This is Peter Lorre, here again to welcome you to the mystery playhouse. Tonight we bring you a story by a Jonathan Latimer called Lady in the Morgue. It offers detectives Crane and O'Malley the delightful problem of solving three murders and interviewing a lovely brunette. A lady who is mysteriously related to the unsolved crimes. Come with me to the Morgue for the beginning of our little story, huh? Oh, don't let these thefts bother you. Their troubles are over. But for those two detectives over there, the murders are just beginning. Come down these steps. Right this way. Come. Come, come. I'm going nuts hanging around here. Oh, stop squawking, O'Malley. Three days just sitting in the Morgue. I'm beginning to feel like a stiff myself. Look, I don't like it any better than you do, O'Malley, but we're hired as private detectives to sit here. And we're going to sit here until somebody identifies the dame's body. Okay. How do you know Alice Ross isn't Alice Ross?  That name's a phony. You know, Crane, the whole thing seems phony to me. What? Who is this rich New York guy, Cortland? He hires us by a telegram. We've never seen him. And why is he so interested in this little blonde who commits suicide? Look, I don't think it's going to do any good, but I'm going to tell you for the last time. He thinks it's his sister Catherine Cortland. She ran away from home a couple of years ago, chasing after some musician. Ah, gee. Hey, that's the desk bell. Looks like the Morgue's got a customer. Leave him in the attendant hall to answer it. Where is he? Where is he? Where is he anyhow? Down in the vaults with the stiffs. Well, then maybe we better answer it, O'Malley. Might be somebody to clean the body. Uh, looking for someone, mister? For a couple of private detectives, Crane and O'Malley. Oh, I'm Crane. And that character over there is O'Malley. Well, my name's Cortland. I sent you that wire. Oh, come right in. Come right in. Glad to meet you. Me, too. Delayed in New York, expected to be here yesterday. What about the girl? No information yet, mister Cortland. And if you think she might be your sister Catherine, why, uh, you can identify yourself. Well, yes. Uh, where? Uh, this way, mister Cortland. Thanks. The body's down in the vaults. Leave him in the Morgue attendant. You see, he's down there. I'll wait here for you, Crane. I can't stand looking at that girl. Come on, come on. Stick with the client. Watch your foot in the stairs, you slippery fool. Yeah. Thanks. Now, uh, what makes you think this Alice Ross girl might be your sister, mister Cortland? Well, just what I read in the New York papers. That's all. Brown girl, blue eyes, suicide.  She ran away from home with the musician two years ago. And... The body's in here. Lieberman. Hey, Lieberman, where are you? I thought you said Lieberman was down here, old Mally. Yeah, I saw him go down about 20 minutes ago. Come on, mister Cortland. The body's on tray number 27. Where is it? It's four, 10, 14... 17, 25, 27. Uh, you pull out the tray. I don't like things like this. Oh, there's nothing to be afraid of. She's dead. All you got to do is grab the handle and... Go ahead, old Mally. You pull it out. Oh, all right. Well, that's a man's body, a man, not a woman. Yeah, she's certainly real. What? Hey, it's Lieberman. The morgue attendant. Murder? Murder in the morgue? It's might all right. It's head smash. Which way is the girl's body? Yeah, mister Cortland. This is a job for the police. Who's about your private detective credentials, Crane? But, Lieutenant... Of course, either, old Mally. Now, look, a man was murdered in the morgue today and a woman's body was stolen. And you and old Mally and this fellow Cortland were the only ones who could have done it. Why don't you stop acting like a movie cap, Lieutenant Grady? What? Think it's true. Cortland is my client. He hired old Mally and me to line up the girl as his sister. Right. I sent Crane Awaya from New York. All right. Skip the details. Ah, use your head, Lieutenant Grady. You're forgetting a couple of things. You remember that Lieberman, the morgue attendant, had a handful of red hair in his hand. And Cortland got red hair? Have I? Huh? You know darn well you have. And we also know that somebody held Lieberman from in front while someone else slugged him from behind. Otherwise, why would Lieberman's wrist be torn and bloody? Okay, old Kale. But Lieberman had the hair in his left hand now.  