect so much his approach to people, to the game, his honesty of the game, his, his relationships that he has, his acknowledgement of if he doesn't have a relationship with a team or a player and what that looks like when he goes to watch film or anything. I just, I really respect everything he has brought to the table. And for Peter and Kyle, I know they do as well because they were around Nate Burleson for so long that I think them learning somebody else's style, especially a new person in media, it's just been such an awesome kind of growth. I know we're all really, really proud of Jason and what he's become. All right. The Good Morning Football Show has the perfect balance of the news and the fun. I believe. Yes, yes. How do you keep that balance between being able to cover the NFL and knowing people watching love the NFL and not being too goofy? Too goofy is, is a line that I think gets towed a little bit. Football inherently is entertainment. It's fun. I believe that I think they picked people to be on the show and to produce the show that believe that I think just as someone who's been around television and sports TV for so long, you just know those moments where it is news and you have to feel it, you know, everything that happened in Buffalo last year, you know, things that hard hit, you know, challenging topics that you have to cover. You understand that your tone has to change, but that doesn't mean it has to affect you the entire time. And so being able to have fun with, you know, McCordy doing the fit list now and he's dressing up as guys and, you know, Kyle's angry runs or anything like that. There's these pockets of like fun and entertainment that I think if we oftentimes lead the day to, you know, we're trying to set the tone for the NFL for the day and, you know, football is fun. It's fun to watch people go to the games to have fun. So there's no reason why from seven to 10 a.m. we can't have fun. The day Jason sang on the air. It seemed like you almost couldn't get it back together. You were laughing so hard. Fair. Fair. I was, I thought so many, so many things why I have to put myself back on that stool. He, I thought he was faking being that bad. And then I realized that there was no faking that like that's how that was going. It sounded just like some borderline between like a cat that was in pain. And he just couldn't hit a tone. There was no beat to it. I can't even remember the content of what he was speaking, but I was just in shock. Like, listen, I know sometimes if we're not really sure what we're doing in a segment, we'll bounce around and be goofy. But like, I was like, wait, pause. Are you, is this, oh, no, this is really that bad. So, yeah, it was, I was shocked, but he can't sing. He cannot sing. He was trying to sing. He was really trying. And I think he wrote that song too. Like, maybe his, maybe he's a songwriter. If he moved back to Nashville, he could be a songwriter, but not the singer. No, he could come back to Nashville. I'm looking straight in the camera. He could come back to Nashville anytime because we love Jason MacCordy.  We knew that he would be a complete natural at this. He may be as natural as anybody I've ever seen in media, but he cannot sing for anything. Here's the other thing I want to ask you about. When you guys do athletic things. Yes. Do you think people are surprised how good at those things you are? Because you're an athlete. Yes, I am. And more so than I am an athlete. I am just that much more competitive than anything else. I don't know if people are surprised. I guess maybe people are surprised. I think Jason is constantly surprised at how seriously I take things. Well, that's what I was talking about more so than the fans because, I mean, Brant and athlete, Traeger can hang, but that's actually, I think Peter takes the opportunity in those moments and segments on the show where I think that's where he has his fun and he like makes a goofy and that's his, that's his angle. I just always like that is like my moment to legitimize like why we are out there playing this game. And Brant is always good about like, let's make great television. Let's have this be good production moment. I'm like, no, I just want to win. And then Jason is just like, why are you, I'm always like rattled around and jumping and jumping and Jason is like, you need to chill. Jason and I probably would not have been good actual teammates. All right, so how much of a help is McCordy to you guys knowing the Titans? Oh, well, I feel like at times Jason feels the need to wave the Titans flag for us, you know, remind us about what's going on in your division and the fact that, you know, things are still early this season and up for grabs, up for grabs. He, you know, he came down to your training camp, which was awesome and we all were kind of spread around for back together weekend. So it was cool that he was able to touch in with you guys and come back and report back. But I like to think we, we all respect and know you guys fairly, but you're right. He does have a soft spot for you guys. That's why the OT people, as we call them, have so much respect for good morning football because they feel like they get an equal say. Whereas in a smaller market, the Titans don't always and that's part of the deal. Well, I'll tell you this, we do some segments throughout the week and one of them we did about a month ago was we were picking games heading into the weekend and it was really fast moving. I got thrown up. I think it was St. St's Titans, sorry, and McCordy was calling the game so I had to pick it and your GM sent me a message. I was like, I don't know what was just on because my TV was on mute, but I think you were talking a lot about the Saints and I was like, don't go back and watch it and unmute it because I am sorry to say I did pick against you guys, which I'm sorry to say, but it was just great because we take pride in. We actually have a list, a working list, every day we are told who we didn't talk about that day. Okay. So we like to get to all 32. All right, so what time do you get in in the mornings? 5.45. Okay, so the car picks you up at like 5? 5. 5 at my house. I get to ride in. I am in my pajamas when I arrive at 5.45. I have clothes there, hair and makeups there. It's so great. I am caffeinated there properly and then I get Jason and I, this is really X's and O's, Jason and I walk into the studio at the same time, 6.55. The amount of time it takes for Jason McCordy to get hair and makeup done is so frustrating. Hair was in quotes. It's so frustrating. Like I leave, he goes in and I'm like barely putting a sock on and he's like, hey, see you guys out there. And I'm like, that's how long it takes you. It's so frustrating.  We all get mic'd up and we rock and roll at 7 o'clock. Do they try to make you look different every day? Oh my gosh. You have so many looks. I do, thank you. I mean in a good way. And I mean this and I said this to hair or my hair and makeup team, Bradford and Ashley are fantastic. I said this to them last July 25th. I use the same people. I know they're the best. Last July 25th. I said I mean this in the best way possible but I don't care what you do. I just want to go out there and be on time and get mic'd up and go. You do you. You're good at this. I'm good at that. And that's what we're working with here. Because you're not the girly girl. No. That's you were an athlete. Yes. And I mean you obviously care about your appearance but that's not your big thing. Yes. No. And like you're asking me to care about very specific content that is very different from beauty and hair and makeup for three hours a day. I can't do both. I'm going to rely on professionals to take care of that part of it for me. So then when I walk out there I'm looking the way I'm supposed to look. I don't care because they're awesome at it. And I like not caring. It's great. It totally works for you. Thank you. Thank you. I feel like I'm in an island. It must be a comfortable thing though. It is. It is. Yeah. It's a very intimate to that process. Is there in your face. It's very early in the morning. You know it's all up in your business but uh yeah. Straight coffee or do you have a specific.  It depends on my mood. Yeah. I have a very rangy caffeine mood. I go I go iced tea. I go ice green tea. I go chai tea latte. I go coffee with milk every day. The the young man Eric who runs our coffee. It's he's like what do you need today because he knows he can't predict. It's bad. I wish it was like a Monday like on Monday she has this. No it's Diet Coke. Sometimes I sometimes I throw in the diet soda. It's not good. We got to go out in the Sherwood Forest and find Robin Hood so I got to let Jamie Erdahl go. Thanks for doing this. Thanks for having me. Good morning football is awesome. Thank you. It was a good show before. I think it's even better now. Oh that's kind. And the OT people really enjoy it. For Jamie Erdahl, I'm Mike Keith. Thanks for joining us for the official Titans podcast from England known as the OT.