Thank you very much Bonnie. Great introduction. Most of the time the entertaining comes because I'm giving extemporaneous remarks. This is actually a cleared address this time. I can't even remember the last time I did that. When I needed that for this audience, this is the most impressive collection of Taiwan hands ever assembled in one place. I think it's very, congratulations to Brookings and CSIS for bringing together such a terrific group. Today, 35 years after the Taiwan Relations Act went into effect, it remains of course the guiding document for our important and valuable relationship with Taiwan. And I agree with President Mao when he says that U.S.-Taiwan relations today are stronger than ever. Some respects may be even stronger than before in 1979. In 1979 there were many in the White House, many in the State Department who did not expect that in 2014 we would still be talking about U.S.-Taiwan relations. Unfortunately that view is supported by the historical record that has been coming up. They certainly would never have imagined that it would be such a close and important relationship today. As we've heard earlier today, the tendency then the tendency for quite a few years afterward was to treat U.S.-Taiwan relations as an issue or treat Taiwan as an issue, a problem in U.S.-China relations rather than as a separate substantive meaningful relationship in and of itself. Today we do take our relationship with Taiwan seriously. We do treat it as a relationship on its own merits. The language of the TRA continues to be very relevant I think for policy concerns. And I think it's instructive as we did a little bit today but I want to continue that to look back at how some of that language evolved into its final form. Discussion of the TRA usually focuses on its language that commits to the United States to provide Taiwan with arms of a defensive character to maintain the capacity of the United States to resist any resort to force or other forms of coercion that would jeopardize the security or the social economic system of the people of Taiwan. And to a determination by the President and the Congress of Appropriate Action to take in response to any threat to Taiwan's security. This language is the core of our of America's unique defense commitment to Taiwan. A commitment made of course by no other nation. A review of the legislative history which we were treated to this morning shows that Congress added much of that language I wrote much after hearing this morning I would say most of that language to the original executive branch draft text of the TRA. The underlying policy for this commitment was spelled out in I think language is also very important in the TRA's preamble Quote to make clear that the United States decision to establish diplomatic relations with the PRC rests upon the expectation that the future of Taiwan will be determined by peaceful means. That policy of expectation that the future will be determined by peaceful means. And all the commitments that follow from that policy remain unchanged 35 years later. The TRA's defense commitments I think understandably get most of the attention. But the acts underlying the acts broader more fundamental goal was quote to preserve and promote extensive close and friendly commercial cultural and other and you can drive a truck through other of course relations between the people of the United States and the people of Taiwan and quote that the entity that then was created to manage the continuing relationship is of course our dear American Institute in Taiwan. We all know the Institute functions in nearly all respects the same as an embassy with representation of all the US agencies that you would expect to find in an embassy and the capability to represent US interests on all issues. Moreover the AIT format became the model for many other countries that subsequently or in some cases even earlier had broken relations with Taiwan. So you could say that indirectly the creation of AIT the format that we came up with for it contributed to Taiwan's ability to maintain close ties with numerous other countries. Over the years we have in fact made a few adjustments to make the relationship to make the AIT structure work more smoothly. I can give many examples but one of the most obvious I think is that a few years ago about a decade ago we decided to send active duty military officers to serve at AIT instead of relying on retired officers which had been the practice since 1979. But the basic structure of how we deal with Taiwan, the basic structure of AIT is unchanged and it is now really largely mirrored by the structure of Dr. Shun's Taipei Economic and Cultural Representative Office in Washington. The TRA drafters were very careful to ensure that agreements between the United States and Taiwan prior to 1979 would remain in effect and also to spell out how future agreements made between the U.S. and Taiwan would come into effect. Today AIT manages and oversees the implementation of over 100 agreements and arrangements between U.S. government agencies and their Taiwan counterparts all handled through AIT and tech row channels. At the same time right now over a dozen additional, I think it's more like 15, 18 additional agreements are currently under discussion. And if you look at the breadth of pending agreements, of existing agreements between AIT and tech row I think it attests to the very wide ranging substance of our interaction with Taiwan. It ranges from defense and security issues, environmental cooperation energy efficiency, scientific and technical collaboration, law enforcement, training programs for people from other countries and so much more. Now on the occasion of the TRA's 35th anniversary Assistant Secretary, Danny Russell, testified in April before the Senate Foreign Relations Committees, East Asia and Pacific Subcommittee my friend Kien Moi, our Deputy Assistant Secretary testified in March before the House Foreign Affairs Committee so those testimonies outlined in considerable detail the current state of our economic, cultural and security ties with Taiwan as well as our support for Taiwan to have meaningful participation in international organizations. I will spare you from repeating all of the excellent information available in their testimonies but I'd just like to highlight what I think are a few important points. Let's return for a minute to the important subject of our support for Taiwan's defensive needs. We believe that support has given Taipei confidence in its engagement with Beijing. The result has been the impressive string of agreements on trade transportation, law enforcement, cooperation and other cross-strait ties that have been concluded in the past six years. President Ma has certainly made clear both privately many conversations that I and others have had with him and publicly as well. The connection that he sees between American support for Taiwan's defense capability and Taipei's ability to negotiate confidently with Beijing. The Obama Administration has notified our Congress of over $12 billion in sales of defense equipment and material and training to Taiwan. As China's military spending grows, as China continues to carry out military deployments and exercises that are aimed at Taiwan, it is more important than ever for Taiwan to invest sufficiently in a professional military force that uses asymmetry, innovation and other defensive advantages it can muster to deter potential attempts at coercion or aggression. Our security relations with Taiwan are about much more than arms sales. The U.S. engages in a wide range of consultations and exchanges with Taiwan in order to assist Taiwan's armed forces as they seek to maintain to train and to equip a capable effective self-defense capability. Our defense support for Taiwan is based only on our assessment in close consultation with Taipei on what Taiwan needs for its defense. As we have assured Taiwan many times before, we have not and we will not hold prior consultations with Beijing on arms sales to Taiwan. Our economic relationship with Taiwan is also something of great mutual benefit. Taiwan is, I was going to say 12th, I now know from Lushan it's 11th. It goes up, it's been 10th, it's 11th. Largest trading partner, it's a top 10 also destination for U.S. agricultural and food exports, big market for all those things. I used to like to say that Taiwan per capita is extremely high. It's like number two. I used to like to say Taiwanese people like to eat, drink, wear, and smoke U.S. agricultural products. I was criticized for the smoking part, but I said the numbers don't add up. It's no longer number two per capita if you take out the tobacco, so we have to leave it. Sorry, that is departure from the clear text. Yes, right, yes. Another thing, Taiwan investment in the U.S. for a long time was a pretty stable figure. It's growing. It's really picking up. I had the honor of accompanying former Vice President Vincent Xiao and his big delegation of top CEOs when they came here last November. Just during that trip, for most of plastics announced it was putting $2 billion into it's already large