And the next talk is about the drone attack. It's secured, I said. It will be fun, he said, and smashed it with a compute hammer. Sebastian Schinzer has been interested in IT security since a long time. He's a PhD at the FHM. And you may recall his talks back at 31, 28, or even 29, C3. Today, he will talk about the drone attack and how to attack TLS by making use of a server that supports SSL V2. Please welcome, with an anniversary edition applause, Sebastian Schinzer. OK, so thank you very much for the introduction. It's great to be back. And I'm very glad that no one is leaving right now because we're presenting a new vulnerability in SSL version two, right? That is kind of old. The attack has a name, it has a webpage and it has even a logo, and having said that, I'm really glad that no one's leaving the room right now as well. The talk will be on breaking TLS. And so pretty much everyone here in this room uses TLS, probably at this very moment, while your mobile phone is checking whatever is going on on Twitter, Facebook, so over HTTPS, or you're checking your emails and stuff like that, right? So TLS is really important. The drone attack has 15 authors and they obviously couldn't all come here. The six of us here is like the most people that got on a single picture. And if you look closely, we are very happy to have received the first Pony Award for the best cryptographic attack in 2016. So we're really happy about this. But so when we talk about SSL version two, what is really SSL version two? So SSL version two was created in 1995 and it was immediately broken in 1995, right? So in the same year, just a few months later. So how did the internet look like during these ages? Pretty much like this, right? This is the internet of the 1990s with some cryptographic primitives like DES and RC4 and RC2 and so on and so on. Most of them are broken and there's also some really interesting things like here export 40 bits, something like this, right? That's like a cipher primitive that was created because of like politics, right? Cryptographic regulations in the 90s said that you're only supposed to export cryptography with a certain strength, with a certain maximum strength out of the US and this is what we see here, right? So in 1995, SSL version two immediately died and the reason for that is that like the creators of SSL version two, it was published by Netscape, they didn't authenticate the handshake. So an active man in the middle could just intercept the handshake and force you and the server, you as a client and the server to negotiate a very weak encryption and there was no fix for that. So this is nothing that you could fix off because it was a protocol issue. And so therefore in 1996, one year later, they came up with SSL version three, which is still the basis on the protocol level for the TLS that we see today and that we use every day, right? So now you could say, OK, SSL version two was published in 1995 and it was broken in 1995. No one's ever going to use this right now. OK, I've got some data for you. So this is the Internet-wide scan of the whole IPv4 Internet in February 2016. And what you see here is not the amount of hosts, that's the percentage of all the TLS and SSL supporting systems on the Internet and there you see, for example, that 28% of all servers listening on port 25, which is SMTP, use SSL version two, which is really, really strange, right? I'll come later to this point, what was the reason for that? And even for HTTPS port 443, we still see 17% of all the hosts out there directly support SSL version two, which is really, really strange, right? So you could even say, these old dinosaurs all are coming back somehow to haunt us users on the Internet, right? OK, so to give you an overview, what is Drown all about? So Drown is a fairly sophisticated exploit chain and it will take me some time to explain all the puzzle pieces. So therefore, this is just a short overview of the requirements that an attacker needs to do in order to run a Drown exploit. So first of all, we can break one in 1,000 TLS connections, so not every TLS connection, but only one in 1,000. That basically means, so in order to break one of your TLS connections, the attacker on average has to collect 1,000 TLS connections from you. These can be connections that were recorded long before Drown was known, right? So we're not talking about an active attack, it's a passive attack, and so therefore, just clicking record in your wire shark is already sufficient. And if you did this on a Congress three or four years ago, you can break the TLS connections that you recorded back then, maybe under certain conditions right now. Okay, it doesn't come for free, so you need to perform two to the 50 encryptions, which is a lot. We can do this, but we need rather beefy hardware in order to do this. And there's one more requirement, we need to do around 40,000 connections to that server that supports SSL version 2, right? So we need one server that supports SSL version 2 and one very important thing is, clients don't support SSL version 2 for a very long time. So the last browser that supported SSL version 2 was Internet Explorer 6 on XP, right? And even Internet Explorer 6 would always prefer SSL version 3, right? So if there's a way to negotiate SSL version 3, it would also always use that. So we're really breaking TLS connections, so the connections that your very recent TLS client does right now, under the condition that the same server is supporting SSL version 2, which is really strange, right? So we break TLS using SSL, okay? So we did an exploit and also we put a lot of effort into optimizing the attack and the best thing that we could do was breaking a single TLS connection on Amazon EC2 for 440 US dollars, so which is pretty right? So if everyone here gives like maybe 50 cents or so, that would be already sufficient to break a single TLS connection. So I don't need to break a lot of TLS connection, I just need to break a single TLS connection that your POP3 client does every minute or so to get your email because there your password is in there. And if you get your password, right, we can break all the residual, right? So breaking just a single one is sufficient in most cases. Okay, I said there's a lot of puzzle pieces that we need to do and I tried to cluster them to make them more digestible. So the first thing that I'm going to talk about is a special attack that I've already talked about two years ago. I will just go briefly into it. If you're interested more into the details of Bleichenbach's attack, just watch more from my talk in 31c3. I will show you a new protocol flaw in SSL version 2 and I need to explain what is it with 40-bit export ciphers. So when we combine these three puzzle pieces, we have a practical attack against SSL version 2, which is not relevant at all because no one is speaking SSL version 2 on the internet anymore. We just have servers that support it generally, but usually we couldn't find any client that still negotiates SSL version 2. The second thing that we have to look at is shared keys among the different SSL and TLS versions. So when you set up an SSL server and it supports SSL version 2, version 3 and TLS 1.0 up to 1.2, it will always use the same RSA key pair. And when we take this into account, all of a sudden Drown becomes a practical attack against many TLS servers. It's practical in an academic sense. It still means it's an expensive attack, but we can do it. We can afford it. We all here can afford it. And then we have two implementation errors. So all of the above practically means that we can attack every SSL version 2 implementation that is out there. Now, here we're looking into two implementation errors in open SSL, and if we combine these with the already existing Drown attack, we all of a sudden get a trivial attack. Really trivial, that means it takes minutes on this laptop against a lot of TLS servers. So let's start with Bleichenbach's 1998 attack. And before I start with that, I just want to quickly repeat the RSA-based key exchange for TLS. So there's various ways of negotiating like a key. And when I say a key, it always means a symmetric key. So asymmetric encryption, for example, with RSA, is pretty expensive. So therefore, we just do the key exchange. I guess we exchange a symmetric key over RSA, which is not that much data. And then the actual content that will be transferred over the SSL or TLS connection, this will use AES or triple desk or desk or RC4 or something like this. And what we are looking at is right now only the part where we negotiate this key for this symmetric encryption. So we have a TLS client, we have a TLS server. The TLS client always starts with a client hello, and it contains a client random number. This will be like this changes with every request. So the client changes this number with every request, and it will be sent in clear text. So the attacker knows this. The second message, the response of the TLS server will be the server hello. It will generate a random number as well. It's a server random. And this will also change with every new connection. And it's also sent in clear text. So the attacker knows client random and server random. And then it also sends this certificate that you buy for Komodo or at Komodo or even at Let's Encryptor so you get it for free. And in this very certificate, there's an RSA public key. And this RSA public key will be also sent with a certificate. And with the next message, the client key exchange, the TLS client generates a thing that is called a pre-master secret. And this is the only part that is really secret in this whole exchange. It will not send this