All right. Thank you. I'm Tramel Hudson and I really like to take things apart. So in this talk I'm going to be talking about Thunderstrike, which is a EFI firmware root kit for Apple MacBooks and The talk is going to have a few parts the first half is going to be about the sort of the journey of reverse engineering the EFI bootrom in the MacBook the second half is going to be about developing the Thunderstrike vulnerability and then the third half is going to be about mitigation strategies. What can we do to prevent it that hopefully are better than epoxying the ports shut? So reverse engineering is a hobby of mine. One of my more famous projects is the Magic Lantern firmware for the Canon cameras. It's a GPL runtime that lets you write your own software. I also really enjoy retro computing and digging through old computers and in the ROMs to see what sort of Easter eggs there are such as this Mac SE that contains a four photos of the team that worked on it back in the mid 80s. And I'd really like to thank my firm Two Sigma Investments. It's a high tech hedge fund in New York City that has encouraged me to do this research and to publish it. I'd especially like to thank my colleagues Thor Simon, Victor DeCovny and Larry Rudolph for their assistance in preparing this for publication. You might ask why is a hedge fund interested in this sort of vulnerability? And it really comes down to security that we care about the security of our data and of our systems. And we'd heard about some some attacks on MacBooks and we were thinking about deploying them. So I was asked to use my reverse engineering skills to look into some of these attacks. So I started by going through and reading and watching conference presentations. And there's an enormous amount of marvelous presentations. In fact a lot by people who are even here today that helped teach me about how systems boot and how to protect the boot process. Although most of them are looking at the the Intel and Windows side of things, the secure boot path. And comparatively few are looking at Apple's boot time security or things like Thunderbolt security. The snares black hat presentation in 2012 was the one that actually started me on this project. So with most reverse engineering projects the first thing that you need to do is get into the system to get a feel for what's there. Apple uses these pentalobe screws to make it a little bit more difficult to get in. I did it the old fashion way and made a bit of a mess. But you can also buy screwdrivers for a few dollars . So once you get inside, Apple has done a beautiful job on the aesthetics of this machine. Despite the fact that they make it so hard to get into, they've really paid a lot of attention to the aesthetics and the layout. Usually what happens with malware is it comes in over the Wi-Fi or the Ethernet, gets a buffer overflow into RAM, gets some code running on the CPU that eventually writes something to the hard drive. What this talk about, though, is the boot ROM, which is this chip over here. If we zoom into it, we can read out the part number, the 25L6406. And we can look up the datasheet. It's a 64 megabit, 8 megabyte serial flash. And we call it a boot ROM, but it's really an EE prom with flash memory in it. SPI means that it has data in, data out, and external clock that's controlled by external hardware. What a lot of other researchers have done is used the bus pirate, which is a off-the-shelf logic analyzer tool and comes with these test clips so you can easily hook it up. The problem is the bus pirate is kind of slow. It takes a couple hours to read and write the ROM, and it's very fiddly. Since I do a lot of work with ROMs, I've actually built a SPI flash reader based on a teensy, which is kind of like an Arduino. The sources are at GPL, and you can download them and have at it. This one can read the ROM in a few seconds and write it in about a minute. One word of caution, if you're doing reverse engineering of this, disconnect the battery before you hook up the external programmer, otherwise you'll have conflicting voltages on the rails, and as the voice of experience, that's not a good thing. So two years ago, when Snare was doing his work, he found that if he changed the ROM at all, the machine wouldn't boot. And he conjectured that there's something checking a signature on the boot ROM, and that made me very curious. What is doing that check? So I repeated his work, and I made a one-byte change to somewhere in the ROM, and the result is pretty much a bricked machine, that there's no lights, no sounds, no sign of any life at all from the outside. But since we have the bottom off, we can flip it over, and we can look at the inside, and when we power it up, the fans spin up, the CPU cooling fans, and then a few seconds later, they spin down. And that indicates that something is checking the ROM. It could be an external piece of hardware, which a lot of folks have conjectured, or it might just be something in the boot ROM itself, which of course leads us to question, what is doing that? If it is only software, we could perhaps bypass that check, and the easiest way to figure that out would be to change the first instruction that gets run. And to find out what that is, we go back to the late 70s, early 80s, for the 8080, because when your modern X8664 starts up, it boots in real mode and reads the first instruction from what at the time was the top of physical memory at one megabyte, and then does a jump somewhere else where in memory to finish the initialization. Using the bus pirate or the flash ROM tool or my SPI flash reader, we can disassemble that part of the ROM, and we find that indeed, it starts with a cache in validate that's actually new, but it does a jump lower in memory to finish the initialization. What if we change the address that that jumps to? So rather than jumping off to there, it just creates an infinite loop, and it will just spin there. When we flash, using the system program, when we flash this into the ROM, there are two possibilities that could happen. The fans might spin up and then spin down again, which would mean that there is something outside that's actually checking that ROM. Or the fans might just keep spinning continuously, which would indicate that there's only a software check. I'm up here today, so there's probably not too much of a surprise as to what happens, but yes, the fans stay on. So this gives us one bit of output before the rest of the system has started, that we now know a way to signal what's going on. And this infinite loop is a very common reverse engineering technique, you can drop it somewhere in the code, and if the system hangs, that means that your code is running. But this also means that there is no external hardware. Apple used to have a TPM on their motherboards, but they actually removed it because they weren't using it at the time. So it's a quick recap. We can now reprogram the ROM with the system program and hardware, and we know that there's no external hardware that's actually checking the ROM validity. But something is checking the validity, and we need to find that piece of code. So to figure out how the ROM is organized, we can go to Intel's EFI specification for their firmware volume. And it has this field labeled signature, which sounds perhaps likely, except it's literally just the four characters underscore FVH. There's this check sum, but it only covers the header. And the other interesting thing in this section is the zero vector, which isn't really defined what it's used for. So we'll come back to that. If we do a hex dump, and there will be some hex dumps in this presentation, if we do a hex dump of the top segment of the ROM, basically the last 64 kilobytes, we can spot that underscore FVH signature pretty easily. And there's the 16-bit check sum here, covering these hex 48 bytes of header. And the zero vector we can see is not zero, it contains something. Those first eight bytes were always the same in every firmware volume in the ROM, but these last eight bytes varied between each of the firmware volumes. And so that's interesting. To try to figure out where things are in the ROM, we can use a tool like strings. And what's interesting is this ROM image actually doesn't have very many strings, but we can find things like that FVH signature. And then a few bytes later, this really tantalizing string that says ROM integrity. So let's fire up our interactive disassembler. I'm using Hopper in this case on that section of the ROM. And apologize, a little small. The slides will be available if you actually want to dig through it later. We can see that it does a comparison of that signature, the FVH. And then there's this chunk of code here that computes some stuff with the length and then it does something with the offset eight into the zero vector at the start of that firmware volume. One thing Hopper can do is give us pseudocode that we can then massage into something that looks kind of like C. And what we can see is that it's calling a function on the data part of the firmware volume, storing the result in that address. And then it compares it to that part of the zero vector. So this function is clearly involved in somehow in checking on that validity. Using Hopper, we can interactively step into that function. And we find that it does a bunch of stuff in a loop reading over the bytes of data, but also accesses this table, 32 bits at a time. As Rudolph suggested two days ago, when you run into these random hex values, toss them into a search engine. And you never know what you're going to find. In this case, there's that constant and there's the next five constants. So a lot of our reverse engineering is done. We now can probably guess this function is CRC 32. And in fact, we can now make a one byte change to the firmware, manually compute that CRC 32, reflash it with the in system programmer. And it now works. So we have a new bullet point that there's only a boot time CRC 32 check of the ROM. This is not a cryptographic check. This is only to ensure that the ROM has not accidentally been corrupted, or that somehow it has been misprogrammed. So simply by regenerating that CRC, you can change the ROM. You might ask, why isn't there a cryptographic check? Other researchers have looked into this and come to the conclusion that the flash ROMs are only checked when they're being updated. And once it's written, it's never checked again. One possible reason for that is for speed to have a faster boot time. But doing the CRC requires reading through the whole ROM anyway. So it's not like you're going to save that much time. The real reason is that malicious software can just skip the checks. But if you can write to the ROM, you can just change that whatever the function is and to always return true, or it can return a pre-computed hash value. So without any cryptographic hardware to help out, a software-only attempt is doomed to failure. Earlier, I mentioned that there weren't a lot of strings in the ROM image. In all 8 megabytes, very little of it had any actual human readable strings. Most of that was up here in the early boot code. And there are two copies. I don't fully understand why. This is a graph of the entropy of the ROM generated with a bin walk, which is a really great free software tool. The zero entropy regions are free space. They're all Fs. And the rest of the ROM is very high entropy, which could be encrypted or compressed. So to figure out what part of the ROM to look at, we can decode the flash descriptor region of the ROM. And Flash ROM tells us that the BIOS is the latter part of it, from 190000 up until the end. So let's look at what's stored at the start of that BIOS region. And again, we can go back to our hex dump. And it looks like a firmware image file section. So we've got three bytes for the