petrochemical facility in Texas. I've talked to a lot of other top CEOs who are seriously working on and moving toward other major investment projects in the United States. I think the price and supply of natural gas in the U.S. has become a major factor attracting these investments, added to all the other things we have going for us here that are attractive as a manufacturing hub or as an export platform perhaps better now than it's been in past years. Taiwan tourists to the U.S. also have increased significantly, started out a little slow after Visa Waiver, but it's picked up and that's another very positive factor. Now these are all tangible factors, whether it's tourist numbers, investment numbers, exports, things we can put a figure on, which immediately benefit the people and companies in the U.S. and in Taiwan. But I think we also know from our Taiwan friends that it is very important for Taiwan to maintain its economic autonomy based on a diverse spread of trade and investment ties, including the United States, Japan, Europe, and its Asian neighbors. Economic autonomy like self-defense capability and international dignity is an important factor in giving Taiwan the confidence to strengthen cross-trade ties. For both strategic and economic reasons, we attach great importance to the resumption of our Tifa Council talks, trade and investment framework agreement talks at the Deputy Ministerial level a couple years ago. Our economic dialogue and activity with Taiwan has increased in a number of ways and we're looking to increase investment, increase trade, and to help Taiwan maintain a balanced economic relations in the world. I'm going to just close by noting that I think, and I've said this in other gatherings, I think an excellent symbol of the importance we attach the commitment we've made not just to current U.S.-Taiwan relations but to the future is the splendid new office complex at the IIT that we are constructing in the Nahua District. I picked the site out myself, it was quite a long time ago, but it's getting, it does have great feng shui, by the way, also, but has the mountains behind and the river in front and so forth. Seriously, the main building is large, modern, attractive. Those of us who've seen some of our other new embassies in the world may find the word attractive and surprising. This one really is, not like the embassy in Bangkok, where it was, for example, sorry if anybody person about that, but it kind of looks like a federal prison. We expect to move in, we expect to move in to the building in Nahua at the end of next year. Okay, and a very important point, seriously, this will be the first dedicated office building any country has built in at least 30 years to have as its representative office in Taiwan. I think that's a great symbol of our longstanding and important future relationship. The core of that relationship has always been our shared belief, I shouldn't say always been, I say it's been since the late 80s, our shared belief in democracy, rule of law, and human rights. Americans have a deep respect for the extraordinary economic and political progress that the people of Taiwan have made, I would say made against all odds, frankly, in the 35 years since 1979. And for our part, we will continue to stand by the commitments that we made to Taiwan 35 years ago. Thank you. Well, you did not disappoint Ray, it was both entertaining and informative. Ambassador Burkhard has agreed to take a few questions, we have about 10 minutes, so please keep your questions short so we can try to work in more than just a couple. I see all the journalists have their hands up. Okay, journalist number one, John Zang over there. John Zang with CTI TV of Taiwan. Mr. Ambassador, you talked about Taiwan's economic autonomy. How do you see the recent student demonstrations in Taiwan against the service trade agreement across the street? Thank you. Are you concerned in any ways that the kind of demonstrations is not just against any agreement with the mainland, but also having an impact on other free trade agreements that Taiwan may be interested in signing? Thank you. Thanks. I mean, all my friends are mouthing things to me and sort of trying to give me signals here. Look, I know over analysis is the greatest, you know, the most popular pastime in Taiwan of anything, you know, so and we try to avoid falling into that trap as much as possible. I've seen some interesting comments by Taiwanese I respect, including people, you know, who are close to the president about these two, and I've seen comments, you know, I see look, I'm going to speak as an analyst here, you know, of Taiwan. I mean, the student demonstrations seem to reflect wariness about the pace of integration with the mainland. I don't see them as a, I didn't see them personally as a comment on a sort of protectionist sentiment, you know. I mean, I think anyone can see that there were no demonstrations against the free trade agreement with Singapore or the free trade agreement with New Zealand. So the conclusion I guess most of us would draw is that this seemed to be all about relations with the mainland, and how they felt that those were being handled or, you know, fears about where it was going. And so I'll just leave it at that. Sorry. Taking a job away here. This is the journalist. Chris Nelson, also important. Following up on John's economic question. Ambassador this morning very clearly says, you know, Taiwan is super interested in getting a TPP. We've said we're certainly, we would welcome that. Our friend, the president of the American Chamber of Commerce in Taiwan says, yeah, but if you really want to get into TPP you need to do the economic reforms that we've been talking about for years. Do them, and then USTR can go to the White House and say they're ready. Let's see what we can do here. This is a classic chicken and egg problem. How do you see it? What advice do you give, and if there's a prediction you could give, that would be great. First of all, I mentioned that we've really revitalized our economic dialogue with Taiwan. Not only at the deputy ministerial level in the annual Tifa Council talks, but in lots of lower level talks, and in some of the policy meetings we have with Taiwan, economic issues are things we're deeply engaged in talking with them about. And obviously TPP and what that involves is one of the topics. So there's no shortage of interaction between us about that subject as well as many other subjects that are important for economic and trade relations of Taiwan, the United States and Taiwan with the world. There are just a few facts. TPP is now a dialogue, is now 12 countries are now involved in the first stage of TPP negotiations. We need to finish that round. Taiwan understands that. Everybody understands that. When that round is finished, then the talks will be open to other negotiating partners. The nature of TPP is that there has to be consensus, there has to be agreement, I think it's not just agreement among the existing partners on admitting new partners. The way the process works is negotiating partners are not actually invited to join. That's not the way the process works. When Japan came in or Mexico and the same process would apply to Taiwan or anyone else a new negotiating partner expresses interest and applies to join. That's in fact the way the process works. Taiwan wants to join the TPP negotiations second round, it would apply to to join. Obviously you do that after a lot of ground work. I see Taiwan is doing that ground work, that's all public. All the work that President Ma has gotten his administration to do, all the work that Taiwan's representatives around the world have been doing meeting with not just the United States but with all of the 12 Lucian's colleagues in 11 other places, 11 other countries also have engaged with those countries about TPP. So Taiwan's doing the right things in this process. I'll just leave it at that. Let's take one last question. Maybe somebody who hasn't asked a question yet, Norman. Excuse me Ambassador Burkhardt. My name is Norman Fu. I'm a columnist of the China Times. You gave a very upbeat account of US-Taiwan relations however in the meantime there have been some disturbing developments. I refer particularly an article by University of Chicago professor entitled Say Goodbye to Taiwan published in the National Interest Magazine. His argument is that when China rises the US ability to defend Taiwan will diminish incrementally. So much so to the point one day the United States will be unable to defend Taiwan. That will be the time when the US will have to say goodbye to Taiwan. You buy that argument of this professor? Yeah. I was recently at a very interesting discussion of US officials and former officials with Taiwan officials and former officials. I made sure that Mirsheimer's article was on the agenda and it was a great discussion. I can't quote any of the people involved that was part of the terms of the conversation but we were treated to a really great analysis of the so-called realist foreign policy analysis and some of the alternatives and where Mirsheimer fit into