pre-master secret in clear, but it will encrypt it with RSA and the key from the certificate that it just received from the server and sent this over. And this is a very important step. The TLS server decrypts the pre-master secret that it just received. And from this pre-master secret, both the client and the server can generate the same symmetric key. So that means the attacker knows the client random. It knows the server random. And it gets an encrypted version of the pre-master secret. And if the attacker can decrypt this pre-master secret, he knows the master secret, the symmetric key that is used for RC4, IAS, and stuff like that. So this is the holy grail that we want to break right now. And Bleichenbach's attack achieves exactly this. So that's important. What I need to mention here is this decryption can fail. So when the attacker sends, let's say, an arbitrary ciphertext, some junk data or so, the server first has to decrypt this ciphertext in order to find out whether this is a valid pre-master secret or not. OK. So in order to conduct the Bleichenbach's attack, we need an oracle. So that's a grippographic term for nothing else than a service that accepts an arbitrary ciphertext. And it will decrypt this ciphertext. So it needs to have the RSA private key. And it responds with 1 or 0, so true or false, depending on the successful decryption. So if the decryption was successful and the pre-master secret looks somehow valid, looks somehow, then it will say, OK, it's true or otherwise it's false. So we only get one bit of information from this oracle. So we have a client here and a server. We have an attacker that eavesdrops on this connection, and then it changes certain parameters of this connection and sends it over to the oracle. The oracle decrypts it, parses it, and then says, OK, decryption was successful or not. That's the only information that the attacker gets from the oracle. So every time the oracle answers with a 1 or with true, the attacker learns a tiny fraction of the RSA ciphertext. So there's a mathematical formula where you could put everything in. And if the attacker only does this, let's say, a few thousand times or so, he can learn the full ciphertext. He doesn't get the RSA private key. We only get like, we only can decrypt this single RSA ciphertext. OK. So in the original paper of Deichenbacher from 1998, he was exploiting the fact that common TLS implementations would like, they had like an explicit error message for this type of decryption failure, which is really bad. And so they didn't actually fix the SSL or the TLS standard. They just said, OK, here's an implementation fix so that the Deichenbacher attack won't work anymore. And it works like this. So we pretend that the decrypted premaster secret that we have received was correct. And we proceed with a random premaster secret. So in case that the ciphertext that we have just received was in mallet, we'll just generate a random premaster secret and continue with the flow. And this will obviously lead to some later error because the symmetric key that comes out here is different for the client and the server. So they simply speak with a different key and can't decrypt each other, and then it comes to an error. So this looks like this. So the server will decrypt the premaster secret. He will always generate a random premaster secret. And then depending of whether the decryption succeeded or not, when it succeeded, it will proceed with a decrypted PMS. In the case where the decryption failed, it will proceed with a random premaster secret that it just generated. And so this makes all the implementations that we looked at, it's indistinguishable whether the decryption succeeded or whether it failed. So it's an implementation fix that is written in the RFC. OK. Now we exploited this very countermeasure for Bleichenbach's attack in order to conduct a new Bleichenbach's attack. And it works like this. OK. So let's look at the SSL version 2 protocol. It changes, it's slightly different from SSL version 3, but it doesn't really matter here. So we also have a client hello. We also have a server hello. We also have this kind of client key exchange. It has just a different name, where we send this symmetric key that was generated by the client. And then both would generate their symmetric keys. And what is interesting here is that the first one that responds with an encrypted message will be the server. And this has one very important implication. That means the client gets one ciphertext. So the server verify is an encrypted message with a key. So with that master key that both client and server should know by now. And the client gets this message without proving that it has the same symmetric key. In SSL version 3 and in TLS, this is different. So this message here will only be sent after the client proved with a finished message that he possesses the same symmetric key. So the attacker gets one ciphertext that is encrypted with an unknown key, because we don't know the key yet. The question, and please accept it, that this is now an important question that we need to raise. And I'll explain it in the next two slides. Can we learn this key? So we get a ciphertext. And the question is, can we learn the key that was used to encrypt that message? Now when we look at the specifications of SSL version 2, we learn that there are so-called export ciphers that only have 40 bits of strength. So this is how a cipher suite looks like. And it keeps on looking like this. It always has the same format. It tells us there's a symmetric key algorithm that we use as RC2. It uses 128-bit keys. It uses a CBC as a mode of encryption. And it uses export 40 with MD5 as an hash algorithm. So that means we have a 128-bit key, but only 40-bit of those are encrypted. I told you the client generates the symmetric key and encrypts it with the public key of the server and sends it over. And here it doesn't fully encrypt the 128-bit, but only the 40-bits. Only 40-bits will be encrypted, and 88-bits are sent in clear, so everyone can read it. And in the 90s, the Clinton administration did this regulation. They said, OK, so 40-bit is enough to protect people with online banking stuff and so on and so on. But obviously, the US government wanted to look into the SSL connections of whatever country this cryptographic code will be exported. When you look at the implementation, the master key will be built in a way that the clear bits, the 88-bit clear bits, will be concatenated to the decrypted 40-bit secret keys. And obviously, for non-export ciphers, so you get the same cipher suite without the export 40 here. For non-export ciphers, the length of MK clear, so the bits that are sent in clear, is zero. OK, fair enough, right? Maybe not the best idea to do something like this from a politician's viewpoint, but still, OK, it makes sense. At least in the 90s. So let's look at this server verify, this single message that we get and where we want to know the key. When we look at the specifications, we learn that the server verify is nothing else than the client random that it sent us in the client hello. So we know the clear text, because it was sent in a clear, and that was encrypted with a master key. So we know the plain text, and we know the cipher text. And we also know, when we negotiate this with a 40-bit export ciphers, which we can do, then only 40 of those bits of this master key are secret, which means we can do a brute force search for the key. We know the plain text, we know the cipher text, and then we can look for the key, because there's only two to the 40 possibilities of the key size, which takes on beefy hardware a few seconds or a few minutes. But you can even do it on this laptop and maybe finish it in a day or so. So this is nothing really critical. OK. So let me show you why this is important and why this forms a new Bleichenbacher oracle. So let's assume we create a new cipher text, a new encrypted premaster secret using export 40 bits, and send it to the server, and we do it twice with the same cipher text. Then we get two server-verify messages, and we break the key that was used to create the server-verify messages. In case that the premaster secret was correct, we follow this path. There we proceed with a decrypted PMS, and as we didn't change the cipher text, the premaster secret is the same, so therefore the master secret is the same, so therefore we get the same master key. In case the premaster secret is invalid, we follow this path here, which means that the master keys for both server-verifies will be different because it will be generated, and a new premaster secret is generated for each and every request that comes in. And this we could distinguish, right? So this forms a new Bleichenbacher oracle with the only condition, so we don't get any error messages from the server, right? Everything is correctly implemented as in the RFC, but if we send two cipher texts, the problem here is so when the server-verify, the key to generate the server-verify was the same for both messages, then we know it was invalid, otherwise it was valid. Okay. So when we had this and it was a much larger group that came up with this attack, so we had a practical attack against SSL version two, and now you need to imagine a bunch of academics in their ivory tower, you know, like high-fiving. Yeah, we did a new attack, a new cryptographic attack, but it has zero relevance, right? So we were missing each other, something like this, right? Okay. So we need to look further. That's not sufficient, okay? It's a cool academic attack, but it's not relevant at all for the internet. So let's look at how people use SSL and