length, about 15K for this section. The next byte is the section type. And type one is a compressed section, which matches well with what we thought. So we then turn to the compression section documentation. And we see the next four bytes are going to be the uncompressed length, about 36K, so they've got a little better than two to one. The next byte then is the compression type. And they've got type two, which is not defined in the specification. So that's a bit of a problem. What I did notice, though, is that these next four bytes in all of the firmware sections were the same. What do we do when we see something like that? Toss into the search engine. And we get a perfect hit for LZMA at compression level negative seven. So to verify this, we can use a tool like DD to extract the compressed bytes, skipping that nine byte section header, filtering it through LZCAT, which will decompress it if it's a valid LZMA format. And no complaints from LZCAT. That's great. The file sizes match up with what we saw in the header. And there are now human readable strings. These are just absolute golden if you're doing reverse engineering, especially printf strings, those percent 0D and percent 0S and whatnot. Those are what tell you how things are happening inside the code. So once you have that sort of thing, it's very, very easy to start figuring out what else is going on. So we now know how the firmware volumes are compressed. It's type two. We can flash new code with the insistent programmer after recompression. I'm not the first person to figure this out. I'm quite certainly not the first person. But I've never seen anyone else write it down. So I wanted to make sure that this is now out there where other people can start working with these firmware volumes. Thank you. So why can't we write to the boot room flash from software? Why do we still have to use this hardware programmer? It turns out that the flash is not directly connected to the CPU. That the flash over here is actually connected to the platform controller hub. And access to it is mediated by things like the management engine. When the system boots, the UEFI forum recommends that all of these regions be locked as quickly as possible. This is done via registers like lockdown that control access to the configuration, the rewrite access. And they can only be cleared during a hardware reset. So this means that once the system is booted, you can't write to those parts of the ROM. But we know that Apple updates the firmware that they pretty regularly ship UEFI and SMC firmware updates that write new code into this ROM. And it has a really nice GUI that will make sure it's the right version for your system and whatnot. But under the covers, it's using a tool, a command line tool called BLESS that takes the SCAP file that is stored in the image that you download and copies it to the EFI system partition. And then sets a EFI NVRAM variable. So the next time the system boots, it sees that variable. And it does what's called a recovery mode boot. So the SCAP file is another undocumented blob that we need to figure out what's actually in it. What are they doing in there? So hex dumps are, it's been too much of my life staring at hex dumps. And it's kind of a good way to get accustomed to what's going on in the machine. We can easily spot the file volume signature there. But it's not at the start of the file. It's actually offset by about 50 bytes. And we see that there's a 50 byte value amongst all those zeros. Based on the firmware volume specification, we know that that's the size of the volume. And we see there's a similar value elsewhere in the header, which actually matches the size of the total file. One thing that you encounter a lot if you do EFI firmware reverse engineering is that there are these 16 byte GUIDs, which they can be frustrating, but they're also marvelous search engine targets. So when we toss that into whatever search engine, we get a perfect hit on yet another EFI specification document. And as expected, here's the header size, here's the image size. And the rest of the fields are all zero. But one thing that we noticed there is that there's an extra 220 hex bytes at the end of the file. So let's look at that. Again, hex dump in it. And it's all high entropy. There's nothing human readable. It's just random values. Well, on the off chance that this might be another GUID, what do we do? We search for it. We get one hit. And it's a mailing list post from just a couple months ago. I wish I had actually found this much, much longer ago. And it's describing a RSA 2048 SHA256 signing and gives us a structure that's 210 hex bytes. So this matches very closely to the trailer that we're seeing. So this is a pretty good idea of what's going on there. So my next step would be let's try to check that. And this is a Perl program. I realize Perl may be worse than Assembly for some people, but it's handy. So it reads in the SCAP file and extracts out the firmware volume and then the RSA public key and the signature based on that structure that we found in that mailing list post. It then uses the default RSA exponent since there's not one stored in there. And I really need to give huge thanks to my colleague, Victor Dukovny, who suggested swapping the byte order to put it into a big Indian. And once we've done that, we built the RSA key. We verify the signature and it's okay. So we now know how Apple is signing their firmware updates, which not only do we know how they're being signed, but we know that the BLESS tool doesn't check the signature, that something in the boot process that does it. And as a word of warning, if you BLESS an invalid file, BLESS will happily copy to the partition, set the variable, and you will brick your machine. You will have to do a full in-system programming reflash of the ROM to clear that. So where are those signatures being checked? We know somewhere in that update process. But it could be hardware, again, the management engine or the SMC perhaps could be helping out, or it might just be software. So if we do a binary grep for those GUIDs that we just found, we find one file in the uncompressed ROM that matches. And it actually matches all three of them. So if we look at the bit of code that works with them, we find that it does the GUID compares, as we'd expect. It checks the file size along with that hex 220 byte trailer. And it also then references this GUID, which is the DXC services table, which becomes very interesting. If we step a little bit further in the code to what refers to the DXC table, we find that it passes the firmware volume, the contents of the firmware volume through a function pointer at offset hex 98 in the DXC services table. To find out where that is, we go back to the specification and they don't give us offsets, but we can count eight bytes at a time because we're in long mode here. And we find that that is calling process firmware volume. That takes the RAM copy of the firmware volume and essentially mounts it and makes it available to other functions in the firmware. If that succeeds, it then calls another function at offset hex 80. And this is dispatch, which will execute any code that was in the firmware volume that was just mounted. So assembly is a little messy. Let's translate that to some pseudo code. We see it does the GUID check. It does the RSA check on the SHA-256. It then calls process firmware volume and dispatch. And that then jumps into the flasher that's in the SCAP file. So we can now, because of what we've learned already, we know how to make modifications to the ROM to find out, you know, to try things out. So one question that I had is, is this RSA check the only place that it's done? Or is something in the management engine or some other hardware also doing it? So I can just comment it out. I can just, you know, put jumps around that so it doesn't get executed. And then I can generate a bogus SCAP file. Now, here's the trailer on it with the usual GUIDs and whatnot. But that is pretty clearly not a valid RSA signature in the file. So if I bless this SCAP and the machine bricks, that means that some piece of hardware is also checking it. But if the system accepts this SCAP file and updates the firmware with its contents, then that means that it's just software. Once again, I'm up here giving this presentation so you can probably guess what happens. The firmware gets updated, which, again, is pretty fascinating. This means that the firmware signatures are only being verified by software. There is no hardware involved. So next question is, can we, could we do this sort of change without internal access to the system? Right now, to make these changes, we have to open the machine and to the ROM. And based on the work that Snare did with the Thunderbolt port, I thought we might be able to. So Thunderbolt brings the internal PCIe bus to the outside world. And when the system starts up, it enumerates all the devices on the bus, and it asks if they have any option ROMs that should be executed. Option ROMs are a legacy feature that literally goes back to the very first IBM PC with that Intel 8080. The BIOS was typically a Masquer, a UV ROM, and there were these six sockets where you could put in optional ROMs that would have things like basic and device drivers for other things. And the ISA expansion bus cards could also carry their own ROMs that would then become available for the BIOS. So that's, we're talking about a legacy feature going back 35 years here. Using it as an attack vector is not a particularly new idea. John Heisman at Black Hat in 2007 showed how to put an attack vector onto an expansion card. And Snare's work on the, was pretty damn awesome. He built a gigabit ethernet Thunderbolt adapter that could backdoor the OS 10 kernel. And that was done in 2012. That flaw is actually still in Macbooks. So, you know, if you put one of these Thunderbolt adapters with the option ROM exploit on it and boot the system, this is one that I built, that will capture your file ball password. I have since changed it to a password one, which is much more secure. So the problem is that option ROMs can't write to the flash because they are loaded in the DXE phase of the boot, but the flash is locked during the PEI phase. However, except during boot ROM firmware updates, in which case the flash is not locked. And we saw that the flasher, the flasher code is running in 64-bit mode, which means the firmware update program is also running in the DXE phase, along with the option ROMs, which leads me to question, are option ROMs also loaded during those firmware updates? And the way that I wanted to figure that out, I could go through and do a bunch of reverse engineering and walking through code and stuff, but that's too much work. So I go back to the infinite loop trick, and I built an option ROM that just does an infinite loop. The EFI firmware is single threaded, so this will basically lock up the machine. So now if I connect the Thunderbolt device with that infinite loop option ROM and power on the machine after blessing an SCAP file, if it goes into the firmware update, that means that the option ROMs are not loaded during a recovery mode boot. But if the fans just spin and the machine appears to be bricked, then that means that the option ROMs are being loaded and executed. So do you guys know what the answer is? Yes, option ROMs are loaded during the recovery mode boot. However, there's a minor roadblock that there is a PEI 32-bit mode signature check of the SCAP file before the option ROM gets executed. So is there a way that we could bypass that check? If we go back to that pseudocode for the flasher verification, remember that process firmware volume is being called via a function pointer that's in RAM, not in ROM. So the option ROM could replace that function pointer in a process called hooking. So we can modify the option ROM to now to hook the process firmware volume function pointer and replace it with its own. And it also then stores the old one so that it can reuse it later.  