all that. One of the fascinating factoids that came out of the conversation is that one of the people there was actually involved in teaching a lot on the mainland Beijing University and so forth and he said the Chinese students of international relations love Mirsheimer. Is that true? Look, I think this kind of analysis, it's good, it gets you thinking. It gets you looking at what the situation is but I think there are a few obvious comments that would make about it. One is islands have certain defensive advantages whether it's Japan or Britain or Taiwan. I'm not sure Mirsheimer completely or I'm not sure we as a government are sure that Mirsheimer completely took that into consideration as analysis. The other thing I would say is that just going back to some of the comments that Randy Schreiber made earlier and so forth, we in fact do have a very in depth discussion with Taiwan at all levels about arranging from policy makers to sergeants about what Taiwan's defensive needs should be. And I'd say we've made a lot of, we've made real progress both sides in working and I mean this business about asymmetrical weapons and so forth. I mean it's not just a mantra. We've looked at what Taiwan needs and if you look at what Taiwan has done in its own indigenous defense development work as well as in what it's bought from other people, you see just exactly the kind of items that make sense in terms of dealing with the kind of threats that Mirsheimer was talking about and that includes like I'm not a military man but I'll tell you the kind of things that military people look at and like, you know, mobile anti-ship missiles, fast patrol boats, greater capability to handle naval mines both removal and putting them in. And the list goes on you know and Taiwan's getting good at this stuff and this represents exactly the right kind of attitude. You know, Mirsheimer looks a lot at the balance of forces on the other side of the strait. There are only two things that matter in terms of what Taiwan has to do in terms of defense.  Great way to put it and make them really have to think twice. Survivability it means surviving long enough until let's just say external factors can be brought to bear to resolve the conflict. Terms of you know, the other half of his argument what does it mean in terms of US commitment and US capability. Commitment is something and it's something we have to we say it and as Randy Schreiber put it, we have to walk the walk too. We have to do things which show it's still there. That's important. Terms of capability I spent a lot of time at the Pacific Command being able to deal with area denial and access these are exactly what all the plans are about. Exactly what these are exactly the important issues. I'm for one fully confident that our military will be able to do that. So thank you very much.


Hey, what's up guys? Good morning. Good afternoon. Good early morning wherever you are in the world. Ah I got my I got my coke zero. I got my fresco Let's get it All right, so today I'm gonna call for rent by owners. Hey, it's a little plot twist So red X has of course a bunch of different Types of leads for for sale by owners geo leads expired for rent by owner pre foreclosures So today I'm gonna call for rent by owners. This is something I've never called the for rent by owners. What's up, everybody? I Never called the for rent by owners I know a lot of agents who have that have a lot of success with them so So as I make these calls every week, I'm gonna hit a different lead source Every week. So the first week I did expires then I did Circle prospecting and then last week I did for sale by owners and Today I'm gonna do for rent by owners Mm-hmm So these leads are actually Owners who are trying to rent their property and it's by owner. These aren't management companies and so on and so forth. So It's really cool because You're catching an owner if you call them right when the lead comes up then you're catching an owner right when they're trying to rent their Property so there's a lot of different things that could happen right there They could be in the middle of renters whereas they may be thinking about selling this this is obviously an investor They manage their own property. So that's very interesting. This could be a very good candidate to pick up another rental property There's a lot of stuff going on there With my market, there's not a whole lot of them as you know, I'm in a really small market So I'm gonna be going back in time on some of these where some of these may be a couple weeks old or even a couple months old And so those properties may be rented out already and you'll see where I take those conversations All right, let's see What else I got oh the reason I'm doing this today really early is because I'm hopping on a flight right after this call to go To Nashville to do this really incredible event tomorrow.  It's gonna be a really big event All right, let me get all geared up right here Let's see what we got Yeah, there we go, I'm gonna put this in the comments See you guys can grab the discount redx discount comm if you want to grab for rent by owners geo leads expires for rent by owners I mean for sell by owners Pre-foreclosures all that good stuff. I'm gonna pin that Cool, yeah, go to redx discount comm to get the hundred fifty dollar discount to get started today Let's see And cool. This is cool comment before I get started started the 28 day program yesterday called old expires and had two great conversations Both rented but willing to meet me to list when renters leaves shot my live video today as well Man, that is incredible, bro Nice That's what it's all about right there guys. Are you excited? Just about the market in general man, it's like whoa, this is the this is a dream market right here, honestly The difference in the normal redx Leads the geo leads and the plus like geo leads they give you I think it's 20. I think it's 5,000 or 2,500 for the regular but then they give you 7500 for plus but then the plus also has email addresses So with plus you're getting more data getting email addresses probably some more phone numbers and you know like More phone numbers per lead stuff like that So it's way better Plus you can use all that data and use ad builder with redx to do to run Facebook and Instagram ads to those people All right. All right. Cool. Cool. I'm gonna dive right in here See right here I got it. Just moving a few things around so I can See what's going on? All right Let's do this man Okay All right, let's see the first one. I'm gonna call is Is in Daphne Let's jump right into it The cool thing is is nobody's probably calling these leads Let's see if I have that right So the cool thing about these leads is who's calling for rent by owners, right? Probably nobody so these are these are kind of a unique Lead Lead source here. All right, let's get it. Hello. Hey, is this Roger? Hey, Roger Ricky Karuth EXP realty here in Daphne. How you doing today? Okay. Yeah. No, it's kind about that house on 2nd Street. Was that for rent? Did you have that for rent? Okay, no, I had your name here for a house in Daphne on 2nd Street that you were possibly trying to rent So that's probably they probably was probably a typo with the number or something like that. I got you. I got you Anything I could do to help you looking for a good real estate agent you looking for investment properties rental properties anything I could do to help Yes, sir. You have your good day wrong number Let's get it right here. Uh-uh two three five Let's Get it Hey miss winter. Hey, this is Ricky Karuth EXP realty here in Foley. How you doing today? Good Do you do you have a house? Do you have a house in Foley for rent? Okay, did you did you run it out yet? Let me write that down. You got short term for now and then long term start in august 1st It's 1500 a month What's What what what is it? Where is this property? I don't have the exact address Oh Got you No, I got clients to come down. So I sell mostly Gulffront condos on the beach So I just saw this and I have clients that come down that you know Want somewhere to stay while they're looking around at properties and stuff all the time So I figured Yeah, okay. I know orchid. Is it a house or a condo?  Okay I actually used to live there Okay All right. Cool. Cool.  Okay Okay snakes or like cows or Oh my goodness. I love to hear those stories Oh my god, how big was this snake? Mmm. Yeah, I know crossby. My goodness Yeah, got you and then at that point it's a it's a long term like for the for the winter or something Yeah, okay Okay, what was no snakes or anything Um, what uh, so what's the what's the length of the lease? Uh for that Okay, you said you said it was short term till august 1st and then Yeah Got you got you got you I got you So it's like just month to month like whatever got it Okay All right, cool. Cool. Cool. Yeah Got you got you. Okay. Cool.  No that That that's not a problem. All right, cool. I'm gonna keep that in mind for clients and stuff And then what about you like are you looking for other rental properties or? Um, is there any Yeah, do you want to buy stuff or sell stuff?  