TLS, how they configure it. When you set up a new server using Apache or Engines or IIS or whatever, at least to my knowledge, there's no way of saying if a client comes in and he connects using TLS 1.2, then he gets key A, and when he connects with SSL version three, he gets a different key. That doesn't seem to be possible. So that means when you set up a system with a key pair, they always use the same key material. It's always the same RSA, public key and private key pair that will be served independently with a protocol version it is, okay? So that's an important insight. What is also very interesting is, a valid question would be, will people use the same TLS certificates for different protocols? So are there people out there that buy a certificate or get a certificate from Let's Encrypt or so and use it for HTTPS, for SMTP, for IMAP, for POP3 and all the different other ports? And it turns out they do, okay? Which is a problem because everyone is looking at the secure configuration of HTTPS. So everyone is looking at HTTPS and no one really is looking at the security of the TLS configurations of IMAP, POP3, SMTP and so on and so on. So, which leads to the fact, I said Bleichenbach's attack works against RSA ciphertext. It's nothing written that this is specific to a specific TLS version, it's a generic RSA decryption oracle, right? So which means if we have 10 systems and these 10 systems all share the same certificate and only one of those 10 systems is vulnerable to drown, then the connections to all 10 systems can be broken because it's a generic RSA decryption oracle. So it works like this. This is pretty clear, right? So when we have a server and it accepts TLS connections and SSL version two connections, then an attacker can eavesdrop on this TLS connection, record it and use this server as a Bleichenbach oracle over SSL version two in order to break it. So there, so if a system supports SSL version two, all the TLS connections that go there can be broken as well, that's pretty clear. What is new here is, let's say we have two servers and both use the same RSA key material, maybe the same certificate or even the same certificate, truly, or a different certificate. So what we saw with Heartbleed was the Heartbleed attack would compromise the keys. So using a Heartbleed attack, an attacker could learn the private key of that TLS server. So you had to apply for a new certificate, you had to buy a new certificate. What many people did is they used the same RSA key pair that was compromised in a previous certificate and bought a new certificate with the same keys that was compromised before, which is not a very good idea. Okay, so it could even be that both use a different certificate but have the same RSA key pair. We saw this on the internet as well. So in this case, let's assume this server here doesn't support SSL version two, so it's not directly vulnerable to drown. The attacker can still eavesdrop on the TLS connections that it sees here and breaks it afterwards by making SSL version two connections to this server, which uses the same key material and supports SSL version two, right? So, and when we scan the internet how this affects the amount of hosts that are vulnerable to drown, this was pretty dramatic, but before we look into this, let me just not go through all the numbers that you see here. I just put on all the numbers that you see that it's really a substantial amount of RSA key pair sharing on the internet. So you have to read this table like this. For all the SMTP servers, we collected the TLS certificates and then looked where did we see this public key in maybe a different certificate or the same certificate on some other port. And there we saw, for example, from all the TLS certificates that we encountered on SMTP, 30% we found on IMAP. No, that's POP3. 29% we found on IMAP and so on and so on. And so what is really interesting here is people seem to share a substantial amount of keys across protocols, which is pretty substantial. This is very interesting here. So when you look, for example, for HTTPS, so a lot of servers on HTTPS were vulnerable, but as I said, HTTPS, many people look at the configuration of HTTPS. No one seems to care about the TLS configuration of SMTP. It's even like this, that people say, for SMTP, if you can't negotiate a TLS connection, if you can't negotiate a TLS connection, it will fall back to plain text. So for SMTP, bad encryption, bad cryptography is better than plain text, right? But what we have here right now is when people have a bad SMTP TLS connection and use the same key material for HTTPS, we can break your HTTPS connections by exploiting the weaknesses in your SMTP configuration, which is pretty substantial. So when we look at the numbers, this, in most cases, it doubles. So we had, let's say for port 25, 28% of all the SMTP servers that support encryption on the internet were vulnerable to drown. Now, when we extend this attack and say, okay, we have the system here and we want to attack it, the system itself is not vulnerable to drown, but the public key is used on some other system on the internet on a different port, we can do the attack there. And that obvious, this here means that 50% of all SMTP servers, encryption-wise, can be broken. For port 43, for example, it's one third of all the internet that support encryption, we could break TLS connections to these systems by exploiting some other system that happens to use the same RSA key pair and supports SSL version too. That's a really substantial effect that we encountered here. Okay, so I said that drown itself is not a cheap attack. So it's actually quite complex and we thought about how can we make efficient attacks for drown. We need to do this, so we need to perform two to the 40 exhaustive searches, so encryptions or decryptions, and we need to do this for around 1,000 oracle queries. All right, so that's a lot, two to the 50. And so we basically took the code, we took some code parts of OpenSSL and did a naive implementation using the RC2 code and the MD5 code of OpenSSL that was the naive implementation of everything. And there we had like, okay, for the full attack, it would take us something like 50 days or so, which is pretty long and we wanted to be better. Then we asked the people from Hashcat, so the Hashcat team, one of the authors of Hashcat is also a co-author of Drowne, and so we sent him the code and asked him, can you help us? Because it is pretty similar to password cracking, what we're doing, right? Drowne is pretty similar to cryptography-wise with password cracking, and then he took the code overnight and made something like a factor 30 or so improvement to it, which is really like, okay, this is crazy. Absolutely stunning, right? And so we ported this on Amazon EC2 and found out that for the cost of $440, we could break one TLS connection in eight hours. So this is pretty substantial improvement. Okay, cool. So now we have a practical attack against many TLS servers, and this is like the Drowne attack that works against every SSL version 2 implementation out there. Now we have two implementation errors in OpenSSL, which are interesting enough so that we have to show them because they make Drowne really, really easy. The first one we dubbed it Cypher Suite Selection Buck. It works like this. Before we can understand this buck, we need to understand that there is, when you do SSL configuration or TLS configuration, you always have a protocol version, and you have a Cypher Suite. And with every new protocol version, there was a bunch of Cypher Suites released, right? And so what many people did is they always configured their Cypher Suites. So they said, okay, we only used secure Cypher Suites, and then we disabled the ports. So here, for example, we disabled SSL version 3 in order to prevent the Poodle attack, but SSL version 2 was not explicitly disabled, right? Which meant the OpenSSL behind that, it would enable SSL version 2, but there was not all the export Cypher's would be forbidden, right? So this Cypher Suite configuration here would forbid export 40 bits Cypher Suites. So therefore, Drown shouldn't work, okay? So how does SSL version 2 do the Cypher Suite negotiation? It works like this. In the client, hello, the client asks, hey, server, do you want to talk with export Cypher's? And the SSL version 2 would respond, sorry, I don't do export Cypher's, right? And then the standard compliant SSL version 2 client would say, okay, oh, too bad, okay, bye, see you next time, or maybe try another protocol version or so, something like this. Now this is the relevant code that will be used afterwards, after the handshake that I've showed you right now. So let's just assume the client wouldn't say, okay, bye, sorry, it's really bad that we can't talk exports. So if the client says afterwards, okay, I want to talk export anyway, let's have a look what the code does. So here we receive the data from the network. This is like this, this is that message that contains the encrypted premaster secret, and that also contains the Cypher Suite that the client just selected. It will get the SSL Cypher Suite by that char that came in. So each Cypher Suite has one byte, or put it differently, so there's a byte that denotes a certain Cypher Suite, and this function will just get a pointer to this particular crypto code. If this was not successful, and not successful means the Cypher Suite was selected that is not compiled in, okay? And if it is compiled in, it will simply be used. So who sees the part that checks the configuration? So we haven't certainly found it, right? So it's not there, okay? So basically what happens is a