Wouldn't I? I'd be holding your weaker hand with my strongest. All right. Now what are you trying to prove? We're trying to prove. What at a time, O'Malley? Okay, go ahead, Crane. Thank you, Professor. We're trying to prove that whoever held Lieberman's hand was red-headed and left-handed. And none of us are left-handed already. All right, all right, Mr. Cortland, pipe down. Crane, go on from there. Lieutenant, we're going to find that missing body for you. All right. All right, Crane. But if you're getting away with something new and something right now, it's only temporary. All right, all right. Come on, O'Malley. And look, don't forget, Crane, one false step and I'll pin the whole thing on you. You shouldn't have slammed the door, Crane. You'll make him mad. Well, what happens now?  O'Malley and I got to pay a visit to the apartment where the missing body hanged herself. Stick out in the hall and keep your eyes peeled. Sure, Crane, but I'm getting nervous. Found anything here? Nope. Uh, one funny thing, though. Alice Ross left a lot of brand new dresses here in this closet. Look, never been worn, but not a pair of shoes in a place. Hmm. That don't make sense, Crane. You're telling me. O'Malley, take a look at this bathroom door. According to the papers, this is where Alice Ross hanged herself. Draped the cord over. Isn't that terrible? Let's see now. According to the papers, she came out of the bathtub and hanged herself while she was still wet. The police found a puddle of water on a floor. That's nuts, Crane. Why would anybody take a bath if they were going to commit suicide unless they wanted to hang themselves up to dry? Would anyone hang herself while she was still wet? Oh, I think she'd dry herself first. Don't make sense. It'd make good sense, O'Malley, if she didn't commit suicide. It'd make better sense if she was murdered. Yeah. Murdered. She was murdered first. Then the murderer hung her body up with a cord. O'Malley, get back in the hall and keep a lookout. Sometimes I wonder what you'd do without me, Crane. Sometimes I'd... Now, now, what's the matter?  Let's get out of here quick. Yeah, yeah, but where? It's free-force to the ground. How about this window? Great. Hey, there's a ledge. One way, I'll go to the other. If I can hide in this room until... My toe!  Now, listen.  And I'll turn you loose if you promise not to make a sound. Now, remember, if you make a sound, you're going to get hurt. Is that clear? Okay. You already hurt me.  What are you doing to my bathroom? What do you want anyway? Now, listen, honey, I didn't want to duck through your bathroom window. It was just convenient. That's all. Get out. When I'm ready. Nice apartment you got here. Mind if I look around a bit? If you don't get out of here, I'll phone the police. You don't have to phone, sister. They're right next door. What? Yeah. Did you know the girl next door, the one who hanged herself? Alice Royce. What's that to you? And keep out of my clothes closet.  But I like answers to questions when I ask them. Now, let's begin again. What's your name? It's Sam Udoni. That's my name. It's a Sam Udoni. Ah, that's better. Now, about the girl next door... I don't know anything about her. Don't lie to me. I'm not lying. Maybe so, but this clothes closet is very interesting. Very. Why, you... Watch it, baby. Now, tell me this. Why have you got two different sizes of shoes there in the shoe closet? Oh, and dresses. Hmm, and two different sizes. Two complete wardrobes. Very simple. Some of them belong to my roommate. She's a blonde. She dresses different from me. Thought you just said your name was Mrs. Udoni. Mrs. Sam Udoni. My husband's a musician. He travels with bands. He's away all the time. Yeah. What do you ask me all these questions? Your husband forgot to take his trumpet. Why are you... Now, don't get sore. I'm getting out. I just heard the cops next door go down the hall. I'm, uh, kind of sorry we met this way.  Don't be insulting. I always like long black hair, the kind that comes out of a bottle. And don't be surprised if Papa comes back sometime. Get out. Get out of here.  Well, that's what it all adds up to, Mr. Cortland. Alice Ross was murdered. And her body, obviously, was stolen from the morgue to cover up that murder. And if this girl was murdered, and she turns out to be your sister... My sister is alive, Crane. I've just found out. What? Mr. Cortland. Oh, you heard from your sister? Yes, she's alive. So, as she's obviously not the dead Alice Ross, I'd like you both to drop the case. Oh. Well, uh... Well, I'd like to do that, Mr. Cortland. I'd like to very much, but one small difficulty. You see, Lieberman, the morgue attendant, was murdered. And, uh, I'm still kind of a suspect, and so is O'Malley, and so are you. Right. Right. And the only way we can clear ourselves is to break the case ourselves. Right. Right. Besides, uh, I think I know who helped to kill Lieberman and snatched the girl's body. You do? Who? An undertaker. A left-handed red-headed undertaker.  