Are you you think you'll ever sell that place? Yeah, um Got you.  Mm-hmm. Yeah, I love Kim. Yeah Got you. Got you. She's made it through Got you got you. Okay. Cool. I tell you what Yes, ma'am. Hey, um Let me uh, what's your email address? Mm-hmm.  Got you. Yeah, I'll stay in touch with you there and I'll keep your place in mind and again. I'm ricky I'm ricky keruth. I'm right here been doing this 21 years. I grew up in gulf shore. So Cool. Yes, ma'am I will I'll send it to you today Have a good day. Thank you.  So it was really cool because the email that she gave me there Was the email that is right here that redx gave me so it's like i'm every time i'm asking for the email I'm looking at redx to see if and like 90 of the time it is the email that's in there um, it's not always but uh But that that was the the right email So i'm gonna get her Let me go ahead and grab that and just get this set up before I go to the next call. So I don't forget To do this I'm actually gonna go ahead and send this uh the subject is thanks for you coming the phone today It was a pleasure Speaking with you I will keep your rental in mind Yeah, sylvia redx has email data. That's you have to get the plus either um Geo leads plus expireds plus all that and this is actually for rent by owners and it had for rent by owners I guess it's plus for rent by owners plus. It's got all the email information as well I'll keep you in it. I'll keep your rental in mind for future clients let's say Stay in touch via email no If there is ever anything in the world I can do to help you Watch out for Snakes Let's say I might make sure she's in my weekly email as well. Boom. Boom. These for rent by owners are fire Fire She's in my weekly email. I've sent her an email and i'm on to the next call. I just figured I go ahead I mean like honestly in a call session. I would just um Keep making calls But I kind of wanted to play that out and tell you what I was sending her just so you see How simple the emails are normally do all the welcome emails at the end. All right That was a cool call Let's hop on down here to the next one And see what we got You guys uh, smash that like button while you are Watching going through your day I'm just here making calls. I used to do I did this Four or five hours a day for 15 years Hey Kathy ricky crew the exp realty here in foley calling about the rental you have there Um, you can reach me here<PHONE_NUMBER>. Have a great day All right, I hope you guys got a real kick out of that call and that was That was hilarious. I got a snake You had a snake over Snake we lost the snake Hey galina it's ricky caruth exp realty here in golf shores Calling about your rental if you could give me a ring back<PHONE_NUMBER>. Thank you. All right guys Let's see. Let's see. Let's see. Let's see So andria, um I did expireds. I think three four weeks ago if you want to go back and watch that one It's right there on the channel, but I'm doing a different lead source every week. So I think I got pre foreclosures. I'll do next week and then Depending on how my schedule works out, then I'll do I may come back to expireds So just busting through different lead sources on radax every week. All right, let's see who the next one is Let's see what we got here. All right. All right. Let's see Bam nobody's calling nobody's calling these leads That one slipped through somehow it has the name is james, but it looks like that was That was a uh What you call it that was a management company Dude, I just chugged that little mini coke zero switching over to fresco But I'm about to hop on a plane I'm about to get right up in Nashville Let's see who we got see that's it's okay. So I'm catching a little trend The ones that have no last name Those could quite possibly be management companies not very many of them Management companies are fine too. Let me talk to management company. You don't care Hey, eric ricky cruz here exp realty and orange beach. How you doing? Good man. Y'all got a property for ren and orange beach I see something over there on magnolia avenue There's a property on magnolia avenue orange beach alabama And this number is attached to it Where are you guys at? Gotcha. Gotcha. Okay. No, I was just a wrong number of mix-up situation Yep, thanks bud. I wanted to kind of dig in there and see exactly what was happening Let's see status for rent by owner less price Let's see agent Okay Okay, okay Moving right along let's see what we got here Okay, so You know what andrea I got about 20 minutes here. I'm actually going to switch over to expireds All right Let's see Yep All right. I'm gonna dive right here Oh, you know what I'm gonna do and we'll call some new expireds Let's see what we got Let's see what we Let's say three seven Let's say let's say let's say cancels I'll refresh this See if I can get the days Well, here we go Here we go Hey miss galina Hey, ricky kruth here exp realty. How you doing? Good. Do you have a property for rent there in golf shores? Is it is it still for rent? I take it Is it a long-term lease or what is it exactly? Okay. Okay. I got you. Is that a house or condo or what I can't really tell Okay, okay, but they have a six month Got you got you All right, let me I'm looking at a map now trying to figure out. Oh, that's down. That's down kenrod 8 Or that's down kenrod 6 kenrod 6 and then up in that subdivision. Okay All right, and you Let me go back to the thing I Let me get back to it because you called me back. I move out 2400. That's what you want for it Okay, um What's the story on it?  Mm-hmm Got you got you so you guys come down and use it sometimes and then Okay, cool All right. All right. I'm gonna keep that in mind because like I I grew up here and I'm a real estate agent I always have buddies looking to You know looking for stuff to rent and honestly, there's just not much around so I just want to see if that one's still available and um You know kind of Next week just for 10 days, we're gonna be there and then probably we'll See what we're gonna go I got you. I got you. Okay, cool. And are you guys interested in other rental properties down here? Like buying other rental properties down here? Okay, um, do you think you guys will ever sell that house? Okay Yeah, I hear you do you guys have an agent down here that you normally work with Like buying is What's up? Okay, cool. Well, I've been here 21 years selling. I grew up in Gulfshores right there You know, I'd love to interview for the job whenever it Comes up. I'll tell you what would it be hard if I stayed and I'm gonna keep this rental in mind And then also if it's all right stay in touch with you. Um What's a good email for you? I'll send you all my information Okay Got it Okay, I'll send you my info and stay in touch with you via email there If you need anything Ma'am Yes, ma'am broker. Yes, ma'am. Yes, ma'am Yeah, if you need anything, let me know and I'll keep your house in mind if I run anybody Because I get calls all the time from people saying do I know something for rent? So Um I'll keep that in mind as well Just let me know if there's something I could do for you Yes, ma'am. Thank you. Bye Boom boom So she called me back um I left her a message she called me back and Uh So that house is like a single family residence that they had as a sink as a second home and they You know, they live out of state So I don't really use it as much. They're going to be down next week actually, but um They're just looking to rent it, I guess I think they're kind of like this is the stage where they're not using it as much I see this all the time The use that they're using it They were using it a lot now they're using it less now They're going to start trying to rent it and then eventually sell it. I see that story play out all the time So when she said oh, I'll look for an agent whenever I uh Oh, and that the her email was the email in redx So when she started saying it I was like, I don't even have to Write it down. I can just copy and paste from redx And I'm going to go ahead and email her. So what I'm going to do is I'm going to put the I'm going to put the house address and the subject that way she for sure opens it Thank you for your time on the phone Today I will keep your rental in mind And when you decide to Sell it Give me a ring. I will be glad to help I grew Up in golf shores and have been selling Real estate here for The last 21 years If there is ever Anything in the world Do for you Call slash text anytime There it is ladies and gentlemen. Oh, yeah Ah She was like what what kind of accent do you guys think she had? Was that russian? Was it uh What what do y'all think that was Right and this kind of goes back to like and honestly that they live in chicago Obviously a foreign accent Not sure, you know, if if she's you know Came from another country or you actually grew up here or whatever the case may be Um But it just goes to Like i'm communicating with people from all different kinds of backgrounds from different areas Um everything A lot of these people I deal with are not even in my area not from here don't live here So and so forth. Okay Let me see Let's see Where