However, the one that we're using, the Gigabit Ethernet adapter, only has about 32K of space available. So we can't put a full 8Meg ROM image in there. But what we came up with is actually even more interesting, that we can instead put in an RSA public key that we control and the processFirmwareVolume function will search through the firmware volume looking for Apple's public key. If it finds it, it memcopies our public key over it, then fixes up the CRC32 since we now know how to do that. And then it calls the old processFirmwareVolume on this now modified image. And when we now boot the machine again with the Thunderbolt device with what we're called the Thunderstrike exploit because all cool exploits have names these days. So when we boot up the machine, the here's the exploit code running in the recovery mode boot and we're not worried about stealthiness in this proof of concept. And now here is Apple's own firmware update routine flashing our option ROM with our RSA key into the boot ROM on the motherboard. And once that's done, we now own the system and we can flash whatever we want using Apple's own update tools. So and all exploits also get logos and I think theme songs and websites now. So we now know how to circumvent flash security with the option ROMs. And because we've replaced the key, this boot can't be removed without through software alone because we control the key that the firmware is going to use that there's no official channel that can remove it. So how would something like Thunderstrike if it were to be weaponized actually be deployed? You know, one option is something like what the NSA is doing where they intercept shipments of hardware and make modifications as they're seen here doing to SSCO routers. The other ones, the evil mate attack that folks hypothesize in which you're at a conference say in Hamburg and you go down to the hotel to get some breakfast and room service comes in and they make the bed and back door to your laptop and leave some fresh towels. Or when you're flying through international borders. In fact, the US courts have said that there is no protection for citizens or visitors alike at the US border. In fact, in this decision against the US citizen photographer that they said that the laptops are the most dangerous contraband and you have no expectation of privacy. So this vulnerability is in pretty much every MacBook since about 2011 when Thunderbolt showed up. I've personally tested about six or seven and found it in there. The pre Thunderbolt devices are not affected. These also have mask ROMs. So writing to that would be a more challenge anyway. You guys might also have heard of another exploit called Stuxnet that spread via shared USB media and was able to get all the way into the air gapped SCADA systems of Iran's nuclear refinement system. It turns out that option ROMs on extra on Thunderbolt devices can be written from that early boot code. So this allows Thunderstrike to actually spread virally through shared devices. So you have a Thunderbolt device that you share between machines at work and it is able to go across them. So all Thunderbolt Mac books are vulnerable. They can spread virally. What can we do to prevent this? So I've been in contact with Apple and they have a, on their new machines, the Mac minis and iMac retinas that we've tested, they're no longer loading option ROMs during firmware updates. They will be rolling this out for the other Macs. However, they're still loading option ROMs on normal boots. Snare's attack from 2012 still works. You can still get backdoor'd via the OS 10 kernel. It's also possible on the older machines to do a downgrade attack that you can downgrade to an older, vulnerable version of the firmware and then attack it that way. And Thunderstrike v2 could use the dark Jedi sleep attack, which you may have heard of. It was introduced yesterday here at 31c3 by Rafa and Corey. And what they found is that during a s3 sleep, all of the lock bits are cleared, including a flock down in the BIOS control. The Thunderbolt option ROM is in a prime position to be able to do the sort of attack. It doesn't need to do any privilege execution. It's already running in ring zero. So there was not enough club mate for me to actually implement this last night, but look forward in an upcoming paper, perhaps. So Apple could add TPM hardware back to their Macs. It wouldn't prevent the dark Jedi attack, but it would at least let you detect it on the next boot. They could also implement driver signing. Future EFI protocols have it as almost mandatory, but the version they have has this rather ill-defined security, architecture-specific security protocol. And they do implement that, but this is the entirety of the implementation. And it turns out that actually proto can never be null, so it just unconditionally approves every option ROM that it encounters, which does not provide any security at all. So because I don't think option ROMs are a great idea and none of my devices need it, I've modified all of my MacBooks to bypass this call to process option ROM. And Thunderstrike actually does this on the systems that it infects, so you can't actually use Thunderstrike to remove Thunderstrike. It's closed the door behind it. However, closing down the option ROMs might not even be enough. How many of you plugged into the projector up here? How many of you actually verified what the connector was that at Black Hat earlier this year, the alloy viper was deployed? It's a decoy VGA adapter. It's kind of hard to see there, but it daisy-changed to a real VGA adapter, going through a slot screamer, which is doing active DMA attacks against the PCIE bus of the running system. And it can backdoor OS X with a little bit more work. It could actually launch a Thunderstrike attack as well. So I believe that we need a way to disable PCIE functions on Thunderbolt entirely, that if you just want to use it for your display, you shouldn't have to expose your system to this sort of attack. I've done a little bit of work trying to do this. This would be a lot easier for Apple to implement as a configuration option, just like they do right now. But if you set a firmware password, the machine won't boot from external media, because that's a security risk. If you have a firmware password, it shouldn't load option ROMs. You should be able to turn off these things. You could also go a little more extreme. Last year at 30C3, Peter Stujer suggested hard wiring, right protect pins, and desoldering programmable controllers. And he went through a bunch of work on how to harden a ThinkPad against external attacks. And if you do go that far, you also should consider using some sort of tamper-evident coverings over the screws to figure out if anyone has opened your machine. This is as suggested by Eric Michoud last year, also at 30C3. So to sum up, how bad could an actual weaponized version of Thunderstrike be? There's nothing looking for firmware root kits on OS X right now. It's in control of the system from the very first instruction. It can backdoor the kernel. It can log keystrokes. It can exfiltrate data. It can't be removed by software, since it controls the RSA keys. It also controls the update routines. You can reinstall OS X, and it will still be there. You can swap out your SSD, it will still be there. You can swap out your laptop, and your Thunderbolt device might reinfect your new one. So it's very persistent. It can also hide in things like SMM, virtualization, or maybe even the management engine, although that's another area of interesting research. It can spread virally via shared devices, and it affects all current models of Intel MacBooks with Thunderbolt. So that's a pretty bad combination of things, if somebody were to actually take this and turn it into more than a proof of concept. But what would really make it worse is I think this is actually remotely installable. Combining the deep Jedi coma attack with option ROMs embedded in the system, I think this could actually be launched with just merely a root exploit onto the system. So on that cherry note, I'll take some questions, and also we'll be having a workshop for folks who want to do a little more deep dive into the into the firmware images in Hall C in a little while after the talk. Thank you very much. Tramol, we have some time for questions. First are there questions from the internet? Yes, thank you. There's one question from the internet. How many Macs have been destroyed making this presentation? I have been quite lucky, both with Magic Lantern and with this project, I have managed to not brick any machines. Okay, you can also line up behind the microphones if you have questions. There was a second question from the internet. No, then microphone number one, please. Thank you. It was very, very cool presentation. If you have been thunderstruck and you bless an original firmware, will you brick the machine? Yes. Is that something that thunderstruck can prevent? Yes. It's the proof of concept is very, very simple, and it could actually be much more sophisticated. It could detect that this is an Apple signed file and do something different. It has total control of the update process, so it could even allow the update to go and then patch it after the fact, depending on how sophisticated you want it to be. Or it might just pretend to run the update and then ignore it. Okay, thanks. Microphone number two? I understand that you have to request the EFI upgrade while that thunderstruck device is attached in order to do the exploit, or is it possible to do it just by attaching it without having an EFI upgrade? So the option ROM can initiate an EFI update that it can basically anything that the kernel could do, the option ROM could do. But does it have to be attached during the boot phase, or can it just attach it while the thing is running if I want to? So in this case, with a passive device like the Gigabit Ethernet adapter, the machine does have to be rebooted. Okay, so just attach it while it's running to a second screen should be possible, but I have to reboot it basically. Yes, you do have to reboot it. So from the perspective of someone who's been attacked, they come back and they find their machine is rebooted, or their machine is shut down, and they would say curses. It's pretty rare that Mac's crashed, but they do crash occasionally. So it's not out of the question that would tip them off. Thanks. Microphone number four. Hey, so this attack would be mitigated on PCs with Thunderbolt by Secure Boots requiring option ROM signing, right? Absolutely. So a case where Secure Boot does actually protect against vulnerability being demonstrated on stage? I believe so. Awesome. Thank you. Microphone number five. Hi, thanks. Thanks for your talk here in the back. Can you imagine this working on other laptops too, since this is an PCI Express option ROM thing, could this be done on not Apple devices too in some other fashion? So John Heesman's work was on a PC using just a generic PCIe card that had a programmable option ROM. A lot of SATA controllers have them and are potentially vulnerable. The ease of sort of evil man attacking a MacBook via Thunderbolt is much, much simpler than having to open up a PC and put a card into it. Okay. Microphone number one. So this would also apply to other machines with Thunderbolt, for example, as a better Lenovo have Thunderbolt now.  