No, now wait a minute, Mr. Cortland. Sometimes Crane gets brainstorms. Figure it out, Mr. Cortland. The only way anyone could get into the morgue and carry the body away is through the delivery entrance. That means only an undertaker could get in there without a lot of questions. What did I tell you, Mr. Cortland? A brainstorm. Right. Right. Oh, this is all nonsense. Complete another nonsense. Oh, but just to prove that it isn't, O'Malley's going out right now and find that undertaker. Right. Uh, me? Why am I going to find him? You'll find him easy, O'Malley. Sure, sure. I'll find him easy? Well, if this is the only way we can clear ourselves, as you say, why, I ought to help find this undertaker. Fine, fine, Mr. Cortland. Now, let O'Malley cover one side of town and you cover the other. We'll meet here in four hours. And what about you, Crane? What are you going to be doing? Me? Didn't I tell you? I got a date with a gorgeous prunette. This is you, Donnie. I told you I'd be back. You? What are you doing here? Well, I came to hear the hot music and, uh, be near you. You've got a nerve after what happened today. Hey, hey, that's a solid horn. Your husband blows in that next room, then. Yeah, what makes you think he's my husband? You said your husband was a musician and I saw a trumpet here this morning. Well, you see too much. What do you want, anyway? How does a wife of a musician feel when another woman starts following him around the country? I don't know what you're talking about. Never heard of Catherine Cortland, huh? She never meant anything to Sam. She's been following him around for several years. Must have got someplace with him in that time.  My husband's coming in here. Good. I want to see him. Tell him that you button in here.  Who is this guy, baby? This is him, Sam. You're looking for trouble, mister. I like trouble. What do you want with us? I want Catherine Cortland or I want a body. What are you talking about?  I know Catherine Cortland left New York several years ago to follow you here. What about it? Sure she followed me here. Does that make me responsible for her? I haven't seen her for months. And who was that living in the apartment next door to you? How should I know? A girl commits suicide in the apartment next door and right away I'm a suspect. Get out of here. Okay, you Donnie. Just one thing. You see this nice, shiny badge? The body of a blonde who was murdered in the apartment next to yours. What? Murdered? What are you... The paper said... Sure, the paper said suicide, but she was murdered, you Donnie. Murdered. And her body will be in a city morgue in four hours. And I want you to come and take a look at it. Just like you said, Crane, there was a left-handed, red-headed undertaker. Only there isn't any more. What do you mean? Yeah. I went to his place, rang the bell. No answer. I went in and there he was murdered. What? Murdered. Yup. I found coffins, a knife right through his heart. Police hadn't even been there yet. This is incredible. Well, didn't you look around, O'Malley? I'm no dope. No? I looked at his books, and I found out that a girl named Alice Hughes was buried today, Forest Tree Cemetery. That's our blonde. You're wonderful, O'Malley. I love you. Ah, it was simple. Now we gotta move fast. Get out to the Forest Tree Cemetery, get that body, and return it to the morgue. How about me? You? You come along too, Cortland. Let's go. All right, O'Malley. Lift her up. Put her on the table. Now can I go? Stick around, stick around. I got a job for you. You certainly have a genius for the fantastic crane, digging this body out of its grave, sneaking it in here in the morgue. I only do what's necessary, Cortland. Now look, are you sure this girl isn't your sister? Absolutely. Well, it's the same body that was swiped from the morgue and she was murdered. Murdered? By the morgue. Whoever killed this girl knows I've located the body and returned it to the morgue. So what, Crane? The killer's going to try to steal the body again. And you, Mr. Cortland and O'Malley, are going to catch him, red handed. Me? You. But Crane, how can you be sure? I made sure. Now listen, here's what we're going to do. We leave the body here on this table with a sheet over it. Then you two get under the sheets on these other tables.  Right. And the murderer, when he comes in, will never suspect that you're under those sheets. All right, Crane. I'm game. I'm leaving you two here alone. I'll beat it out and get Lieutenant Grady. Oh. I ought to warn you. No one knows you're down here in the vaults. Just you two. But don't worry. The killer will be here. Good luck, boys. Just us two and the killer, Mr. Cortland. I'm not afraid. Let's get under the sheets. Now turn out the light. Mr. Cortland. Will you do me a small favor? Why, certainly, O'Malley. What is it? Every now and then, reach over and pinch me. That will be a pleasure. Every time I get under a sheet, I go to sleep. You don't mean to say you could go to sleep in a morgue waiting for a murderer? Why, that's ridiculous. My mind agrees with you, but when my body feels a sheet, it goes to sleep. Perfect. I got you covered. Now, come on, get up off the floor. Well, thanks, O'Malley. I knew I could depend on you. Right, right. Hey, this guy is Cortland. Now, you tricked me, Crayon. You were waiting at the end of the hall all the time.  