non-standard compliant SSL version two can force that handshake. So we say, wanna talk export Cypher? No, I don't do export Cypher, sorry. Okay, we go, right, okay, let's talk export 40 anyway, and it would say, okay, sure, we can do that. Sure. So the story behind here is like this. Nimrod did this, used Scapi, a very bad Scapi implementation of some kind of a scanner in order to look how many systems on the internet supported SSL version two, and I did the first scan, and I found this huge amount of numbers of SSL version two scanners, and then I used a different scanner that just looked for SSL version two, and it would say, no, SSL version two is not supported. And I debugged, and I debugged, and I debugged, this took us weeks, and then I saw that Nimrod was just too, he was simply too lazy to parse this message. So he would just say, hey, wanna talk export Cypher? Yeah, yeah, yeah, let's just talk export. But he didn't just care what the server was responding, and so this took us, yeah, so we were lucky, okay? If we didn't have this implementation bug, we probably wouldn't have found many of those, we wouldn't even have found this bug. So independently of your SSL configuration, of your Cypher suite configuration, using this bug against OpenSSL, we can negotiate whatever we want over SSL version two, okay? But using a non-standard compliant SSL client. Okay, so this means the server is vulnerable to drown, and this is even though you disabled SSL version two export Cypher's, which is cool. The second one is a special drown, and this is really, it's really very special. It's also an implementation flaw. It's not a, it's an implementation flaw. So let's again use this Cypher suite. So we use RC two with 128 bit keys, but we transfer all except the 40 bits in clear. We have talked about this before, right? An implementation flaw allowed to use these clear bits, so the bits that are sent in clear with non-export Cypher's. So for non-export Cypher's, we said MK clear needs to be zero. This is not the case here. So a standard conforming client would, like, right? So for a non-export Cypher that we have here, we would use all the 16 bytes, so the 128 bits, would be filled with the secret part that we just extracted from this encrypted pre-master secret, okay? If we send four clear bytes, along with a 16 byte pre-master secret that was encrypted, it will still prepend it to the actual encrypted pre-master secret. So that means K13, K14, K15 would simply fall off, okay, which becomes really interesting when we send 15 clear bytes. Because then, all of a sudden, we have a server verified that was encrypted with a 128-bit key where we know all but one byte, and then we can brute force on average 128 encryptions, right? So, and now we do this, like, in a stepping mode, right? So we sent 15 zero bytes as MK clear. We break the Cypher text, we learn K1. In the second step, we sent 14 zero bytes. We know K1 from the previous step, so we brute force K2. In the next step, we sent 13 zero bytes, we know K1, we know K2, we want to brute force K3, and we do it, right? And then, like, for this case where we send zero zero bytes, we have learned K1 to K15 and only have one byte, and we need to brute force it, it's, again, 128-bit, right? Okay. So that means, so we dub this special drown because it's a special version of this attack. The generic drown still has two to the 40 complexity per oracle request, and we need to have something like 1,000 oracle requests, so it's pretty substantial. But this two to the 40, in case of special drown, goes down to 15 probe connections, and altogether approximately less than 2,000 trial encryptions. So this can be done, the full attack can be done within a few minutes on just a normal Linux laptop, which is very, very critical. So what is interesting here is this bug has been fixed by an OpenSSL developer without knowing that it was fixed. So Nimrod and I, we submitted a bug that was totally unrelated to drown. We didn't even know drown. This is like one and a half years ago or so, and OpenSSL did a patch, and they patched this bug without knowing what it actually was. So it wasn't really a silent fix because no one was really noticing what was going on here. But later we figured out that this is pretty substantial. Why I'm explaining this to you is we can scan, we can scan again the internet for this, and we can look at who didn't patch their OpenSSL when we submitted the patch like one and a half years before. And so this here means this is like the, this is the amount of internet hosts that run some kind of encryption and that use OpenSSL that is more than one year old. So these people don't really patch. And when you compare this to the amount of service that are vulnerable to drown, you will see that most of them are OpenSSL actually, because the numbers are very similar. Okay, so in summary, there's just one sentence that I can say here, ancient SSL version two breaks current TLS. And we can do nothing else than just disabling SSL version two, right? It's dead for good. But an important discussion is also who's to blame for drown? So what was the fault here? So the first one is pretty obvious. So we have some crypto design flaws were done in the 90s. Okay, that's nothing that is really too surprising. Okay, right, it's 20 years ago, many things happened between them. We have some crypto implementation flaws from the 90s and like the OpenSSL guys were like, okay, I've never looked at SSL version two code. It's been there forever, nobody has looked at it. And so it's really old implementation code. What is more a problem is the crypto configuration flaws. So people were configuring their SSL servers in a pretty bad way. And what is also quite interesting is the export ciphers, export 40 bits is a thing is an essential part to drown. So drown wouldn't be a practical attack if we hadn't the Clinton administration who forced this crypto regulation that only export cryptography may only have like 40 bits in secret. Okay, so what are the mitigations for the administrators here? So disable SSL version two and SSL version three while you're at it, right? Because it's also, so SSL is insecure, right? Don't use the word SSL anymore. TLS is the real thing, okay? And then obviously update here OpenSSL regularly, which is a thing that you should do for every library that is in some kind of security element, okay? So this is the mitigation for the admin, the mitigation for the citizen in my opinion is vote against crypto backdoors, right? Thank you very much. Thank you, Sebastian. Do we have questions from the audience? Okay, we have one question, I think. We start with microphone three, please. Yeah, actually it's two questions. One is how specific this is for RSA? I mean, would it work also for Diffie Helman based crypto? And also after the hot bleed, a lot of people start looking into the OpenSSL code and even forks started and so on. So has the situation improved since then? So the first question was, is it limited to RSA? Yes, it is somehow. We can impersonate the server with like, when we have substantial hardware, we can impersonate the server simply. Well, it's hard to explain like this without slides for this. So look at the paper. So we have broken quick using this. We can break Diffie Helman, but this is not an offline attack, it needs to be an active man in the middle, okay? So it's your first question and it's limited to RSA, yeah. So for example, yeah, so Diffie Helman doesn't work. And your second question was, excuse me? If the situation with OpenSSL or other SSL implementations has improved since hot bleed. Okay, so this bug hasn't popped up in one of the audits, probably because people didn't care about SSL version two because it's already messed up, right? So people were doing a focused audit, which is what I would expect. They did a good job there. Okay, thank you. Do we have questions from the internet? No, okay, microphone one please.  But there goes your uptime, right? 1,000 days uptime, yeah, yeah. Thank you, microphone four please. You mentioned that there's a factor of 1,000 that you have to apply to the 20 to the 40. Where does that come from? I think I missed that. It comes from Bleichenbach's algorithm, right? So when Bleichenbach's algorithm from 1998 was published, it was dubbed the Million Questions Attack because you used to have to send like one million, on average, one million messages between client and server in order to decrypt the ciphertext. This has changed dramatically in the years between. So there are several papers that did improvements to the attack and now it's boiling down to 1,000 approximately. It depends on the size, it depends on the pre-master secret, but on average, 1,000 connections is what we need. Okay. Thank you and the next question is on microphone one please. This is just a paranoid question about if you're using the OpenSSL library, when you said disable the protocols, I presume that means when you do the function call where you pass in no TLS version or no SSL version, there's no SSL. Has someone checked that they're actually checking that? If they're not checking the protocols, if they're not checking the cipher suites rather, are we guaranteed that doing that means you're protected? Can I, if I've said no SSL v2 when I set up the context in the library, does that mean I can breathe easy? So OpenSSL deleted the SSL version 2 code after we told them about it, so it's fine. Just update OpenSSL and you'll be fine. It will be deleted. It's not there in the repository anymore. That's what I wanted to hear. And restart your server. Your, sorry, a service. Microphone five in the back please. Yes, thank