Or if somebody has a private key and signs some malware with a private key, then you are vulnerable, I think. Exactly. And as Matthew had pointed out, that if you have a Secure Boot that actually signs the option ROMs, then they would not be vulnerable to this. Although a device with Thunderbolt would potentially be subject to the Slot Screamer attack, which was an active PCIe DMA device. Another question from the internet? Yes, thank you. I've got two other questions. The first one is, could you imagine of a pure software solution as well? And the second one is, is there a way to detect that the ROM is tampered with? So to the software question, I could imagine perhaps someone could produce bug-free software and BIOS updates. But the number of presentations that find flaws in software, particularly in BIOS updates, makes me think a software only solution is unlikely. And what was the second question again? Is there any possibility to detect that the ROM is tampered with? So in the proof of concept, it's quite trivial. It actually advertises itself with the logo. But a weaponized version would be very hard to detect, that if it's hiding in either system management mode, it can detect attempts to read from the ROM and serve up a clean copy. Or it could boot the system into virtualization and just provide a complete virtual ROM that looks intact. Microphone number two. Are you missing any features like booting from network if you disable the option ROMs? No. It turns out that the modern MacBooks have the driver for the Gigabit Ethernet adapter bundled into their boot ROM already. So the option ROM is completely superfluous. It starts no purpose. Thanks. Number one. Okay. Two quick questions. First, if you mentioned, I think that you have to bless a firmware update to launch the attack. So if I set a firmware password and shut down my computer before I leave it in my hotel room, can I prevent it? No. The firmware password is actually checked after option ROMs. So there's a much simpler attack that an option ROM can actually just clear your firmware password. And to the other point of your question, the option ROM doesn't actually even need to boot OS 10. It can just set the NV RAM variable and initiate a recovery mode reboot from the option ROM. Because it's in ring zero. It can do pretty much anything. Microphone number three. So do you think that a open source solution, do you think that an open source solution as opposed to an open standard solution would be able to avoid this problem or have you investigated in particular core boot? If core boot is vulnerable to this problem, I believe core boot is not vulnerable to either Thunderstrike or to the Jedi coma attacks. I have not done really any work with core boot. So I'm not sure, although in general, we should talk then we should in general. I think that having open source for the for the early boot is really vital both to trust that the system is doing what we think it is. And this is one of the reasons I'm really excited about things like bunny's laptop that we're all of the source for every piece in the system is available so that we can actually understand how it all works. We are running a bit out of time. So please keep your questions and possibly the answers short microphone number four. Yes, as you've shown, the firmware update not only contains a signature, but also a public key. What happens if you replace the public key and then just create another signature? Have you tried that? I'm sorry. Oh, yes, actually the I didn't go into the presentation. I have a paper that I hope will be coming out sometime soon that actually goes into a lot more technical detail. The the public key in the signature is actually ignored. You can write whatever you want there and it doesn't matter. The the public key is actually stored in in the in the boot ROM. There are actually five public keys, but only key zero is ever read. And that is the one that is actually used to validate the signature. Thanks. Microphone number two. Have you looked at other attack factors than Thunderbolt that expose PCI lanes like express cards? I have not, but I've I've received email from someone who has looked at it and suggests that it would also be vulnerable to this sort of attack. Microphone number one again. Can I launch this attack from another MacBook with a Thunderbolt cable or do I need special hardware? That's an interesting question. I have not looked into that whether or not if you boot into like target drive mode, could you could you fake it out? Possibly. That might be cheaper than I don't know. I haven't looked enough into that part of the firmware. Microphone number five. Yes, you said that with your exploit you can close the door behind you for this exploit. Can you provide the service to close all our MacBooks? If anyone would like to borrow a Thunderbolt Ethernet adapter. So right now my my proof of concept is has a lot of hard-coded things for the specific version. So I verified that the the sort of exploit works against the other ones, but I've only actually implemented the 10 comma one MacBook. So if you have one of those I'd be happy to let you upgrade. Microphone number three. Okay, so I'm wondering since the option ROM is only loaded during boot and you can basically as far as I know prevent DMA access while the system is running by setting a firmware password and you said it's possible to write the option ROM if you are early in the boot process. Is there any way once you've booted to check if your Thunderbolt adapter has been infected? Potentially. So from a clean system you could read out the option ROM and find out if it contains the an exploit in it. But once from a infected system if it were being sufficiently stealthy it could mask that attempt to read. And you had a second question that I actually I thought was was quite good that um oh regarding DMA there's a lot of interesting work being done with Thunderbolt and DMA attacks especially looking into how well does VTD and the IOMMU actually protect you and it's not clear that it provides as much protection as we would like. Microphone number four. Okay, forgive me if this is a stupid question but other than open sourcing the boot process entirely which is a no brainer could vendors protect against this kind of attack by using something like timing based attestation of the boot firmware so knowing the timing signature that the legitimate firmware has and measuring that in the operating system or some another kind of electronic device that measures that that then if an attacker uploads their own malicious firmware they at least have to emulate the timing side channel of the legitimate firmware. So to the first part of the question I don't think so the MITRE presented a really neat piece of malware called a TIC that I think was 51 bytes and was capable of beating the time timing based attestation. The other is that it could boot the system under a virtualized environment or it could just rewrite the timestamp counter that it's you know it's in ring zero it's in real mode it can do really whatever it wants. Thank you. Another question from number four. Just very two very short questions. The one was to verify again you said the current iMacs and Macminis are not affected and future Macbooks will won't have this problem. That's so Apple has produced a fix that they are shipping in the current Macminis and iMac retinas that protects against the proof of concept however it leaves out a huge hole in terms of the option ROMs that I believe could be a Thunderstrike v2 would would fairly easily be able to attack. And the second question was proprietary TPM modules have been criticized what do you think is is are they more helpful or are they in any kind do they have any drawbacks if they're not open source so is it better to have a machine with the TPM module or without one? So perhaps TPM is not not exactly the right word but some systems have sort of you know co-processors or sometimes even hardware devices that will leave the main CPU and reset until they do cryptographic verification of the boot ROM. So that's the sort of technology that I think is really necessary to detect these sort of attacks. There's a huge number of papers about defeating TPMs and secure boot via other techniques so I'm not sure how well you know proprietary TPM versus some more open source one would really be able to do. Okay one final question from number two. Just to make sure it's not that I can't leave my computer in or I can't leave any of my Thunderbolt device either right? That's that's a great point yes you should keep your Thunderbolt devices with you along with the computer. And having said that would it theoretically be possible if you do achieve code execution from the Thunderbolt device to actually perform tests through that code could I create a Thunderbolt device that actually uses an option ROM to check my own EFI? You could unless you're running unless you've already been hit in which case the option ROM won't be loaded. At all. Okay. So all of my machines are protected in this way that they will not load option ROMs which is also you know the sort of thing that would be great if it was a configuration option just to be able to say you know don't do this versus. But then you'd know if it doesn't execute then you'd know. Oh if it had some way to let you know that it had executed I suppose it depends how targeted of an attack you're expecting. Okay so please give again a round of applause to Tremul.


For 0.7GHz gas, Olga has quantum cascade lasers with four quantum well structures are reported, achieving high peak output power and maximum operation temperature. This article was offered by Kater O'Harney, Dana Turinkova, Christopher Bonzon, and others.


The House of Representatives Committee on Public Accounts partnered with the Office of the Accountant General of the Federation and the Lagos Mainland District of the Institute of Chartered Accountants of Nigeria to organize a national workshop on the Auditor General's Queries and the ABC of Responses. The workshop was meant for officials of government ministries, departments and agencies as plus TV Africa's correspondent Destiny Momo on our reports. In an audit, queries address issues where the Auditor General needs further clarifications to erase doubts and address disagreements. The queries may also be the questions asked by the Auditor General during an investigation to gather information to conclude an audit. The key issues in responding to Auditor General's queries and the fundamentals of technology innovations and compliance initiatives at the major discuss in this workshop. The Auditor General audits all governments pending every year by carrying out interim and annual audits as well as ad hoc examinations when the need arises. Key members from the National Assembly and the Institute of Chartered Accountants of Nigeria speak on the need for the provision of answers to these queries. As of Chief Executive Officers to be alive to their responsibilities in terms of rendition of audited accounts to the Auditor General for the Federation for his comments and subsequent report which is expected to be laid before the floor of the House and of the Senate. What it's meant, this workshop is meant to do is to look at the work of the auditor and the audit query holistically. Audit queries is a phenomenon in the Nigerian environment so to say in the sense that every now and then the Auditor General for the Federation encounters issues, sometimes unexplained issues. Delegates speak under plans for their respective organizations after this workshop. Yes I think it's trying to drive the culture of financial, regular financial reporting, reliability of accountants reporting from the MDAs. A useful one considering that when we prepare we are accountable for whatever the government has given to us. The workshop is meant to help enclosing the technical operational gaps brought about by the introduction of emerging technology disruptions and of course the consequences of the COVID-19 pandemic. Destin and Marmo for Plus TV Africa.