Yeah, but I don't get it. Did Cortland kill Lieberman? Did he steal a bargain? Not so fast, O'Malley. Go ahead, go to the telephone and tell Lieutenant Grady to hurry over here to the city morgue. If he wants, leave him and his killer. I'll wait here. I'm still expecting Sam Udoni to show up and identify the girl's body. Oh, O'Malley, another thing.   Peroxide, I'll need it. This is Sam Udoni and Mrs. Udoni. And this is my client, Mr. Cortland. Your client? Then why you got him handcuffed? Well, it ain't merely because he didn't pay his bill. Now, no! O'Malley told me on the phone that this blonde dame, Alice Ross, didn't commit suicide but was murdered. What about that? Well, that's right. Murdered. By this man right here. But look, Crane, Cortland, couldn't have... Who said anything about Cortland? I said this man right here, meaning Sam Udoni. That's a lie. You can't prove that.    Do you think Udoni committed all those murders? No, my husband was with me when they were committed. And what reason would he have to kill this Alice Ross? Why, he didn't even know her. How about that, Crane? Well, Udoni ought to have known Alice Ross. He killed her because she wouldn't give him a divorce. Alice Ross was actually Mrs. Udoni. How could she be? I am Mrs. Udoni. Let me out of here. Grab him, O'Malley. Let me go. Let me go. I won't do you any good. It's better. Don't talk, Sam. They can't prove anything. Be quiet, you. Be quiet, you. Be quiet, you. Oh, heaven, this is all beginning to make sense. That's why Udoni stole the body of his wife. So that he could pass off this woman here as Mrs. Udoni. Right, Lieutenant. Sure, I get it. And now for the proof, O'Malley.  Here you are, Crane. Hey, now wait a minute, Crane. Wait a minute before you start his shenanigan. If Alice Ross was actually Mrs. Udoni, who's his name here? Well, that's simple. She's Catherine Cortland. What? You're crazy. Catherine Cortland was a blonde. Wait a minute. She's no blonde Crane. Oh, no. Just watch. Watch her hair, Lieutenant. Just watch her hair. Yeah. Say, the black is running out. That dye, you mean. You better take it someplace where she can clean up, O'Malley. Yeah, but wait a minute. Where does this guy Cortland fit in? I'm afraid he was merely an unhappy accomplice. But go easy on him. He's a good guy. Good guy? Good guy? Good guy? He tried to stab me. Yeah, yeah, but he was dragged into this whole thing to protect his sister. And she was dragged in by Samuel Udoni. He's the real Alice. Look, Crane, I'm not making any alibis, but I wish you'd answer me just one question.  How did you know my sister had dyed her hair? Well, in your sister's apartment, I found a bottle of black hair dye and a bottle of peroxide in the bathroom. But what finally convinced me was the real Mrs. Udoni. What do you mean? You see, hair grows after death.  Crane, all I can say, you make my hair stand on end. It was Lady Nemorg by Jonathan Latimer. Oh, yes, yes, we were going to have a guest ghost on tonight's broadcast. Oh, but poor fellow. He was taken gravely ill. The doctors have given up all hope. He's going to live. By the way, if you have any pet vampires you'd like to hear about on these programs, just drop me a line. Just give the letter to your favorite witch with instructions to take her broomstick and knock on the door of the mystery playhouse. Armed Forces Radio, Los Angeles, USA. Now it's time to close the doors before all these bats fly away. This is Peter Laurie saying, good night, sleep tight. This is the Armed Forces Radio service.


Good morning, and thank you for joining us today. We are excited to be here taking part in DEFCON China 1.0 This talk is IPv666 address of the beast. I am Mark, and this is Chris Hey, what's going on everybody? My name is Christopher Grayson. I'm originally from Atlanta, Georgia I went to the Georgia Institute of Technology a few times Was the head of the Georgia Tech Hacking Club I've been the head of the red team at snapchat, and I'm presently a security engineer at birdrides my name is Mark Newlin, and I'm a Hacker by formal or lack of formal education I have done a lot of work in the wireless security space using software-defined radio to do reverse engineering of wireless protocols And I've done a lot of vulnerability research at wireless devices at this point I have discovered and published vulnerabilities and wireless devices affecting somewhere north of 25 vendors My spare time I've done a handful of DARPA challenges placing