you. I wanted to ask, have you looked into other crypto libraries except OpenSSL? Yeah, so most of the modern crypto libraries, so with modern, I mean the ones that appeared in the last few years, they didn't implement SSL version 2 at all anymore. So Libre SSL, for example, they just deleted the code, boring SSL deleted the code, like the Python libraries and so they didn't even implement it and so on and so on. But all the ones that were, that we looked at, for example, the code that is in IIS as channel, it has, it still supports SSL version 2 and it has the same protocol flaws. So if you support SSL version 2, you're vulnerable, independently of the implementation, at least how we looked at it. Okay, thank you. Welcome. And I think microphone one please. Why the name Drown? That's a good question. So there's, I think, so Nimrod came up with the initial idea and he has this, like his favorite movie where this plays a role and then we did a backronom, which I don't remember anymore, right? It's written in the paper, sorry about it. I don't even know the backronom anymore. It's just a working name and then it got viral and yeah. And of course, more information is provided on the FAR plan. So any other questions? Okay, in this case, I have a question. Usually you say, okay, which politician was it? That said, okay, please weaken the strength. The virtual security? The SLV2 security? I'm sorry, I don't get the audio here. Oh yeah, of course the audio on the stage is not that good. Let's say more than in general information. We have the politicians that try to weaken the security. So which one was it again? And this was the Clinton administration. But this is not to, I mean, every politician obviously wants to do this because of terrorism. Yes, of course, because you're all that bad people. Yeah, and so if we do this right now, if you have crypto regulations right now, we at least make sure that maybe in 10 years, maybe five years, maybe 15 years, we have another bunch of crypto PhD students who can write their PhD thesis on it, how to break them, right? So that's maybe one good thing about it, but in general it's not a good idea. Okay, any other questions in the meantime? I think microphone five, is this a question? Nope, this is just down. Oh, there's a question. No? Hi. Four please. You said that for mail servers, it's still a good idea to stop support old crypto. So with the drone attack, it isn't anymore I expect or did I misunderstand? So there's an argument of supporting SSL version three, even though it's broken, but it's broken in a sense. So the poodle attack is still, it's obviously more effort breaking SSL version three than reading the plain text, okay? With the drone attack, it's different because even when you use secure TLS connections, you can still break it by exploiting SSL version two. So and the word for this is opportunistic encryption. So some bad encryption is even better than no encryption and this changed for drone. And I think this is the first attack where this works cross protocol. But don't you compromise, oh, you don't compromise your RSA private key with drone. Okay, yeah, then I get it. So you don't need to buy new keys for it, right? You can still use your same key, just remove SSL version two from your configuration and restart the server and you're fine or update open SSL. Okay, any other questions? In this case, please give an anniversary edition applause to Sebastian Schenzer. Thank you very much.


Hi everyone, Joe for jaspyscasebrakes.com coming at you with jaspys big hit express multi-sport series 6 12 box random team break number 14 three random teams each Four spots being given away if you bought a full spot. You got a chance at an extra spot There's all the combos right there. We only made 24 cases. So we're getting close to the end big Thanks to everybody for making it happen whether you bought a spot straight up Or whether you won your way into a break. We appreciate it. Now if you bought a full spot You got a chance at some extra spots right here. So that'll be our first dice roll Then we'll use a different dice roll for all the team randomizers All right, so top four after Six two and four six times fingers crossed good luck one two three four five and six and final time So Nancy nice Zachary Casey William. Sorry Tristan very close. No cigar, but after six You've got extra spots going your way. So we'll put a little rooftop symbol so you can differentiate your winning spots With your full spots. So now we got a full list of 30 Now we can start Doing the randomizers here. We'll go NFL first Actually, let's get a list for your names All right, so for the next Set of randomizer we're gonna use one dice roll for all the randoms and that's gonna be two and a six eight times So your names first one two three four five six seven and eight Kenny down to Nancy That's her football you can see the tabs on the bottom of your screen baseball and basketball all right two and a six eight times for the Football teams are the football teams right there Rams bucks combo Cardinals Browns combo once again two and a six eight times one two three four five six seven and eight Dolphins down at Cowboys So I'm just gonna show you the list like that. We'll we'll come back to it. We'll show you your Your team names again if you're watching live you can actually pause the video It's like a DVR function pause the video and then see what team you have Right, there's the first half and here's the second half Just don't forget to click the live button again, so you can be at the current point at the stream and just in general I feel like you should Be frequently checking that live button And just click just click that live button make sure you're watching live And occur at various points of the day all right two and a six eight times four baseball team Remember the Brewers have that combo right there one two three four five six All right Rockies down to twins. Oh actually put that in It's in the basketball section. This is the football section What am I doing here? All right, so that's the football section put that there This yeah, we'll just clear that out and get the original list of names again put it back into the basketball list Now baseball that list stands there and there were the results of the baseball list Rockies down to twins after eight All right, there's the first half of the list right there And the second half of the list right over here and let's alphabetize by a team And again, well during the trade window we can go back and take a look at your teams again if you need to see All right now last but not least two and a six eight times before the basketball teams one two three four five six seven and Eighth and final time. We got the spurs down to my Lakers Let's go at the NBA tab Put those names in there and there's the first half of the list Second half of the list actually we do have one more that I have to randomize Two and a six eight times for the remaining case numbers So case number on top is the one we're going to do after eight one two three four five six seven and Eighth and final time we're going to be doing case 23 if for whatever reason case 23 is not available We'll just go down to the next one, but I'm pretty sure we've been keeping track of the cases we were doing accurately I hope so. All right, we're gonna pause the video when we come back We're gonna see if there's any trades remember you can't trade baseball for basketball But you can trade baseball for a baseball team basketball for basketball team so on and so forth So there you go. We're gonna pause the video be right back All right, welcome back everybody. No deals were done. So that lists right there for basketball for NBA remains the same List for baseball remains the same. No deals done in any of the sports Baseball teams and there's the football team right there NFL There you have it. There's the case right here Said case 23 of 24 there's case 23 Big hit express. Thanks everybody for making this happen And let's actually I'm gonna keep this case right over here sort of bulky boxes in here, but let's Brown paper the boxes in there You'll see 12 the total side right there so you can see inside the box There we go. Let's see what we got Guess we ran out of the other boxes we have a Past and present dual relic for the Vikings Justin Jefferson Randy Moss 9 out of 99 From 2022 immaculate football nice That'll be for Nancy and the Vikings Set that right over there. That's football section. Let's me just recycle these Put that over here All the space we have in the shop Running out of space sometimes all right next one Yeah, you may want one. They're all you've been one of ones We've got a Trey Lance 48 out of 49 Three-color jersey and autograph out of immaculate collegiate So he would be a 49er in this set and that will be for for Edward Petty won that spot in The in the filler maybe Trey Lance finds a new life in Dallas Marinates behind Dak Prescott for a little bit Maybe finds his way elsewhere We'll see or I wonder I mean if Dak Prescott Doesn't do well You know is this maker breakers is Dak Prescott on the hot seat? All right, we got a graded card looks like more football and it's for the Falcon. That's Kyle Pitts blue camo PSA 9 Navy camo I guess according to the slab and That is for Tristan and the Falcons 11 out of 25 So three football cards so far No baseball or basketball just yet. All right next one is Nice Kenny pick it from select orange pulsar six out of seven That's nice and that will be for for a Zachary H and the Steelers Zach on my on my list here Congrats Let's hope for a big season from Kenny pick it That'd be good for the hobby All