is I going with this so Anyway, I just emailed her added to my weekly email. That's a done deal And we'll see what happens with both of these leads. So I talked how many people that I talked to four I believe Three or four and I got two emails and they're really actually pretty really solid leads honestly So, um Yeah, I'll tell you what I I was going to hop over to uh expires before that lady called I'm going to put a link right here if anybody wants to come on the live with me I got time for one person if anybody wants to just hop on Let's see. Oh, was that there the whole time? I'm sorry Um outside of that I'm going to scroll through the, um Comments if you guys have any questions. I'm going to go hop on a plane Let's see Okay, this is this is a good one What's the reason for calling a for rent by owner possible? They will sell Robert listen, man. It's about Whatever they want to do It's about whatever they want to do Um, I'm never calling with an agenda My only agenda is is to use the property as an excuse to talk to someone to see what it is Well, number one to see if I can connect with them see if there's a connection to be had And then use that to figure out what it is they want to do in terms of buying or selling real estate and what I could do to help them do it Um, so it's every lead is the same guys You know, you guys heard the conversations, uh, you know, hey, you got a house for rent tell me about it What's the deal with the story? I hear all about that all about the snakes and everything And then I turned it into great. I'm going to keep that in mind Um, would you be interested in buying other rental properties? Uh, you know, I'm looking for investors here. If I had a great deal on a rental property, would you be interested in that? I'm trying to figure out if they are a buyer Uh of more properties or if they're a potential listing down the road I'm just trying to figure out their situation. So every situation is different and um and so Honestly, like for rent by owners expires for sell by owners geo leads online leads internet leads facebook instagram zillow Open house fear of it. It's all the same exact stuff. That's why I say Why spend so much money on leads? When you can get people's contact information for a couple of pennies Like I just did just demonstrated and just talked to these people If you have to pretend like they're Hazilla leads to do it then do it But it's the same people ladies and gentlemen same people Okay, cool All right. Hey, listen nice little quick little call session got one in right before my trip If you're in nashville looking forward to seeing you. I'll tell you what the rest of my schedule is here. I got I got Let's see richman or lando denver leisington houston vegas sacramento That is the uh lineup for me for the next couple months travel on all over to see you guys looking forward to it Anyway, you guys keep calling you guys see what I did here picked up two leads People are going to do business with me in the future already sent them emails put them on my weekly email It's really that simple guys keep plugging away Quit focusing on the prop quit focusing on the property could focus on trying to close people Just focus on the person get to know them see what it is You can do to help them and get them into your ecosystem for the weekly email and treat them like family And you will crush it now is the time to really get in there and make it happen All right, I'll see you guys soon. Love you so much signing off


Live from Madrid, Spain. It's theCUBE, covering HPE Discover Madrid 2017. Brought to you by Hewlett Packard Enterprise. Welcome back to Madrid, Spain, everybody. This is theCUBE, the leader in live tech coverage. And we're here at day two at HPE Discover Madrid. My name is Dave Vellante. And I'm with my co-host for the week, Peter Burris. Jeff Carlott is here. He's the senior director of Solutions Go to Market with system integrators at Hewlett Packard Enterprise. And Kalyan Garamela, who's the IOT manager at Deloitte. Yes, sir. Gentlemen, welcome to theCUBE. Thanks for coming on. You bet. Love to be here. It's always a great time.  You've got deep expertise in vertical industries.  Last time we were talking about manufacturing. This time we're going to talk about retail. Yes. Why retail? You know, retail's in turmoil. Everybody's got an Amazon war room, you guys are going after that, helping some of your customers sort of take advantage of their physical presence, bringing in an online presence, moving to digital. Is there hope? There is hope. Retail is not dead. You know, I hear all the time about this, retail apocalypse, retail is dead. And in reality, it's not dead at all. Still 85 to 90% of purchases are being going through a brick and mortar store. The problem here, and the apocalypse will happen to those brick and mortar retailers that don't change. They don't digitize and change to the changing demands of a consumer in the way they want to purchase something. Give you an example. My son, or even myself now, I increasingly want to do things through an experience. My computer, my mobile phone, I do research. I want to understand. I want recommendations. I want personalization. I want to be catered to. I don't want to go stand in line. Well, that experience can be done, but our unique ability is taking that experience and applying it into a brick and mortar environment. Well, I got to say, I love going to Cabela's with my kid, with my wife. I mean, I can spend all day in there. Can't get that on Amazon. So Kalyan, tell us about your role at Deloitte. Obviously, you're specializing in the retail practice. What's your background? Yes. How'd you get here? So my name's Kalyan Garimella. IOT manager from Deloitte. IOT practice, based out of San Francisco. And we have been working with our partners and friends, HPE, Aruba, over the past year or so, helping them develop IOT go-to-market projects, products that we can take to market. And recently, we just working with manufacturing and the retail industry. So what's the conversation like with your customers? As I said, everybody's got an Amazon war room. They're trying to figure out, okay, how do we leverage our physical presence as an advantage? What are the conversations like with clients? With our clients, mostly, they're talking about how do we mimic our online channels? If I go to an online retailer, you know if I go open, say Amazon.com, they know exactly what item I am purchasing, where I'm going next, what, how much time I'm spending. So in order to differentiate the brick-and-mortars, in order to differentiate themselves from the fellow retailers, they have to offer that customized shopping experience in order to give a reason for the customers to come in store and make that purchase. So they're trying to look at what new technologies that we can help with, what are the some of the new processes that we can help with, and that's where most of our conversations have been going on. Yeah. So it's a really experienced problem. It is, and you talk about Cabela's.  I want to touch and feel it. I want to lay it in. I want to understand. Well, that is a perfect opportunity of providing an experience that allows me to do the research, get suggestions, go into a brick-and-mortar store, try it out, then guess what? I'm getting personalized, hey, you know what? There's a nice beer stand that I can put right next to that table to be perfectly complimented, hey, here's a light that can look over. So we have that ability of actually tying together an experience, actually predicting in advance what the customer really doesn't know they want next, but they really do want it. Example, we just walked out of a client engagement. Beautiful example, client engagement. It sells high-end women's fashions, right? Dresses and shoes and accessories, everything. And he basically said, hey, we're dabbling around with RFID tags and inventory management, but we don't know what to do, right? Bingo, we now have a proven referenced architecture called the Connected Consumer. This is a preview to be announced soon, but that can allow actually that client to integrate and optimize and digitize the solution for a number of different use cases that spans a unique customer experience, in-store operations and efficiencies, and then providing insights through analytics, in-store analytics to make decisions quickly. So you've got, by using this architecture, building the solutions based with Deloitte competencies and capabilities, and HPE, Aruba technology, we can deliver that to increased top-line revenue, increased basket size, decreased inventory costs, lost inventory, and provide much greater brand loyalty to those customers. By having a nice personalized experience, they know being by name, they know what I'm looking for in advance. Beautiful solution. So the online retail world did two crucial things. One is it provided a new way of a customer to buy something, and number two, it provided a new way for the retailer to learn something about the customer. Very, very powerful. But as you said, we are still, last time I checked, physical things that move through