top three and multiple of them I'm a former member of the red team at snapchat, and I now work as a security engineer at birdrides And so what are we going to be talking about today? And the short answer is the future and if you didn't know this Chris and I actually recently went to the future And while we were there we discovered that there were IPv6 connected devices as far as the eye could see Everywhere so we decided that we would build an open-source tool that you can use today to discover these IPv6 connected devices And we've been working on this project for about a year and a half now And in that time we've made a lot of mistakes learned a lot of lessons And this talk is a story of how we went from where we started to where we are now and how we built this Need tool and I want to point out that this is a pretty technical talk And we're going to gloss over some of the granular technical specifics And we're doing this for the sake of translation clarity and time All the details still in the slides and if there's anything that we didn't cover in super depth that you would like to learn more about Please find us after the talk and we are happy to answer any questions And I also want to point out that Chris and I are not network engineers And we've been learning about IPv6 as we go So it's possible that we've got something wrong If this is the case please correct us because we are here to learn just as much as we are here to share our experiences We're going to start with some background on IPv6 and our motivations for doing this research We are then going to look at the difficulties of scanning the IPv6 address space We are going to go over some techniques that we tried to discover these IPv6 addresses Some that work well, some that did not We're going to look at the latest iterations to our scanning algorithm We're going to then look at the latest iteration of the software Where we have the ability now to persist scan results to the cloud So that we can have a crowdsourced global data set of IPv6 addresses We're then going to look at some results from these latest scanning improvements Talk about the tool that we've released IPv666 and then have our conclusion So a bit of background on why we care about this work So here we have a plot of the percentage of users connecting to Google over IPv6 over the last 10 years So we have 2009 on the left, 2019 on the right And we can see that a decade ago there were almost no users connecting to Google over IPv6 This has grown over time and now in 2019 approaching a third of users connecting to Google over IPv6 And this is just a single internet company but it's representative of the fact that IPv6 is growing And as security practitioners it's something that we should be spending more time thinking about the security implications of And we got specifically interested in IPv6 as a result of some research we conducted a couple years ago We presented at DEF CON 25 with our friend Logan Lam A number of vulnerabilities that we discovered in Comcast, Cable Modems and Set Top Boxes And one of the big takeaways from this project was that a lot of these severe vulnerabilities Could only be exploited over IPv6 and to do so you needed to know the IPv6 address of the target device And to illustrate this I'm going to talk about one of the more interesting vulnerabilities So if you're a customer of Comcast you have a Comcast Cable Modem You have the administrative web user interface you can access on the local network And there's a separate administrative web UI that can only be accessed from Comcast Via a specific IPv6 address from a specific Comcast network segment And we also spent some time looking at the Set Top Boxes And there's a service called Send To TV And if you're a Comcast customer you go to this website You put in a URL, you hit go And it displays that website in a web browser on your TV We discovered that these Set Top Boxes actually exist in the same protected network segment As the Comcast customer support agents And this meant that we could take the IPv6 address of any target customer's modem Put it into this Send To TV tool And actually load the administrative web UI of their modem on our TV And then sign in with hard-coded credentials So this meant that we could actually remotely administer any customer's modem As long as we knew their IPv6 address And this was our first hint that knowledge of how to discover these IPv6 addresses Could have some pretty interesting security implications Yeah, so that was quite a fun project All of our research for that project is available on GitHub if you want to take a look But so we do this, we have a lot of fun with it And we start thinking, oh you know what Maybe we should dig into IPv6 a little bit more And so we kind of came away with a handful of different things That left