right, another graded card love seeing graded cards in here Hope to be able to pull this out of the box. There we go and it is It's wander Franco We did pack these products before the incident Ah Alleged, I guess let's hope it turns out to be nothing That's gonna be for Edward Petty and the rays All right next Another graded card. That's a good sign It's football and autograph. It's Justin Herbert from 2021 illusions 10-10 on the grade clear shots 7 out of 20 Nice chargers that's gonna be for for Nancy. That's with the extra spot that you won. Congrats. Oh Thursday night football who do I have? Well, I think Casey is gonna win But I think there might be a little value and maybe if you're into this sort of thing maybe investing on the spread For Detroit. All right. We got a heavy one. It's hoops Nice John Stockton two out of seven Got a piece of the silver right here some fine fine silver got the basketball Hall of Fame stamp on there It's pretty sweet Utah Jazz our first basketball card going to Alan Matsui There you go, Alan Who do you have who does everyone have for Thursday night football? I'm glad football is back You're going with Detroit just to win outright Kaboom Nate Diaz 2022 Panini instant UFC Nate Diaz Kaboom psa 10 boom Nice, so that'll go to the MMA Brewer's combo spot. That's for Kevin onwards not too many left next one is Trayvon digs Two-color patch and autograph tie-dye from select 16 out of 25 Dallas. That's for Nancy last Bob Mojo All right next up is Is one of one hunter Henry? From illusions football Patriots Whip for the big hit express and that's for the Patriots. That's for Nancy two more to go That's a hot take Eric thinks that uh that the Lions are just gonna win outright Yeah, yeah Travis Kelsey did hyperextend his knee he might be up for a week or two and No, no Jones, right? Another key defensive guys We got Malik Willis XRC Malik Willis PSA 10 Titans that's gonna be for William with a spot that he won football heavy in this one Very football heavy in this one Let's see what else We're gonna close out with another graded car though. Love seeing all the grades this one is baseball And it is PSA 9 Andy pahas from 2020 Bowman chrome green shimmer And you got the auto in there as well his bowman first for my Dodgers One of their one of their top outfield prospects has grown into one of their top outfield prospects I don't know who feel if you're gonna eventually get starts Maybe part of a bigger trade package. We'll see 14 out of 99 Dodgers have a great farm system, of course That's that's also Nancy Nancy with my Dodgers. There you go, and that's it ladies and gentlemen We've got another big hit express case in the store right now jazby's case rakes comm if you want to run one back Remember the member the promo right there. I think every full spot you buy end of Spot in the related filler to these big hit express rates tonight only Get 10 entries into tonight's promo check out the details jazby's case rakes comm Bye-bye


Alright, so in this video it's a bit of a lucid dreaming motivation cure, so if you're not motivated and you don't believe in yourself or whatever, this is going to logically break down step by step why you should be, and if you don't believe that you can do it, you're wrong. So this is not going to be some hypey thing about, you know, you can do it if you believe in yourself, come on you got this, no. I'm going to very logically explain how and why it's not only simple but it's possible and even easy for everybody in theory and there's a big, I'm going to explain at the near the end how you can make sure that you actually do it. Okay so firstly let's just start with the logical stuff, hopefully that playing noise is not too loud. So everybody dreams, like you probably know right, everybody dreams every single night and what happens is most people don't remember their dreams, so their dream recall is bad, but everybody has the possibility, potential, to improve their dream recall and therefore remember four or five dreams every night. So let's just think about this for a second, if everybody dreams every night, at least four or five dreams and everybody has the ability to improve their dream recall, then everybody can lose a dream. In theory four or five times a night, now obviously not everybody does that, you know, most people cannot do it four or five times a night, they struggle and it takes a bit of effort and getting used to, but it's really, it's really more about the how much effort you put into actually practicing the use, the relevant skills, so the relevant skill in this case is dream recall and so what the studies show, overwhelmingly what the studies show and what my experience and the experience of many other people who I've taught lucid dream, lucid dreaming too, what it all shows is that the big domino, like the big thing you need to do, more than anything else, right, it's really two things, okay, improve your sleep and have regular high quality sleep to where you're sleeping about eight to eight and a half hours a night, at roughly the same time every day, waking up and going to bed at the same time every day, that's the first one and the second one is dream recall, remembering your dreams, the good news is for you that both of those things are incredibly simple to get right, like for example with the bedtime and wake-up time, all you need to do really is just be strict with yourself and say right, I'm going to bed at 11, waking up at 8 or going to bed at 10, waking up at 7, whatever, so that's the good news, the studies also show is that with the skills, like let's say dream recall, what is really important is doing, practicing it very little but very often, which is much better than, for example, saving it all for once a week and then practicing it for two hours once a week, by far the best option is to break it down into tiny chunks of like between one and two minutes practice per day and then make sure that you don't miss a day or if you do miss a day, you very quickly get back to the next one, so let's say if you currently try and get your dreams down and then you really try like on the weekends and then during the week you forget about it, your biggest hack for lucid dreaming would be to just make sure that once a week, no sorry, to make sure that once a day, every single day, you just spend the bare minimum amount of time trying to remember your dreams, it might be 20 seconds, it might be 30 seconds but everybody has 30 seconds spare in the morning, right? If you don't, I don't know what you're doing, okay, but that's what the study show, you just need to be consistent with the very small basic important stuff, if you do that everything else kind of works itself out and this is why I think motivation is kind of a it's a weird subject with lucid dreaming because in order to get motivated to do it, you need to see results, to see the results you need to put in the practice but what a lot of people do is they get super excited and then they do a burst of practice, they'll read about techniques, try a lucid dream all night and then the next day they stop and do nothing and then the day after they do nothing and then maybe next weekend they get back into it and start practicing again, that's the wrong way of doing it. If you do it like that, obviously you probably won't get the results, you need to do it little and often and this is not just for lucid dreaming, any habit, any skill, anything you're trying to learn, practice or improve on, little and often is the ultimate key, that's the hack and then obviously once you're doing that then great, get inspired, get motivated, watch films, videos, tutorials, different ideas and stories about lucid dreaming but you know first get the other stuff right you know and say okay what do I mean by that, what you need to do and again this is for another topic for another video really but to get motivated to do it you just need to logically remind yourself that if you practice little and often you will get the results like it will happen, you don't need to, it's really not that hard actually, in fact the only thing that you could say is difficult is remembering to practice every single day or at least as close to every day as you can get, you don't have to practice that much when you actually do practice and the things you practice are really not that difficult at all, it's just like remembering to do a reality check a few times a day, I mean how long does that take you right, like 15 seconds remembering every morning to start to try and remember your dreams how long does that take 20 seconds you know this is not it's not difficult really isn't difficult so and on top of that you can build you know build on other things and stuff but that's kind of the basics so yeah this is not like a hypey motivational thing about lucid dreaming but it's more just logical you know it's very easy when you break it down