space, that use physical senses to make decisions. Tactile, do I like the color, the experience? I mean, I remember having arguments with people about whether the Apple stores are ever going to have any impact in the world, and boy, did they prove that experience of physically being there matters. So in many respects, what we're talking about is we're talking about creating spaces that correspond to the experience that a customer wants in a way that doesn't force them into another channel. I think that is an excellent point. I think you'll hear Kirti, and Kirti talks about it, who leads our Aruba team, and they are renowned for taking a space and providing, using technology and IT and software and security to provide a total experience, an immersive experience for those that are occupying that space. But that's not how retailers used to think. What they used to think was, this is the space where I put my inventory, where I show my product, and then I'll put the catch register over here. What you guys, I presume, are trying to do is show them how they can turn that physical space into a place that can bring in the online digital elements complimented in a way that makes that store a source of differentiation. It gives that experience in the brick and mortar store and allows the comfort of, yeah, you know this. And makes it differentiated. So that someone wants to go there because that is a valuable experience in and of itself. And sadly, retailers of the past 40 years have always relied on big brand names to attract customers. If I have the best brands in the world, customers would come to me. That scenario doesn't hold true anymore. You need to give them a reason, a personalized, curated experience for them to come in. Well, not the least of which is that digital technology allows us to spin up new brands like overnight. And so there's a, it's having an erosive effect on the other side of the inventory. So tell us a little bit about where you think over the next few years that differentiated in-store experience is going to be. What is going to constitute great retail? I'll start it off. Sure, sure. First and foremost, the expectations of millennials and other generations is more of that online experience. So I think retailers of the future have to be able to provide that customized experience to be able to provide, particularly people are not waiting in line is not an option in the future, right?  That's, waiting in line is not an option. I think that ability of, you have to have more instantaneous gratification, but allowing, if you will, the personalization, I'm being covered. I think that is one expectation for those that want to sustain a business and retail in the future. Yes, and add on to that, right? I mean, the marketing managers or the store managers of the past have always relied on opinions rather than data and insights to make better business decisions. Where do I place my product? Where are my customers spending most of my time? It's just, guess, most of it was guessing. Now, there is a technology out there where we can actually monitor what's happening inside your retail store. And, thereby, you can make better business decisions to help you with your customer journeys. Put traffic. Put traffic, you know, through video analytics and the data, someone's hanging around the Nike booth or whatever, you know, trying to understand, and you can purposely point them and give them suggestions of 20% off, and so you can personalize that experience. So, we have a CIO client and that's in the retail space and the way he described it is, you got to break the whole thing down. He tested some of you guys. You have a period of, I want the experience of shopping and the example that he gave me was a bike company a number of years ago who used flexible manufacturing to collapse the time, high-end bike, to collapse the time from ordering the bike to getting the bike down to a few days and they failed because the customer liked waiting. The process of buying, reducing time, simple, straightforward, but also what they said, and this is the kind of flexibility I think we're talking about, is some people don't want to walk out of the store with the product they want to deliver to their home. So, the store is, again, not the place where the inventory is, it's the place where you experience the product and that they create an option. How would you like that? Oh, I'd like it to be delivered to my house. No problem, there you go. Is that the kind of thing that we're talking about in the future? Absolutely. We call it the unified commerce of the Omni-Night channel shopping experience. You want to give the customer all the options available. Like you said, I can buy online, ship it in-store, or I can buy in-store, get it to my house. All the different options that a customer is looking for on an online channel, which is easy and convenient, we want to do that in a brick and mortar as well. And our solution can help you do that as well. So, when you guys encounter a client that is, you know, declining same store sales, so the management is concerned about, you know, the future, it seems like it's a tired, sort of experience. And, you know, that's sort of the end of the spectrum.  Yes, right. Future state. You're talking about, where do you start? So, who brings what expertise? This is actually, I'm going to repeat what I said last time.  And what I mean by that, what we mean by that is, with the Lloyd's capability, we can jointly come in and help a retailer. Let's think it through. Let's think you have how many branches looking to wear, what are your problems, what's your inventory leakage, you know, what's your current experience, what's your in-store Wi-Fi. We can build a plan on what we can do. But the next big problem that we see is not about the technologies, it's about the people and the process. How do you convince us, how do you convince some to invest to change? Well, this is through our proof of concept capabilities. We have the ability of starting small. Let's just go in and we can do through this architect's modular proven architecture, we can do a starting more. Let's just start with some RFID tags and tags and start small. We can deliver the business value and calculate that and extrapolate that out if we apply that to all your stores and scale fast. So we're making this be an on-ramp for those retailers because they're saying, what do I do? I know I need to change, but what do I do? So you do like a test store model, right? Okay, and then what? That's your POC, is it an actual? Yeah, and then so I want to go back a little bit on this whole IoT offering. It's a composite offering, right? It takes a lot of technologies coming together and a lot of SMEs, subject matter experts to come in and help you to build that whole solution. And that's where I think our solution is where it's ready to go, where all the pieces have been put together and can be easy. From day one, the time to market has been drastically reduced because of this, right? So we see a lot of value in that. So you're able to say, okay, what kind of target customer? What kind of inventory? What's the cost of it? What's the turn? Take all those business attributes and then say, we can map that back into a set of physical and system components that you can scale fast. It really comes around, three buckets. We're doing this to optimize and increase revenue, basket size, conversions, everything, time to revenue. Decrease costs, efficiencies in inventory, logistics, people, labor. And then providing a much greater experience of brand loyalty, which will also affect both costs and inventory as well. And capture and capture additional data. So for example, returns means two things. Costs, but also somebody had a problem. That's right. I'm satisfied with customers, yes. So we're out of time, but so summarize kind of where you guys are at, your solutions, when it's going to be available, you go to market, give us a sort of bumpster. Right now we're here at HB Discover. We are previewing this connected consumer architecture. We will deploy it calendar quarter one of next year. We'll be the full announcement. We have contact information. We would love to engage in clients and start that discussion now around doing proof of concepts. And we're going to be not only driving this collective retail solution that can be extrapolated into different use cases and markets, but we'll also continue to drive the more industrial internet of things and manufacturing operating around predicting maintenance, asset monitoring maintenance that we talked about in Vegas. Great, well I hope next Vegas, come back with some examples and some, a customer and we can go through sort of what impacts you've had. Maybe you'll be through a POC at that point in time. I'd love to get the cube into one of their POCs. There you go, Will. Love to do it. All right guys, thanks very much for coming on theCUBE. Thank you. Have a great seat. Thank you. Thanks, keep it right there, everybody. We'll be back with our next guest, Dave Vellante from Peter Burris. We're live from Madrid. HPE Discover 2017, right back.