us scratching our head thinking like, huh This seems like it might be concerning as far as security goes And so one thing is that IPv6 works out of the box Without any explicit manual configuration So in IPv4 you typically are relying upon DHCP servers To give you your IP address You don't need that in IPv6 anymore There's an improvement called Slack The Stateless Address Auto Configuration Protocol Where if you speak IPv6 If you have the ability to speak IPv6 And your networking equipment can speak IPv6 Then you can just provision yourself an IP address Not only that, but all of your devices and networking equipment Both support and prefer it Assuming that it's modern equipment So this is your phone, this is your laptop And this is your gateway And so that means that A, hey Your address is going to be provisioned automatically And B, if that is possible Your devices are going to prefer speaking over IPv6 Wherever possible Third, there's no such thing as private address space anymore In IPv6 for the most part There's this thing called unique local addresses But whereas right now when you go home And you plug your laptop in Or you connect to your Wi-Fi network You typically get like a 10 dot star address 192 dot 168 dot star address But you're on a private network And that means that folks from the open internet Can't start routing traffic to you Without you opting in and doing a NAT punch through That's going away now Basically we're going back to the world Where we have to rely upon firewall rules To prevent access to your devices We kind of found out When we first started looking into this Mark is sitting at home on his couch I'm sitting at home on my couch And he was able to ping my Chromecast That was on my network And he was kind of odd to us So your IPv4 firewall rules also don't apply So if you even thought you know what I know about IPv6 I'm going to check my firewall rules And make sure that I'm blocking all incoming traffic And you do IP tables dash L Well it turns out that that has nothing to do with IPv6 There's actually a separate list of rules And a separate utility for managing them It's IP6 tables Otherwise it looks entirely the same But just because you have your IPv4 firewall configured With everything That has nothing to do with IPv6 And so somebody with Somebody coming from a red team background My entire understanding of ICMP The internet control message protocol Is that it is for ping scanning hosts And so you know It's commonly people asking How do I block ping How do I do this How do I do that And one of the pieces of knowledge That is given away in this Is just block all ICMP traffic Well it turns out that you can't really do that In IPv6 ICMPv6 is a critical protocol If you block it everywhere You are not able to route traffic So in IPv6 The address resolution protocol Has been turned into the neighbor discovery protocol Which is packaged into ICMPv6 There you go It is a critical protocol And then lastly There's no more notion of broadcast in IPv6 In IPv4 There's broadcast And there's this thing called multicast Which is basically I take a packet And I send it to an IP address That makes the networking equipment Propagate it to a bunch of different endpoints But it was largely unsupported And unimplemented and unused IPv6 only has multicast And if you are too spec With IPv6 Then you support it out of the box So we read all of these things And we're like huh It seems like it might be concerning We should totally go test this hypothesis That IPv6 security posture Might be worse than IPv4 And then we ran right into The problem that the rest of this talk Is going to be covering So as Chris mentioned We want to validate our hypothesis That the IPv6 security stance Is potentially worse than IPv4 And to do this We need a number of IPv6 addresses To look at to see what these devices Are actually doing And we quickly run into this problem of scale IPv6 addresses Which gives us just shy of 4.3 billion addresses And this is a lot of addresses But you can nonetheless have a single computer Do a TCP connect scan on one port Across the entire IPv4 address base In an afternoon With IPv6 We go up to a 128 bit address space And this is a much, much larger Number of addresses So on the bottom of this slide Is the total number of possible IPv6 addresses And I have no idea How to even begin pronouncing this number It has 13 commas It has far more addresses Than ever possibly hope to scan So we need to come up with creative ways To find these potential addresses To go and scan And then we have something called pslack Which complicates this So originally there is a protocol called slack The stateless address auto configuration protocol Which is used to generate an IPv6 address And we can think of an IPv6 address As having two components We have the network