All right, new version here. There's sound. I'll tell you boys, life is crazy. One day you're in community college, driving a Camaro Teetop, Coca-Cola walk, and then you need some cash, so you get a job. You think it's only temporary, but then you get a promotion, and then a raise, and all these doors open up for you. Except they're not really doors. They're trap doors. And then all of a sudden, bam! 20 years has zipped by, and you're thinking, is this all I have to my life? Not you kids, I love you kids, but come out of the house. It's crap! I'll tell you boys, life is crazy. There is a lot to go through. I'll tell you boys. And you are mentioning here, hold on. It's mostly the lower part of the face and body mechanics. So I think I'm going to go through... It's overall great. I really like it. Sometimes I'm a bit worried about stuff like this where you have... It's more simplified textures, and then you have fairly complex textures, or more complex. And then you have photo reel, photos, photos are photo reel. In the background, it's an odd mix. I will probably do something where you put that type of geometry back there a couple of times and do a hardware fog and kind of haze it out. Like you start off and it's a cool look for sure. It's just... Maybe it's just me. Sometimes there's such a disconnect between a photograph and then CG objects since you're already taking care of the look. But it's nicely placed. I do definitely like it. And I've seen... I was going to say I've seen worse. It's not that bad. Sometimes it's really, really distracting. And I don't feel like it is that distracting here. But just as an FYI, you're paying me this workshop so I'm going to tell you everything that I'm thinking here. Sometimes it's a bit odd to see just that mixture of super sharp and texture stuff and then you have kind of a photo in the back. I don't know. It's cool stuff though. I'll do like it.  Still like the beginning? I like that intro. But let me go... They're little things animation wise. It's not too crazy. For me, it's more the combination of the energy of the sounds with the energy of your body mechanics. I think I mentioned that before, but there's some areas that still stand out a little bit. So let's go one by one. I'll tell you boys, life is crazy. So that's okay in terms of sound. Don't mind. What caught my eye is that you're fanning out that arm and you have that exposed hand gesture in terms of... You can clearly see the fingers. And then you do it again. It's a bit of a... It's a bit double and maybe just the way it's modeled and from that angle, but it seems like at that point they remind me of... This is an alien creature. It's like in strange worlds or just an alien thing where you have the fingers and then it's bulbous at the end. How they kind of stick out there might just be me, but I will probably stick with something like that hand towards us like this. I'll tell you boys, life is crazy. And then you can do a life is crazy like that and maybe just not spread out and fanned out. So maybe just the bits.  I don't know. It's pretty big. It's almost like you want to stick with that kind of pose on this. That just seems over-exaggerated. The thumb is really high up there. That's the only thing that bugged me there. I'll tell you... Tool of this. I'll tell you boys, life is crazy. Now, for me, I will keep it like this.  And not have this and also not have that. Just throwing it out there. Your shot, do what you want to do. I'm usually in the lesses more when it comes to arm gestures, fanning out, opening up hands and stuff like that because you do have something here already. Life is crazy. And I don't think it's needed. And again, like this opening up so sharply and then having the fingers out like I look here and I stop looking here. And that's the main reason why I'm saying have this as a nice line here. It's a nice pose, the simplified triangle, finger pose and everything. But that way the focus is always here. I'll tell you boys, life is crazy. You know, I don't know. That's just me. Rest cool. Life is crazy. I love all this. I love the silver of this, the bite and then how the that is great. I love all this. One day you're in... Thank you back. I don't think I've ever animated with that's the Apollo rate, but I remember reviewing it a while back. It's just so appealing. I love the face. Anyway, that's all cool. I think your sausage is a bit soft. That's an odd thing to say. Never mind. I'm just saying this wobbly thing. One day. Just because I came back from Switzerland like two weeks ago or something like that. And we ate a lot of sausages.  That's the country for that. And stuck in here on the grill. They're going to be pretty hard. I know this is the oddest, most inappropriate review ever. But I would just not have that wobble so much. Keep it a bit firmer and stiffer. There you go. I said it. I said it. It's horrible. Here's the first one. Okay. I'm continuing with the inappropriate. Cock. I can't even say it out loud without laughing. I'm so immature, but I'm going to stick with it. So you're in community college driving to Camaro T Top. Cock-a-la-walk. That. Cock-a-la-walk. There's such an accent there. T Top Cock-a-la-walk. That I would have a little bit of maybe a slight shoulder raise, but a little bit of shoulder chest up, but definitely a head up accent. Or you can do like a side twist or something, an accent on that word. Driving to Camaro T Top. Cock-a-la-walk. That's cool. I like all that. Careful again with the hands. College driving to Camaro T Top. You have this here. Cock-a-la-walk. And then you do it again. You need some cash so you get a job. And then you have it again. So I'm just worried about the repetitiveness already. So to me, this I like because it's such a strong silhouette that I would have... You can keep this one. I would still have it below and not have it at all. Cock-a-la-walk. And then this one would be like no higher than this. He's just acting things out and that's how we're framing this. It doesn't go that high. And then you need... Because again, I love looking at this. And then... And suddenly I'm looking down because this hand comes up. And you need some cash so you get a job. I would keep that one. You think it's only temporary. Don't mind this one. That's okay. Watch out at the very end. That's a linear pop there as that hand goes down. You can easily go down once it's covered. So I would just keep that up here. Watch out spacing-wise. We're having a rotation this way. Bam. And then we're locked here. You can see these are a couple of frames. We kind of locked two frames. In 2D space, sometimes it's all when you animate something to camera. It gets kind of locked. Watch out for that. Right. But then you get a promotion. That's okay. You think it's only temporary. But then you think it's only temporary. The temporary is a bit mushy in terms of the lip sync. Let's go back here. Crazy. Crazy. I might just be a player too. Life is crazy. Crazy. I know sometimes it's like two frames off. But I think it's the player. One day you're... Maybe the clip is long. Community college driving to Camaro T. Top cock-a-la-walk. Top cock-a-la-walk. Even the cock... I would open the jaw just a bit more over the head accent. Cock-a-la-walk. And then you could almost have less... That's almost like a burp. Like I would probably use this by 20%. By reducing, I mean, just the amount of opening. So it could be somewhere here between these two and not as wide corner-wise. And then you need some cash. So you could... I love the lips. Need some cash. Cash. Need some cash. Bit sharp, I think. On the eyebrow raise. Need some cash. So... It's not crazy, but... Need some cash. I'll put that at the bottom of the list. So you get a job. You think it's only temporary. But then... Yeah, so a temporary. A temporary. But then... You get a promotion. That's okay, like I said. You get a promotion. It's not too fast just yet. We are borderline pose to pose and notice moves down first. But then it's fairly in sync. You know what I mean? Like you can draw a line here, here, here. And then it finally breaks free. So just through there, it's a bit linked. The sausage link is linked to the face. Motion. And then a raise. And all... A bit fast. A bit fast. I would slow down that from here to here. Just by two frames. Literally just two frames. And then a raise. Only because... And then a raise. It's so... And then a raise. But in the voice, it's just... And then a raise. It's more... It's not that it's a whisper. But I'm not hearing... And then a raise. That amount of exertion. It's not huge. That's what I'm saying. Just two frames might just soften it just a little bit. And then a raise. And all these... And all these doors open up. And then a raise. And all these... This is a bit fast. I would probably tweak this. Slow this down. So when that goes up, this goes down. And the sudden fanning out. Adds two, three frames to that. More so than this note. So when I watch this again. And then a raise. It's like... A bit fast, but there is a wobble there. Which helps with the softening. And then a raise. And all these... But then... And then a raise. But then... This just seems a bit fast.  If you open up the fingers first. And you almost anticipate that move. And then... I did not that fan out. It just seems like... Wait! We suddenly go out. And it's... He almost wants to sell that more. Where he goes... Where he might raise the shoulders first. To anticipate. And then on this. He can drop them a bit. All these doors open up for you. Except... You get a promotion. And then a raise. And all these... But then... You get a promotion. And then a raise. And all these... And then this seems a bit... He goes... A raise. A raise. And then... So for me it's... We're going into this pose here. Body and headwise, right? We go to the screen right. And then a raise. And then... A... It's a bit sharp. Not sharp. It's just the angle. It's very flat. How we go up. Hold. And sell it to the left. And then the audio... A raise. And all... It's almost like a raise. And all... I feel like you want to anticipate... The next step. So he goes up. And then imagine he goes down a bit to the left. And then comes back up here. A raise. And all... It's a little bit of a... A little bit more rhythm. It doesn't have to be a crazy arc. And all these doors open up for you. Just a bit more. I love this here. I love the expression and that. It's great. And all these... We are a bit in the W pose. But... It hasn't been really twins. Covered enough. So that this is the first time. And all these doors open up. And it's okay. I'm always kind of like... Watch out for W poses. But it functions as in like... Ta-da! The doors open. And you do have a nice change of finger posing. There's a height offset. I think you're okay. A bit even. I would probably group one of the fingers there. For you. Except... They're not really doors. They're trap doors. That's the one where, again, the energy... They're trap doors. Is a bit much. And I hear it in the voice. They're trap doors. It's definitely big. But this is a... They're trap doors.  I don't mind the sausage being... They're trap doors. More limp there. But... I would reduce that. Probably, so if we're up here...  