We got a 1-1 game in the bottom of the 10th inning between the White Sox and the Tigers. This breakdown is brought to you by DraftKings and they are gonna try and move the runner over. Very simple. I'm gonna bunt this dude to third base. He's the winning run. Let's move them.  These guys are clapping, they love it. Now look what they do. You can't shift anymore. You can't move infielders around but you can bring an outfielder in. So they have an outfielder playing the infield. One, two, three, four, five infielders because if he hits it in the air it's probably a sack fly and they win anyway but if he hits it on the ground let's make sure we turn it into an out. So this batter, you know, just don't hit it right at that wall of players and he does. So now there's two outs. They intentionally walk sheets. So it's first and third. That brings up the next batter, burger and they're gonna go after him. Ah, shit, they went right after him. They hit him in the arm with a sinker. It's coming, it's coming, it's coming, it's coming, it is off your arm. So that stinks and it loads the bases. The intentional walk, the hit by pitch which then brings up Tim Anderson. All he's gotta do is nothing apparently because watch this. The catcher calls for a breaking ball. The pitcher thinks he called for a fast ball and cross up right in the umpire's face and that is how the White Sox win the game. Now if it didn't hit the umpire in the face it just would have been a pass ball and it still would have been bad. But as a total cross up the catcher is expecting a different pitch. So he's waiting for this ball to break and he just gets right by him into the ump's face. I do like that the ump goes down hard. I mean, 96 mile per hour pitch to the face. If that happened to any of us we'd tell our grandkids about it and this is just kind of a regular occurrence. But look at the ump's head on a swivel. He's staying with the game. Where's the ball? I gotta make the call. He's looking around. And then Anderson and the catcher are both like, whatever, game's over. Are you okay, dude? You okay? Anderson's like, you all good? And the ump's like, help me up, help me up. Okay, yeah. I think I'm okay. Anderson, they're like holding hands a little bit. He's like, I think I'm okay. No, probably not.  Is he okay? Is he seeing stars? He's dizzy. Now he's walking off on his own. He's like, just get me out of here. Let me go sit down and whoa, did not see it coming. Teeth kind of rattled, whole face jerks. Oh, that's nuts. This woman, she likes it. She's clapping and then bam. And then, oh, he's down. He's down. And the runner has to run. The pitcher has to get there. Just an unfortunate situation. Not for the White Sox though. They do celebrate. They do, look, there's a little bit of a water dousing on the right side there. There was a bubble gum pour. You can see the bubble gum on the ground. No footage of that, but I wish we had it because that had to be pretty awkward.  What was it? Ghost runner, sackbunt, ground out, intentional walk, hit by pitch, wild pitch. That's brutal. But this guy takes it. He'll take it. He likes it. And everyone's just kind of walking in like, what is that? And then they're talking like, I couldn't hear you. Because he's got pitch common in his ear. He's like, I thought you said this in my ear.  I didn't say that, but hopefully I'm OK. Brought to you by DraftKings. Thank you to DraftKings for sponsoring the breakdowns. As you always do, I appreciate that. I appreciate all of you guys for watching. And hopefully this umps OK. I'm sure we've had an update. But yeah, what a terrible last inning, kind of by both teams.


to another special edition of the Private Property Farming podcast, The Gardening Series in partnership with home growers. And today we have a live demonstration of an NFT hydroponic system, a 60 pocket to be specific, which Cass and Kepp is going to be assembling for us. So for any of you that is wishing to purchase an NFT hydroponic system to start growing your own food at home, this one is for you where you actually get to see how the system works and most importantly how it's installed. But that will all be covered by home growers.


Fasten your seat belts. From Alibaba Security Lab. For, it looks like their talk is about escaping iOS 11 sandbox. Give them a round of applause. Hello everyone. Can you hear me? Okay. Hello everyone. Today we are going to talk about the security of iOS 11 sandbox. And this talk will be presented by my friend, Min Spark Zheng, and me. We are from Alibaba Security. Firstly, let's kind of look at the iOS system. There are three levels in the iOS system. The first level is sandbox applications. There are quite a few attack surfaces to the kernel in applications. And the second level is user line system services including some services called Mac services. In these system services, we can have more attack surfaces to the kernel. And the third level is the kernel. So in iOS, iOS application is sandboxed. This sandbox was first introduced as seat belt in macOS. And now, there are over 100 operations that are hooked by sandbox policies. And these sandbox policies were first blacklist and now they are now. So with this table, this table is from the OS internals. With this table, we can know that there are over 100 sandbox hooks in iOS 11. And there is a concept called sandbox profiles. Sandbox profiles define what Mac services can be accessed by sandbox applications. In macOS, these profiles are visible in system library. And in iOS, the profiles are hard coded and difficult to be decoded. But we can try to get the list of services that can be accessed by sandbox applications. Also, we can use some tools. For example, the SB2 developed by Jonathan. In order to find the vulnerabilities in a mac service, we need to disassemble and analyze the binary that handles the mac service. There is a directory called system library log demons which contains the configuration of most mac services. From these playlist files, we can know the path to mac services banners. And next, Spark will give more details about the vulnerabilities we found in iOS 11 sandbox. Thank you. Thanks, Xiaolong. Okay, so there are a rich set of IPC mechanism in iOS. And most of them are available to third party applications. In this talk, we will focus on mac service. Mac messages are most common use the IPC mechanism in X and U. In addition, mac messages contains typed data which can include the port writes and the reference to large range of memory. Based on mac message, Apple developed the XPC compared with raw mac message. XPC is safer and easier to be used. But the cost of XPC service maintenance is very high. As XPC message is built on top of XPC message which allow abstraction of XPC connections and remote objects. Slow mac message, sandbox app can communicate with mac services, XPC services and NSXPC services. Consequently, if the server doesn't handle the message in expected ways, they may be corrupted by malicious apps. So in this talk, I will share three old bugs today. The first bug exists in the Gitkeeper XPC service. The related binary is the result. The service receives two parameters. One is test sub dictionary and the second one is source pass. But it doesn't check the validate of the past string. Therefore, if the attacker can use a pass traversal vulnerability to achieve arbitrary file move outside the sandbox with mobile privilege, this bug was used in Pangu 9 for jailbreak. So the second vulnerability is in media library D, NSXPC. It can be exploited to read, write and query arbitrary circulate files outside the sandbox. Since the remote object of the service have mobile privilege and it does not check the input pass of the circulate file, an attacker can achieve arbitrary query of the files on the system. The attacker can use begin transition for database at a path to connect arbitrary files, arbitrary circulate files on the system and then use execute