Hey guys, what's going on? It's Andy guys. I'm here with Dave. I want you to meet Dave I want to tell you about him for one second, and I'm gonna hand it over to him This isn't about me today. This is about him. You guys know this this business offers the automotive industry offers more money More potential and is made for anybody in the world Dave the record month. He's been in the business for two years He doesn't take fresh ups His record for most money made in one month is 58,000 and his record for selling cars is 65 he averages about 55 cars a month Doesn't take one fresh up. I told you guys it could be done number one He's gonna tell you how he does it, but I want to start out with Dave introduce yourself Tell us who you are how you got in the business and you need to know his story His story is more important than anything else and then we'll get to the magic Dave. Go ahead, bud Hey guys, what's going on? My name is Dave to tell a base just south of Boston So just a quick rundown about me 25 years old. I lost my father and my little brother. I was living in Los Angeles. I ended up moving back home Got into drugs and alcohol pretty bad Move back home was living with my mom managing a restaurant for a couple years at 27 I kind of decided, you know enough is enough Started looking for job opportunities and I was out interviewing Having my mom drive me around because I didn't have a car at the time Interviewing for any random sales job that I could sort of find and I took one and I needed a car so I walked into a haunted dealership they full-pot me made all the money and They offered me a job too and and I jumped and I said, you know what? Let's go for it. So my first couple months in the business. I was miserable. I wasn't making really any money the first month 100% commission Making no money just hammering out the phones and they wouldn't let me leave the BDC I was stuck in the BDC for three months just ripping the phones And taking half deals wasn't allowed to leave the BDC on my third month a salesperson quit who was Kind of utilizing Facebook a little bit and I asked if I could take her old leads and she told me yeah, that's fine There's nothing there. They're all dead leads or a year plus older and I said, okay great So I ripped every single one of those I sold 34 cars that month I made $17,000 and the rest is history the rest is history and You know, I kind of I didn't grow up in a in a great way I didn't really have you know, the best life post college and I did graduate college and I kind of I slump for a few years after Going through a lot And I was kind of lost and I got into car sales accidentally and I never really thought that I could make a lot of money Doing it. I had no idea that people actually make money like they make and once you get a little bit of taste of it You realize that there's no ceiling in this business You can literally make you can go from making $30,000 a year to $300,000 a year in one year And I did that so, you know, it's living proof that you can do this And you just have to be different and you just have to work harder than everybody else and and stay consistent Get up every single day and get after work on your days off if you can And work as much as possible and and really just take advantage of all the tools that you have the internet And everything around you So so real quick this is important because I talk about this a lot and obviously guys, you know Just number one you're amazing. I'm just telling you and I truly say that this is what the automotive industry is about It's about it's from zero to freakin hero The people that come from nothing can end up with the most drug addict I don't care you like you said going into depression with losing your brother and your father which I'm sorry and Everybody right now heart is probably broken Life could sometime hit you with anything and they can strip you and tear you to nothing and you know what When you decide that you were made for greatness and at 27 your mom's given you rides and you're living with her And you're trying to figure out what the hell's next when you got that job at that car dealership, right? They probably thought man. Hey, this guy's just another number But what happened is you took massive action and tell them how many calls you were making today in that BDC department? I Was making 200 phone calls a day. I was ripping everything alphabetically. I didn't care how old the lead was I was going through I was calling every single lead 200 plus calls a day. You assumed everything was a deal You were gonna find it. You're gonna get your hands on it, right? Yeah, if they put their information in there at one point or another they needed a car Nobody puts their information in for no reason That's exactly right. Nobody's on the car dealership for no reason people don't call on the phone when they're not trying to not buy a car Okay And once we realize that everybody can buy they came to buy and they will buy if you do your job Guess what all of a sudden you start acting different you start going at it different and like everyone else is pre-qual and everybody to death You're going at it to try to find that deal and you're hustling and guess what you had an opportunity to get on the sales Ford and notice I said the word opportunity Had you not gotten that girl's list? That year-old dead list that she said hey that deal. There's nothing in there. It's all junk. Am I right?  Had you not had that 200 call-a-day work ethic and you started grinding those leads Man, you end up making yourself $17,000 and everybody in your store thought hey man something's going on here By the way, what it what what what do the veterans want you to do?  I'm talking about the negative Nancy's in the world that are going and telling you that time and experience is how you make a lot of money in this business No, it's not You can go in right out just like you did from 27 to 29 Right, how much money have you made in the car business in the last two years? I can I can tell you this when I first got into the car business my bank account was overdraft $4 and 36 cents I'll never forget it. I had $12,000 maxed-out credit card and I was just under $40,000 in student loan debt That's that was where I was at. I didn't have money for lunch and I paid my first year I paid all that debt off every penny I bought a house just closed in December 31st a half a million dollar house with the love of my life I've probably made in two years 700 grand we're right about there guys listen I want to ask this real quick because there's a lot of people out there right now That are trying to put titles on people doing extraordinary things right guy says hey I made 700 grand two-year selling cars. Guess what they're like. Ah, man, that guy's dad must own a dealership Must be getting fed leads number one. Does anyone give you a lead you don't generate? Yes or no, sir No, nope. Okay. We'll ask the second question number two. Do you take a single fresh up?  They're like all right hold up. How are you doing it? You know how? Because you're thinking outside the box You're watching people out there drowning on the pavement. I told everybody you have to become walking internet departments It's 20 20 man. It's whether you like it or not the technology age is here And how does a guy beat everybody else? Well number one was skill Yeah, sure. He's got to know how to close every deal, but also more leads equals more money now I'm gonna ask this question. Are you sitting there drilling those 200 phone calls a day now? No, because you've built processes for yourself that you don't have to do that, right?  I have my own personal Facebook page. That's a work page and people Assume that that's a dealership and it's not it's me.  He works for a Honda store. He don't brand the Honda store He brands himself and anywhere you go in the country you can take yourself with you, right? You're the investment It's you and you have all you're all in this video isn't about talking about what you have set up This video is about talking about from rags to freaking crushing it It's about going from massive problems. Hey and and really and I'm gonna say this because this is important You're not motivated Man Dave, you're driven and that's the difference man Motivated people when the sun's shining Life's great, you know, your family doesn't have any problems.  I sure don't feel like a winner today When you can wake up and do it on those days you can do it on any day and I'm telling you if anybody's watching this Dave isn't motivated. Sure. Motivated is a feeling, right? Like hey, man, I'm motivated I just got no watching a motivational video man.  What would you say to anybody right now?  Hey Welcome to America man opportunities everywhere man. It's crazy That that's it man. And hey guess what how many can I ask this one question? And then you know, obviously I don't want to make this too long I'd love for everybody to get what they need to get out of this and then get to work and make their life Change and make it happen How many people believed in you in this life that you're after right now and how great you're doing How many people really said Dave you you can do that man? How many? Two or three That's it man. You know what and you're lucky you have two or three one of them was my general manager One of them was my general manager. I should have been fired on my first day I should have been fired on my first day because I was late My very first day I should have been fired.  He's got to be a badass man. Just telling you Yeah, that's great man And and hey a number one I just want to say and obviously for in the video guys bought a new home half a million dollar house Came from nothing two years worked his way up 700k in two years. You average about 55 cars a month. Is that right? You said your record was 65 you've tied it a few times, right? You said the most the most you've ever made in a single month 58,000. Is that right? And man, and man, guess what you're just getting warmed up, bro So guys listen, I want Dave Dave you're in Massachusetts, is that right? Is that right?   So you got a giant Y, right? Yeah, dude, that's everybody out there can resonate with him 100% across the board I'm gonna say this to you wherever you found yourself connecting with him. He's amazing.  You force it. Am I right? Am I right? That's it. Yeah, like a tsunami man. You're standing on a beach when a tsunami comes in You're done man.  