It might just be... You don't go this low. You only go this low. And maybe not that far. So the head is maybe a bit higher. The neck is a bit straighter. The head is a bit higher. Just to kind of reduce that intensity a tiny bit. They're trap doors. Even this expression... Trap doors. And then all of a sudden... I know. Again, subjective at this point. But... Trap door. It seems so much more intense. And there's so much more movement... Visually than I hear in the voice. Of course. And then all of a sudden... That's okay here. And then all of a sudden... Bam! And then all of a sudden... Bam! That one's okay. And I think that's what I mentioned before. Where you want to be careful to not lessen this. Now, it's definitely not lessen. Because it's such a broad expression. But this is already so intense. That by reducing this... Trap doors. And then all of a sudden... Bam! This is going to have more impact. But right now, all you're doing is... Up and down. Definitely with this end of cuts. The cut definitely helps. But this is... A stronger body change. Trap! With that stab. You know what I mean? Trap doors. And then all of a sudden... Bam! It just seems less eventful. But this is his moments to... To go full contrast. So that's my reason too. Just for lessening this a little bit. And then all of a sudden... Bam! So that we can give this a bit more breathing room. And then all of a sudden... Bam! And this is picky. And I might... I don't have a longer version there. This is for you to experiment. But I will probably cut... Three frames sooner. It seems ever so slightly late. Three or four frames sooner. Into this shot. And then this one. 20 years. It has so much more energy. And you can even hear it in the microphone. The levels are peeking out. 20 years. It's just... It's so loud that... 20 years. I would have a stronger... Something with the body forward. A bit of a shoulder shock maybe. But definitely head accents. And then all of a sudden... Bam! 20 years. Like to me it's like 20 years. Like you're rounding the shoulders forward and up. Like a caving in of the chest. Because there's so much energy there. 20 years. 20 years. Has zipped by. And you're thinking... Is this all I have to my life? Look at that face. I love the folds here. Not you kids. That's fine. Oh, I remember you with the camera. Not you kids. That's lessons. Yeah, I like this. Not you kids. Might be still a bit low here. Not you kids. Yeah, it's tricky. You would have to... Pan down... A tilt down. Pan over and tilt down more. But then we don't have so far. Then we're back. To where we were. I think... Not you. I know that that was the note last time too. But I think you can afford to go from here. And only this far. Not this low. Reduce the height. It's not crazy. But just... We're initiating such a move over there. And we're ending here. Which you might argue that's good. Because now we're looking at the kids. But we don't want to lose the focus on him. So I think you... You could be okay. 20 years has zipped. Like imagine he goes... Bam! 20 years without forward cave. So that the head ends up in here. And then zipped by so that he's still around here. Is this all I have to my life? And into my life he might even go a bit further to the left. So now he might be a bit here. Right? And then as he goes back. He can even shoot back a little bit more. My point is that if you do all this. And you lessen the amount. He goes to the right. And down. His head might end up being... You know, he might end up being only here. And then if you have that. We're pretty good in terms of... Oh, we can still look over here. Not you kids. This arm stops a bit too abruptly. It's mechanics wise. It feels like we're going... And it's a bit too... I know he's kind of tense of... Not you guys. Not you kids. I love you kids. But I would either overshoot a little bit. Or ease into that a bit more. Not you kids. I love you kids. Come on. This is definitely too fast. Don't hear that in the voice at all. That's probably the most distracting one. Not you kids. I love you kids. Come on. The house.  And by slowing it down. It's also going to help you with the camera. It feels completely out of place. There's no connection there with the audio. Not the house.  And then this one. Come on. The house.   But come on. The house.  It seems too little in terms of just raising him and bringing that head up.  Not you kids. I love you kids. But come on. The house.  It's almost like you want to go up and down again.   Or you go up with a bit of a left right shimmy.  It just seems a bit simple. Compared to what the voice is doing. Again, the energy and body mechanics don't quite match. Subjectively of course as always.  And then careful here. Maybe that's the thumb having a bit of a tangent with that forearm line. You have to. And it's fine. It was that runs you the critique. I just gave someone else where he says. I love you kids. But come on. The house.  Like that's a statement. He's like cool. Come on. This is it's a crappy house. Look at this. Arm out. Hands out. It's almost apologetic. So like. He's a bit stern here. So it's not like a full apology, but this feels more defensive to me versus someone. It goes guys. Come on. This is a crappy house where he would. He would almost lean in. Not that far. But it's like guys. Come on.  Not that you want to do like arms down.  But it's to me. This seems more apologetic. Like I said, and it would be more of a statement where I would lean in forward and you can maybe have that arm down. Now that's not a fist, but something a bit stronger where he is, he is convinced of his statement. And he thinks he's right in his world. And that's kind of that. Alrighty. Thank you. All right. There's an email. You can sign up. You can start whenever you want. You can submit whatever you want. You get 16 submissions. Either way, like and subscribe would be awesome. All right. Thank you.


See if you follow this, in math we have what's called a transitive equation. A equals B, B equals C, then A equals C, C equals A. The reason for this equation is you can apply it in real life. You can even apply it towards the Bible. For example, A equals B, B equals C, then A equals C. In this equation, A equals God, B equals the Lord. So since the Bible tells us in places like Isaiah and Deuteronomy that God is the Lord, then A, God equals B, the Lord. But the Bible also tells us that B, the Lord, also equals C, C being Jesus. Jesus is the Lord. And if A equals B, B equals C, if God equals the Lord and the Lord equals Jesus, well then guess what? Jesus is God. That's simple.


This is stock number 20 T31. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used. Ram and light-duty truck headquarters. Today we are checking out this brand new 2020 Ram 1500 limited crew cab 5 foot 7 inch short box. This truck has the 5.7 liter V8 Hemi motor with MDS and e-torque. Del Monaco red is the color and this one has the split tailgate on it and it is loaded up with just about every option that you can get on these rams. So I want to do a walk around here just give you idea of the overall styling and looks of the truck and then we're gonna get up close and I'll go over the exact options take a look at the window sticker and check out that new split tailgate and all that good stuff so keep watching here. This one has the 22 inch polished aluminum with the painted inserts alloy rims and Goodyear Eagle Touring tires. These tires are 285 45 r 22's and they are more of a highway tread on there. Like I said Del Monaco red is the color LED running lights LED headlamps LED fog lamps front bumper parking sensors this one has the 360 camera on it also has adaptive cruise control and all that good stuff. We'll turn those headlights on in just a second here when we do our final walk around. You can see the truck looks pretty low that's because it's in the mode where it's the exit mode basically so it gets down as low as possible to get in and out easily. We'll take a look at that window sticker it does have the power running boards so feel free to pause this at any second I'm not going to go too much into depth into what this thing has because it'll take the video way over time limit but you can see it is a limited crew cab total MSRP 70,160 as the anti-spin level one this is a limited level one has a protect protection group the Hemi with the e-torque the dual pane sunroof multifunction tailgate 33 gallon fuel tank the 22 inch rims and they trail a break very safe vehicle five stars overall five and four front five-star side crash and four rollover 22 highway 17 city for an average of 19 and we're going to get into the interior in just a second here I really want to check out the multifunction tailgate because that is new for 2020 you'll notice it's got those tie downs in the corners now I think though they put those tie downs there to give the bed a little bit extra strength because when the tailgate you know when we got this split in the tailgate it probably loses some of its rigidity so anyways to get this tailgate down normal you can either do your key fob like this and that'll power drop down the tailgate like so and you can see it's nice and flat right here so you're not going to have too many issues if you're sliding stuff in and out so how you get that tailgate open the gateway there's a bottom button here to get it open the normal way it's the top button to get it open like this it's the side button so you go like that now there's only one way to close this you got to close this side first which means that you have to open the other side first so the theory behind this is it's really easy to get up very close to the bed so you don't have to jump in to reach to the almost the middle of the bed and a little bit past you'll notice it does have the spray and bed liner the LED bed lighting and stuff but just makes it easier to get to the bed of the vehicle and to get in now you can just step right on the bumper and you can see I'm inside the bed pretty easy same thing getting out just step on that bumper and it's a it's a very easy step down now to close it you have to close this side first otherwise it will not work and you'll end up with body damage on your truck but you can see it shuts nice and solidly and really a neat function on that tailgate I don't want to spend too much time on it because there's a ton of stuff to go over inside the truck dual rear exhaust back of parking sensors full towing package receiver hitch four pin seven pin wiring LED tail lamps you get the fender flares part of that limited package all the Rams now come with the capitalist feel-fill which is a nice feature if you've never used it entering go system the power fold-in mirrors with the built-in directional signals blind spot and heated elements also has the blind spot mirrors in it inside the limited level one gives you the all leather black seats with the gray stitching and piping lumbar both these seats are heated both these seats are cool do you have the all-weather floor mats back are in here the Harman Kardon sound system power windows power locks and the power fold-in mirrors as well and both sides power fold in and out memory driver's seat you got the cool stitching and woodgrain trim on the doors auto headlamps power pedals the steering wheel now tilts and telescopes and as we hop inside you got these seven inch seven inch LCD display outside temperature and compass display and just a ton of things that you can do with that seven inch screen you get the heated woodgrain trim steering wheel there's your adaptive cruise and normal cruise controls that's the adaptive cruise so it'll actually keep you a certain distance from the car in front of you and speed you up to make sure that you're maintaining that distance Bluetooth and information center controls for that seven inch radio right here on the back is steering wheel controls as audio controls for the radio this one has the 12 inch touchscreen radio you got the factory nav this is the 4c radio so you can do Android Auto and Apple CarPlay on this screen so many things to go over on this radio we're gonna have to dedicate a video just to that you can see it has the 360 so you can see all the way around the truck and it has the HD camera there with the dynamic grid lines this one also has lane departure and your perpendicular and parallel park assist where the truck will actually park itself so really cool stuff there down here you have more controls for your heated seats and cooled seats heated steering wheel your powerboards you can turn that off and you can check out your cameras there as well down here you have your factory brake control your height control stability control