bits Which are commonly the lower 64 bits Of the address And these represent the network That the device is connecting through The network bits Which are commonly the upper 64 bits Of the address And these represent a unique identifier For that host With the original version of slack The host bits were just a direct transform Between the MAC address Of the network interface To these host bits And this transform would be the same Regardless of what network you were on So this meant that if you connected Your computer to the internet Over IPv6 at home You would have the network bits From your home internet And you would have the host bits That were related to your MAC address Then when it connected from a coffee shop Or from work Or from somewhere else And you would have a different address Because you would have different network bits But your host bits would be the same And this meant that website operators Could actually track you As you went to different locations And connected to their services Because these host bits would be the same So pslack Which is the privacy extensions for slack Introduces pseudo random entropy To the process of generating these host bits And this is good for privacy Because it means you can no longer be tracked As you connect from multiple locations But it's bad for us Because that high entropy means it's difficult For us to do any kind of probabilistic modeling To predict what these addresses are going to be So this means we have to really break this down Into two separate problems We first have the problem of identifying The high entropy pslack addresses And then we have the problem of identifying The lower entropy non pslack addresses So in the case of the high entropy pslack addresses We decided to get creative and see if we could use Honeypotting techniques to instead of predicting What these addresses would be We just get these devices to connect to us instead And so we started by setting up a web server A DNS server and an SMTP server On a cloud instance that we spun up We used a few techniques to get traffic To these services And the idea was we could start collecting This list of IPv6 addresses So we started by setting up a Honeypot DNS server Which was just a bind server And at this point we thought we needed to be clever And we assumed that we would have to funnel Connections that were coming in on IPv4 Over to IPv6 What we realized at the time Is that on modern operating systems If a device can connect over IPv6 It will automatically prefer IPv6 in most cases Turns out that all the documentation we read was correct And so we ended up doing some extra work We thought we were being clever but it was just Extra work that didn't really notice anything So here we have a plot of DNS requests Over time to the service And we can see we have a few spikes here And these spikes correlate to campaigns we ran With an ad network called PopAds Is an ad network where you give them money And they drive profit for your website And we selected PopAds because they were the cheapest Ad network we could find And so here we have a plot of some traffic From PopAds over a course of two minutes And in this case we gave them ten or fifteen dollars And got between forty and fifty thousand requests In two minutes And you might think how do you get Forty or fifty thousand real users to click On your website in two minutes We do know that the referring page For a lot of these requests was just a blank page To get a job as a script payload So it's tough to say but maybe not Hundred percent loaded in traffic So then we set up a Honeypot web server And this was initially running at IPv6.expose which is where our web portal Is up now And we were serving this over both IPv4 And IPv6 The idea was if the page was requested over IPv4 We would have images served over IPv6 So that we could get IPv6 addresses Even from IPv4 clients And again this was the case where it was not Because everything just automatically connected Over IPv6 And we also had a web RTC JavaScript payload On this page which would enumerate The private IPv4 addresses of the client As well as their IPv6 addresses And post those back to a web service we controlled Now one thing I want to note here We tried posting links to this all over social media It turns out we're really not that popular And so we didn't get any traffic from that So this again was the case where we used Pop ads to drive traffic to this So here we have plots of the number Of access log requests from the web server On the top over time And then from the HTTP post backs on the bottom And this is over the course of around 10 months And so again we have these spikes where we did The pop ads campaigns Now on the top the access log requests Are on the order of tens of thousands But the post backs are on the order of thousands So this