That's it. Hey guys. I remember what I want you to meet Dave. He's amazing I haven't done you know kind of a an introduction to salesperson in a while been on the road training a lot He reached out. He was talking and I was just like dude.  He's he's always leveling himself up You heard him say surround yourself with people that have been where you want to go You know people that you know believe in you and it by the way if it's one person You're lucky because you may not have anybody that believes in you right now And you might be on your on your own, but I believe in you Dave. You probably believe in them. Anybody can do it, right? Anybody can do it. That's it man.  Hey, it's COVID man. I don't care. There's no No excuse I was the only I was the only guy in my dealership in April. No manager there working from home remotely I was the only one in there selling cars Just kept going right you have to you have to just gotta keep going and by the way I just and look I and I'm gonna let him get off here because he's going back to enjoy time with the son But I just want to say this, you know, he was telling me he's like hey man You know, I've been making money all day get half deals in the dealership because I generate my own leads and Then I and then I send them off to another salesperson in the store Man, man, that's amazing. Get paid on vacation Man, so hey enjoy rock and roll man.  Thanks, Andy. I'll give you a call man. Okay. I appreciate it You as well. Okay. Thanks, Andy. Bye. Okay. Hey, I'll see you All right, brother. Bye-bye


No, this is too crazy So it looks like you guys really wanted me to react to bleach I reacted to bleach for the first time yesterday and said if you want more reactions get that video to 5,000 likes I expected that to happen in maybe a week. It happened in two hours.  Oh, and on my patreon. We're already on like episode 8 So if you want faster reactions uncut head on over there. Let the peak continue We reached 2,000 viewers today, which won't happen I'll put a straw in the bleach bottle and drink out of it, bro. My best friend. His name is Eric He is a Maluki.    Y'all have a face plant your father's and Grad them by the neck and order them around God oh God what we're doing this again Is bleach gonna be like my favorite anime when it comes to OSDs I've heard nothing but God tier OSDs from this show and we're two episodes deep Road is each episode have like a different episode card. That's unique. Oh now We're in school what a bunch of people will never see again beyond 30 episodes. Yeah Remember all right remember this is like elementary school guys, so you cannot find anyone attractive All right, let's keep that between us. All right.    I'm sending you on the street. What do you mean? She's hot.      I knew dr. Strange was inspired by bleach Soul society I used to roam around school my sword every day So it's really big time here we go This kid's just running away from from an invisible thing.     Oh wait a minute.  Oh wait, did it some of her Knowledge go into him when he absorbed her he saw her doing it Yeah, but still like this one thing seeing it, but doesn't he need it explained Like how do you know that was gonna work? Did he just send a kid to hell?  I bet he did Krolo why is Krolo stalking Nami? Oh I'm done talking about the OSD you already know how I feel do I don't even have to say it you already know what I'm thinking I'm not gonna repeat myself They're kind of cute.   Are you skipping the fillers? Yeah, unless you join my one thousand dollar a month patreon tier where I just watch fillers Look at her outfit. I love her in like the the character admiration way you fuckers Why is Nami always on the floor? Here we go each goes time the riser up What is that like the? The Brazilian flag on his shirt. What is that? Oh, it's the um, LGBTQ flag. Oh Tommy Hilfiger flag I love that little flower hair. She's so kawaii, bro.  She's been tainted. I bet these are the only three characters that make it past 40 episodes Walk her home walk her home walk her home Follow her just follow her.  He ain't dead.   He's the one that grabbed her leg. Wait a minute I just put this together the guy watching her from her window was her brother but her brother had black hair he didn't have orange hair and He was wandering so that the soul reaper society Made him into a hollow and now he's trying to follow her again and Why are you all saying pre-watched I really hope I'm not right I Really hope I'm why is live saying pre-watched. What do you want away? She does watch bleach.  I'll always say looks better than real food.   Was I just right was I right? I swear to God I swear to God. Am I safe? Am I safe from any anime? I mean it was a little obvious right like anybody could have put that together, right?   He knows brother. I think her name's Eno. I think I said the name you know, you know That's Eno.    Gee this this is not fair This is not fair for other animes. This OST is too good. We gotta stop guys It's it's time for bleach to stop. This is bullying at this point Meanwhile they're having a girl's night out.    I love it I love the I love the OSTs so much. I love the ending. I love the opening I love the sound effects. I love Ichigo. I love Inoue.     We're back. We're back Uh-huh, he will go after the soul of the one he loved the most in his life and of course it was his oni-cha Told you I'd stop at the peak man. I can't take it anymore What I miss. I don't miss that thing. I don't miss a thing. This is nicolas.   My god. Look at her No Oh, she's okay.  That's what I'm thinking.  They're getting stabbed. They're crawling their pin to the floor like imagine The brother has her chained up Of course, her brother has a chain Oh, that's her soul. Yeah, she was like punched.    Come on. Come on. Okay, let me real come on Come on.   How is she taking all of this she's just like a high schooler Finally you fuck. Yes. Yeah Finally a main character that's killing.  I was bullied. You know why they're born first to bully the younger brother.    I wonder Look, he was always there Oh, wait the main characters these worked on him.  That's the hollow corrupting his heart What is the block thinking when they see like houses exploding on the block? Like just out of nowhere. They don't see this giant serpent with a bowl cut They they did they just see a house literally falling apart. What did they think it's yeah gas explosion? How did they explain this? Is that how they actually explain it a gas explosion? Oh, I was just building a bomb. I was gonna bring it to the city, but um it blew up an house. Sorry. It won't happen again How high is that jump? Oh god you green mist Bro, this level one hollow is pretty good.   Yes At least he died in style My god, I didn't even notice that man.   I am so dumb. I thought the hollow was driving and trying to kill her Is this the first bleach emotional os to you about the play?  God You better fight harder. Come on. It's your little little nom.  God, can he die in peace? Yes Let these freaks handle it, bro I'll use my keto to save her.  Why are they doing this?   What are you touching bro? Let him cry before he himself. What a great combination He's dying peacefully.  Yes Put a smile on his face. Yes Whoa Episode three is a w episode one was a w episode two was a w episode three is a w Wait, so where's her body? Is it like is she just stuck like that? Oh wait, she's back Just tell the world now. They're gonna think you're a freak Yeah, that's believable Remember when y'all had a picnic on your school roof I was on no roof, bro The only time I was on the roof if I contemplated jumping off of it Jesus Memory replacement You know what I need memory replacement for the Naruto endings. That's what I had I had memory replacement for my reactions. That's why people think I've watched 100 before nah, man My my memories were were recreated. They were replaced man. I I they made me forget about it There we go, that's what I'm talking about. I like that.  Yeah, but he has this attitude about him that I really like I like this attitude. I don't like that.


Today on the trainers they are working on the ESIS system, the instrument stand-by system. They're troubleshooting it, finding out the fault and then fixing it. My job here as an instructor as of 15 November is to train and mentor highly educated avionics mechanics for the future generation. As a 15 November instructor we teach these soldiers to be the best avionics mechanics as they can, teach them the hands-on to be the best mechanics in the operational environment. The purpose of the actual trainer that we were working on today is to simulate actual real-life aircraft. That way they know how to work on it once they get to their actual unit. We have all the actual components and functionalities and wiring that an actual aircraft has. We go straight through our actual technical manuals as of 15 November and make sure that we teach them exactly how to perform the job. I enjoy and love being a 15 November instructor, teaching the actual soldiers, seeing them later down on in the future, being one of my own soldiers.


The study found that after three years, only 17% of the pyrethroid-long-lasting insecticidal nets, lins, distributed in sub-Saharan Africa, were still present in the homes where they had been distributed. This suggests that these nets may need to be replaced more frequently than previously thought. Additionally, the study found that the PBO lins were more protective against malaria than standard lins, despite having similar levels of pyrethroid content after three years. This article was authored by Elliot Lacolle, Jackie Cook, Jacqueline F. Masha, and others.