tow haul mode you get two USBs two USB C's and an aux jack this one has the RAM charger so you just put your cell phone in there they'll actually charge your cell phone wirelessly and down here you have a hundred fifteen volt four hundred watt plug-in the trim on this truck is just amazing this one also has the full vista roof so the fixed glass second row glass roof and then the power sunroof in front you get the assist and SOS systems here you can put your tailgate down from inside the truck and then you have all your controls for that sunroof in your power side rear window map lights up there you got your home like buttons for your garage door security systems and lighting systems and the auto dimming rearview mirror we'll take a quick look at the back seats so these back seats are heated and cooled if you ever seen the RAM commercial and they say back seats that do front seat things that's what they mean they they also recline which is a always reserved for a front seat thing it's really hard to do if you're not sitting in the seat there you go so you can see that that seat's actually reclined it goes up like that they have all the nice stitching back here as well power sign rear window with the built-in rear frost you get the flat floor and back you also have a storage compartment so you can put like a storage bin just put that up and you get a hundred fifteen volt four hundred watt plug-in back here to usb's and to usb c's I'm running out of time so we're gonna finish this video up here and personally I like thank you for checking out the video today and I hope from this HD video you have been able to tell a little bit about this truck I turned those LED headlamps on so you get an idea of how bright they are they are amazingly bright and I hope you were able to check out the truck and if you want to see more pictures of this truck or one of our other 450 new and used cars trucks SUVs minivans wranglers half tons three quarter tons one tons you name it we got to go to our website www.summitauto.com full pictures and descriptions of every single vehicle from two locations all at summit auto.com and if you like to check out more HD videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos I see there in fact in a second you'll see a link to subscribe to your channel on the left link to more videos on your right and if you're not been to our website on the bottom link to this vehicle


Okay, so what are socket testers? Okay, so I just got this definition from Wikipedia. So socket tester or receptacle tester is a small device, okay? 3-PROCK, 3-PROCK power plug. Okay, so it's plug your power socket and then it has 3 indicator lights. Okay, so the lights will indicate if there's any fog in the wiring of your power socket. Okay, so the power socket here that I'm using is this model Harvotest HD107E. Okay, so the 3 indicator lights are actually on the top. Okay, so this socket tester is a bit more advanced. Most socket testers actually don't have so many features. They only have 3 lights, but this one also have an LCD screen there. Okay, so this is a bit more advanced. Okay, so you can see from the status here, right? Depending on which lights come on, it will indicate what is the fog in the power socket if there's any. So currently, so you can see when I plug to a proper working power socket, right? The first 2 lights come on. So you can see these 2 lights on. So it means, correct? If it's anything other than this state, that means there's something wrong with the wiring already. Okay, so this LCD display also shows extra details. Okay, so the RCD current to test. Okay, so this first value, 37mA, is the amount of current that it will pass to the earth line so that to actually simulate earth war. So you can see this big one over here. So it press this, right? It will send 37mA from the life to the earth. And then you will trigger RCCB trip at home. But so it don't anyhow press. Okay, so okay, then the next one is the life to neutral voltage. So 237, okay? Pretty normal. Another one is the neutral to earth voltage. So this one should be 0, or at least close to 0, to be normal. Okay, so let's go into the functions of this socket tester. Okay, so I just plug it here and consider it guys. Okay, now it's green. So it's okay. Yep, I can see. Okay, I'll just leave it here. Okay, so these are all the functions. When everything is good, right? It just shows the first 2 lights. Okay, so I actually simulated this. So I just take the very wires and connect to the pins behind the socket tester to simulate the different ports to try to engage all the different modes. So let's say there's open neutral. So open neutral means that the nothing connected on the neutral light. Then you will show only one light, the middle one. It can show life and ground reverse. So I simulated here, life and ground reverse. Then you show you the second and third light. Then there's also life and neutral reverse. So only the left and the right light. Okay, okay. There's also other modes like open ground so your earth wire is not connected. Okay, but life and neutral is still there. Okay, so it shows you this light. There's also missing life. Okay, if missing life means totally there's no power already. So nothing will come on. Okay, there's also an 8th mode which is the earth and neutral reverse. But this one is the same as... This is the same as... Oh, sorry. This one is thought... I think I put a typo here. This will be off. Okay, so this one is an undetectable error. Because earth and neutral they are actually about the same voltage level. They're connected together actually at the circuit breaker side. So this one can't really detect it. So there's an error here. This supposed to be off. Okay, okay. So all curiosity. So let's open this thing. So this is the circuit board inside. Okay, so open it. You can see the wiring. So actually from the 3 pin socket there they connect using thermal wires which are soldered onto the PCB. Okay, and then the LCD has red and green backlight. So basically if it's something wrong, then the red backlight will come on. Otherwise it will just show a green backlight. So let's look at some chips inside. So one of these chips is a power regulator. So this one is a non-isolator when it just converts from the AC power to 5 volts. So this is probably to power the microcontroller inside. The microcontroller is the one that is driving the LCD display. Okay, so this one is not isolated. So if for some reason you're going to play with it, you try not to connect to the boss okay while you're playing with it. Because the DC portion is also live. Okay, so this one is for low cost. Because this iVis socket tester is less than $20. So yeah, as long as you're not supposed to open it while using it. So it's okay. Okay, then there's another one DC-DC 3 volt regulator. Okay, sorry. So the DC-DC 3 volt regulator actually powers the microcontroller. It takes the source from this 5 volt regulator. Okay, this one here. Okay, so of course, I will wonder how the three lights, how are they controlled right? Based on the different connections of your spouse. Okay, whether they are 40 or not. So using some tracing using the continuity mode of the multimeter. So this is what was traced out. Okay, so a bit of painstaking work. Okay, so from the three different AC power lines. So this is a schematic that is drawn on chi-cat. Okay, so roughly what is here. So they have some diodes here some resistors here. Okay, some LEDs. And then this one over here is an opto isolator. Okay, so this opto isolator signal is connected to the microcontroller. So that it knows so it can receive the whether this particular line is energised or not. Okay, so how does this result in the different operational states of the three different LEDs? So let's say everything is correct. That means all life neutral and earth lines are connected correctly on your boss again. So this is the path of where the current will take. Okay, so the life of the mouse so that okay Okay, so you can see from the life right, so the power flow from the life through this diode here. Okay, so one loop so it already turn on. The other one okay the current can flow in this way. Okay, so on the negative side when the life goes to the negative cycle right. So now the potential of life goes below the earth the current actually flows from the earth in this way. Okay, so what about the open neutral it means the neutral is not connected. So only this light the center light will turn on. Okay, so this center light will turn on because the earth and life is connected together. Okay, so when the light goes to the negative cycle right the power of flow from the earth to the life. So only the center part will turn on. Okay, life and ground reverse. Okay, so life and ground reverse here we have the second and the third LED turn on. So I guess put it here so we connect earth and life this way. So it can just follow the path. So now this bottom line is life. Okay, so you flow this one flow this way. Okay, and then the other two lines are earth and neutral. So the life can flow to earth and neutral on the opposite cycle. Okay, so you flow through the second and the third LED. Okay, so what about life and neutral reverse? This way. So life and neutral reverse only the first and the third LED will turn on. Okay, so in this case it will be this way. For the first LED you flow whenever the life goes to the negative cycle. Okay, so the current will flow from neutral to life. Okay, then for the third LED the current will also flow from earth to life on the negative cycle. Okay, so what about life or ground reverse? It missing ground. Okay, so it's like this. So like this part is not connected. Okay, life is taking the place of the earth. So the current will flow through actually all of them. Okay, so there is an indication for this first and second LED. You notice that the first and second LED is actually dimer than the third one, at least from the neutral. You can see. It's slightly dimer. So it's because the current is actually flowing across these two circuits. So there are two sets of resistors that can explain the slightly or lower current. Okay, so open ground. So open ground is like this. So open ground is only the first LED. Okay, don't worry. Okay, missing life. Okay, missing life means there's no power and also nothing like that. So that's really obvious. Okay, earth and neutral reverse. Okay, so earth and neutral reverse is actually the same as the correct aim because earth and neutral is to the socket tester is indistinguishable. So this is something that is actually is a common thing across all socket testers. If you connect earth and neutral wrongly, most socket testers cannot distinguish them. Yeah, okay. So that comes to the end. So like that. Oh, I'm going to pass it around. I'm going to take a look. Okay, I can just point. Yeah. Okay, so mysterious law. So the point I went here is that actually this socket tester is not that complicated design. I mean, you saw the circuit is very simple actually. But I find it actually very elegant. It's truly just a bunch of resistors and LEDs connected in a way right, able to solve most of this problem or trying to detect whether your power socket is connected correctly or not. So actually it's very, very good. This design. Okay. So I think that is yeah, that's all.  I think I still have a bit of time. The earth and neutral are very connected in your house? Yes, at the circuit breaker side. That's the breaker. I've also heard this before or after the breaker. If, yeah, but it's around that. Yes. It's to tie the neutral line to, of yeah, it's to to stabilize neutral. And so it's like a linkage right? It probably I'm not sure. I don't, lucky I don't, I'm not L.E.W. So I don't know what it is. I don't know. I'm not sure what it is. You can go after. Yeah. Because of that connection I think there's no way. There's no way. Yeah. Need more specialised schools. Okay. That's all. Thank you.