query to execute SQL commands on it. For example, a malicious app can leverage this vulnerability to modify SM messages or emails on the device. In addition, it has another vulnerability because it uses circulate 3. The circulate 3 has a feature that called FTS3 token leiser. It is used for built-in full text search. Developer can use commands to get or set token leiser. However, attackers can leverage this feature to link memory information and even execute arbitrary code. For example, the first commander can help us link the address of the default token leiser which can help us to bypass ASLR. In addition, attacker can register a new token leiser and trigger the callbacks using the following commands, the second commands. Because the callback address is set by us and the process doesn't check it. So it's possible for us to hijack the PC register and control the NSXPC service as we want. This vulnerability was used in our private jailbreak. So here is the third bug. This bug exists in the Bluetooth D mark service. There are 132 functions in the com Apple service, Bluetooth D mark service. Bluetooth D communicate with other sandbox apps and on sandbox processes. For example, through com Apple service, Bluetooth D. A process can use BT session attached to create a session token for the Bluetooth D and then use BT local device at the callbacks to register a callback for event notification. However, it has a vulnerability which are found by Renny. He found that the Bluetooth D only use the session token to identify the process which means we can use a sandbox app to hijack communication between Bluetooth D and on sandbox processes through the session token. The key problem is the session token is too easy to be brute forced. It only have 10000 possible values. Therefore, the, therefore Apple fix this problem by adding a user ID to each session which is a random number. And only the process and the Bluetooth D know the user ID and the Bluetooth D will check the map of SES token with the user ID in the, at the callbacks. So the as we mentioned before, a user ID is a very, very large random number. So if we know the session token, we can still try to hijack the communication through user ID brute force. But when I try it, I found it will take a very, very long time, about 12 hours. So I don't think this is a good bug. So what if we can find some other functions without a user ID verification? Yes, I found one. This function is called BT accessory manager add a callbacks. However, after sending messages to that function, nothing happened. What's wrong? Finally, I found the problem. The callback event can be triggered only when the iOS device connects to a new device, which means we need to trigger the callback by click the Bluetooth D manually. This is not a good bug because we need to do something on the device manually. So the first bug takes a very, very long time. The second bug is very hard to trigger. Can we find the third bug to do, to, to get a callbacks and easy to trigger? Finally, finally, I found it. This, this one is called BT discovery agent create. We can use it to create a callback for the discovery agent. Then we can use BT discovery agent to trigger the callback without manual click. So we find a very good bug. But the goal is not only control the PC register, but the process as well. So the next step is to create a rope chain and do a hip spree for the target process. In this case, we use complex mark message with all our descriptor memories. This is a very useful mark message because if we send the message to the process and don't receive it, the message will stay in the target's memory space persistently. Then we can use a magic address. For example, in this case is 10540000. To set this callback address and the PC can jump to this address, it will point to a rope chain. So after we trigger the vulnerability, we can control the following registers. And the last BR is X4. So now we can do BOP or GOP. But it's hard for us to control the whole program flow because we need a stack pivot to control the stack and change the BOP to ROP. So a good stack pivot gadget can be found in the system platform. This gadget is very useful. If we can control X0, we can control SP. After that, we can do real rope. By using rope, we can still file or open a sandbox, I okay to use a client. But rope is not elegant. We want the task pod to control everything. So what is task pod? Let me briefly introduce what is pod. A pod in X and U provides an endpoint for IPC. Messages can be sent to a pod or received from it. Pods can contain writes and pod writes can be passed in message. The most important pod for the process is the task pod, which can be get from mark task itself. One can control the memory or all the registers for the process through it's task pod. This pod is very useful. For example, we can use mark VM analog to analog memories in a remote process through the task pod. And mark VM write to copy data into a remote process. And thread create a running to create a new thread and control registers in a remote process. So if we can get the task pod, we can control everything of the process. Okay, so let's try to get the task pod of a remote process. Here is the steps. First, we ask a launch D to get the pod name of Bluetooth D. Then we send a lot of pods with the power apps send write to the Bluetooth D and send loops through HIP3. After that, we trigger the vulnerability to control the PC of Bluetooth D. After that, we use the rope chain to send mark messages, which contains the task pod of Bluetooth D back to our power app. After that, we can use the target process, we can control the whole target process through its task pod. There are some tricks learned from much portal, which are developed by beer.  And the pod can be sent by all our messages with pod description. In most cases, the mark task itself returns 103. So we can just use 103 without the rope to call the mark task itself. In order to get the task pod back to our power app, we need to know the pod number of our power app. However, we can't use launch D to help us. So that's why we send a lot of pods because it can be brute-forced. So we send a lot of pods to the remote server in order to increase the success rate. After that, we can try to remotely malach some memories in the target process or just execute some functions in the target process. However, iOS 11 adds a new mitigation that we cannot easily use the task pod in the user land. So we can easily use the generic parameter. So we have a plan B that the ropes always work in the user mode. So we can use a generic primitive for the function called with arbitrary parameters in the core foundation. This gadget is very useful because we can have unlimited parameters and then call x8 and last return to the program. By using the Bluetooth D vulnerability, we successfully exploit iOS kernel through on Sandbox, I will keep you the client and break Knoll slide and then gain the Knoll read and write ability on the iOS 11. Also, we got a root shell and a jailbreak on the iOS 11. So here is a conclusion. First, we introduce the basic concept of iOS Sandbox and summarize several classic ways to escape the iOS Sandbox. Based on old Bluetooth D vulnerability, we found two new zero day Sandbox escape vulnerabilities on the latest iOS version. And we present a classic way to do heap 3, stack pivot and rope in iOS user land. Then we show how to get and control the task pod of the remote process during the exploit. During the exploit, there is an update that after we submit our talk to DevCon, we also report these two zero day bugs to Apple on July 7. Apple fix them in the latest iOS and as well as iOS 12 beta with CVEs. So please update your device to the latest version in order to defend against the potential task, potential attacks. So here is some reference for this talk. Okay, that's all for our talk. You can follow us on Twitter. Thank you for listening. Thank you.