Here in the last few years I have spent a lot of time window manager hopping. It seems like every few weeks to every few months I get bored of the window manager that I'm currently living in and I move to something else But really I stopped window manager hopping. I would say about a year and a half to two years ago I've kind of settled into X-mone ad and I just quit hopping because honestly X-mone ad just works And if what's working for me is working for me Why hop why keep window manager hopping thinking I'm going to find something more than what I'm already on but Here recently I've kind of got that urge again to play around especially with some of the window managers I've explored a little bit in the past, but I didn't really do that deep of a dive in so what I'm in today Is actually this window manager here now looking at this screen some of you guys are gonna wonder Hey, that looks exactly like your X-mone ad desktop and if you said that you would be right It does look exactly like my X-mone ad desktop because it is the same kind of cocky. It's the same panel That's the X-mobar panel, but I'm not actually in X-mone ad what you're looking at here is left WM So what prompted me to revisit left WM was about two weeks ago Or so it came to my attention that there were some major changes with left WM as far as their config file their config file Was a Tomo file you had a config dot Tomo and now they have moved from using that Tomo file to a Ron file so now you should have a config dot Ron Ron I've never actually heard of that particular syntax, but I guess it is a more rust like syntax rather than Tomo Which makes sense because left WM is written in rust So for their config file it makes sense why they want to use this dot Ron fall and it's very easy to convert your Config dot Tomo over to a config dot Ron the left WM guys They've made it very easy because there's a simple command you enter at the terminal and it Automagically converts your config dot Tomo over to a config dot Ron for you. So you don't have to rewrite that config yourself Let me switch over to my desktop and switch workspaces here. So I've got my browser open This is the left WM github and if I scroll down really at the very top of their github read me here You can actually get the command. They make this important note letting you know about the change from Tomo to Ron And then just copy this line here left WM dash chick copy that go to a terminal and then You know just enter that command and that's exactly what I did first of all to run that command You should probably CD into your left WM config directory. So in my case I'm in Home directory slash dot config slash left WM Let me LS and you can see I've got a config dot run But before I had a config dot Tomo here instead and then all I did was Entered this command hit enter and then it rewrites the config dot Tomo over to config dot Ron And let me go ahead and Show you the config dot Ron. Let me make this full screen here One interesting thing they did is the comments at the top of the page They added this nice little ASCII art left WM config dot Ron in these bubble letters. That's not something I did that's just how it converted this and my left WM config is really not a very lengthy config It's rather simple. You can see the mod key I'm using the super key which is mod for and then my workspace list So there are my nine workspaces with their names. You can see the workspaces by switch workspaces here These are the nine workspace names you see in my XMO bar in this case Then if I scroll down, you can see the various layouts that are available for me You can see I have a scratch pad for the alacrity terminal if I want to use scratch pads So that's a nice feature that left WM has not all window managers have scratch pads But most of the good ones do have a scratch pad a feature that you can use and then finally my Keybinding section one gripe I do have with left WM I don't believe there is a way to use key cords and left WM Which is unfortunate because I use key cords a lot Well, one of the things I love about Xmone ad and about q-tile and even about the awesome window manager Even DWM they all allow me to use emacs like key cords for key bindings And I find it limiting now when I go to a tiling window manager that does not offer that because I have so many key bindings I can't just use you know a single mod key such as the super key and then the keys on the keyboard I'm gonna run out of key bindings if that's all I can do I need to be able to do these more complicated key cords for key bindings and unfortunately that is a limitation here with left WM And that's really all of the config here and you can see one thing I will say minor gripe about the config dot run is I don't really love the syntax It does seem a little confusing to me As far as just the layout I thought it was a lot cleaner as a tumble fall as far as it was easier to read Let me switch back over to my browser And if I go into my get lab and go into my get lab history here Let me show you my old config dot tumble before it was converted And as you can see the tumble here the syntax for it It's actually very easy to read very clean even if you're not that comfortable with tumble It's not something you usually use right It's definitely pretty easy to grasp and obviously I find it much easier to read than the run fall Now let me quit out of that. Let's talk a little bit about theming So now one of the cool things with left WM is you can have multiple themes installed Meaning that if you want different color schemes or different panels different bars different widgets You can quickly have several different themes for left WM installed and switch between them now That's not something I'm necessarily that interested in but for those of you that like that kind of rising ability You can certainly do it So if you go to the github for left WM and if you go into the themes directory you can see they have These basic EWW that's the wacky widgets Thing I've never people have asked me to take a look at that at some point Maybe I will but it's a little weird to grasp and it's not as user-friendly as I think what most people imagine It's the kind of thing that is you can do a lot with EWW But it because it's not as user-friendly as standard panels and bars and stuff I think a lot of people would probably be put off by it. I know for me I don't find it worth my time and effort unfortunately because you can create some beautiful widgets with it But I haven't got into it Then you also have this lemon bar theme a poly bar theme and an XMO bar theme Of course, I downloaded the basic XMO bar theme and then all I did was throw that into my dot config slash left WM slash themes directory So if I go back here, so I'm in dot config slash left WM and you can see if I do an LS There is the themes directory if I go into themes and LS you can see there is basic underscore XMO bar So let's CD into That directory and you can see there's quite a number of files associated with the theme the important ones really are up Up is a bash script and then down is also a bash script now. Let me actually open. I'll open it with them There is the up script. This is the most important script It is the script that executes your programs when you launch a theme or when you launch a left WM You think of it when you switch themes What program should be launched with that particular theme? So you can see when I'm launching my basic XMO bar theme I'm launching LX session I'm launching pycom for a compositor Network manager applet volume icon. I'm also starting the emacs daemon I'm starting cocky with this location of the cocky. I'm also launching trailer Although trailer doesn't quite work here. Trayor is running, but it is behind the panel Even though the panel is saving space for Trayor Trayor is actually underneath the panel So you can't actually see Trayor and if you could see it though It does have the network manager applet in it. It also has the volume icon I've got to figure out what is causing that little bug there. I'm also setting a wallpaper using xargs So you can think of the up script kind of as a Auto-start script as startup hook essentially and the down script think of down as the opposite of the up script So when you switch from this theme, so if you were switching between themes Think of this as all the processes that were running in your current theme that need to be killed before you start Launching all the processes on the new theme that you're going to so in my case. I'm just killing everything I'm starting in the up script. So the down script is basically I'm just running a kill all pi com cocky Trayor X mobar network manager applet and volume icon That's what I've got in my down script anyway And then other than that I have my X mobar config and this is the X mobar config here X mobar dash config dot HS They had it labeled with a dot HS extension even though the X mobar config Typically is not written in Haskell. It's written in a user-friendly syntax, but the dot HS would make you think it's actually a Haskell file But that's not actually what the X mobar config is written in this year Was the original that came with the template that I got off a github But what I did is I just straight up copied my X mobar that I was using an X moden ed to this fall It's the exact same X mobar minus. I think one line. Let me go ahead and open this. So let's open X mobar dash config dot HS And again, it's the exact same X mobar. I was using in X mode add the only line I had to add to make this work was this one here override redirect equals false because without this line The padding at the top was a little off windows would kind of sort of cover X mobar sometimes But by adding this line it works perfectly. So really, it's very easy if you're already using Got X monad installed and you you've already configured your X mobar left of them is very similar to X monad It's basically the same layouts the set it handles multi monitors the exact same way as X monad it handles workspaces The exact same way. Obviously you can already use the panel you were used to an X monad Let me go ahead and close all of these windows. So it's very easy It's a very easy transition for me as primarily X monad user to just comfortably slip into left WM It's practically the same window manager itself It's not as fully featured because left WM is a much newer window manager Obviously, you're a little bit more limited in the config file and that config dot Ron fall than what you are and X Monads config fall which is straight Haskell so anything you can do with Haskell you can make happen in X monad Which I prefer but I know many people don't know Haskell hate the Haskell language They find it confusing and complicated and if you're one of those people that you kind of like the way X Monad does things, but you hate Haskell left WM is probably the window manager You want to give a try now before I go. I need to thank a few special people I need to thank the producers of this episode Gabe James Matt Maxim mimic Mitchell Paul West why you all Homie Alex armor dragon Chuck commander angry dieokai George Lee Mars drum Nate or yon Alexander Paul piece archer of door Polytech reality's for less red-profit Roland Steven tools devler and Willie these guys they're my highest tier patrons over on patreon They are the producers of this show. I'm also brought to you by all of these ladies and gentlemen all these names You're seeing on the screen. These are all my supporters over on patreon because I don't have any corporate sponsors I'm sponsored by you guys the community if you like my work I want to see more videos about Linux and friend open source software subscribe to distro tube over on patreon peace Honestly, I think Qtile is the best X Monad clone


The Niger Navy has placed one of its personnel, Abdul Ghaffar Ahmad, also known as Qt Abiola, on one month extra duty for wearing police uniform in one of his kits and for ridiculing the Niger police force in the process. The popular Instagram comedian was arrested on November 15, but has been released from detention to serve his light-corrective punishment in the cantonment. Ahmad is expected to earn his punishment by December 15, when he would be allowed to return home to his family. The Navy also spoke expressly in Commodore, so the man Daho confirmed their development.