tells us that while we had a lot Of requests to the web server Most of those clients weren't actually executing The JavaScript payload and so it again Limited the quality of data that we received And then we tried to set up a Honeypot SMTP Server and we thought we were being really clever We thought we would post email addresses To this all over the internet We would sign up for spam lists And our hope is that we would have a lot of DNS Resolutions and a lot of SMTP hits From these email addresses And unfortunately this was just a major bust We had a small number of hits From infrastructure email providers like Hotmail And Yahoo but nothing terribly interesting With the SMTP Honeypot So what does this Honeypot results look like So in the course of ten months We generated around 90 or discovered Around 92,000 unique IPv6 addresses And in practicality We ended up spending closer to a thousand dollars We kind of lost focus on this Because it was a slow process It was expensive The results weren't as promising as we wanted But it was still a number of addresses That we discovered So after we collected this set We decided to do an ICMP ping scan And see how many of these hosts were still live This May, almost none of them were up And this led us to the discovery Of something called ephemeral IPv6 addresses So just as we have ephemeral UDP and TCP ports We have ephemeral IPv6 addresses And in these cases outgoing connections Will have a unique ephemeral IPv6 Address per connection And so most of those 92,000 addresses That we discovered were actually not live And pretty pointless So now we've spent ten months A thousand dollars and have basically nothing And so we decided to switch gears And start looking at some different techniques For predicting these lower entropy Non-P slack addresses Yeah, and it's The hallmark of a good research project When you spend a lot of money And a lot of time for absolutely no reason That's how you know you're going in the right direction So we talked about the P slack addresses Let's talk a little bit more About the ones that don't have a lot of entropy So we started looking at these addresses This is a sample of addresses In the public data sets And just kind of like squinting your eyes You can see that there's some structure In them And this was kind of our hypothesis Was that looking at these you can see That there's a number of kind of byte boundaries That people are commonly iterating upon You have like colon, colon, one, colon, colon, two So clearly devices are getting Least IP addresses from DHCP servers There must be a lot of structure In these And so what does any self-respecting Professional do and pose with a problem With data? Machine learning, obviously This is the solution to everything So not only Are we not network engineers But we're not machine learning experts either And so Basically we worked with A friend of ours that is a machine learning expert And he told Us that we should build an auto encoder And so I'm going to explain this In the way that it was explained to me That's not the way the human eye works Light bounces around, it bounces off of objects It goes through the lens of your eye And hits the retina on the back of your eye And your brain interprets that As your vision So if your lens is damaged Then the data that is processed On the back of your eye is imperfect It might be blurry It might be the wrong shape But the point being that when the lens is damaged You have an imperfect image That goes through on the other side So the auto encoder Is very similar in that You basically build this lens And then when you push data through this lens It changes the data So it transforms the data a little bit But the very interesting part about an auto encoder Is the way in which it changes the data And the error in the lens Is actually representative Of the structure of the data That the lens was built from So the idea is we take All the public addresses that we Know about from public data sets We build this auto encoder And then we take the addresses, put it through it The auto encoder changes Those addresses in a way that is representative Of the structure of the IPv6 Addresses that we trained on And then we have new addresses that we can scan And of course, this worked Completely well Just kidding, this did not work at all So we basically Could only make a completely perfect lens So that we Could take a dataset and pass it through the lens And then the data that we got Out the other side was the exact same As what we had passed in So not particularly useful Fairly discouraging We'll throw this on the pile with the thousand dollars And the p-slack stuff But we're like, okay, we have to at least Be on the right track here And so then we found this paper Which is the entropy IP paper And this is from a group of researchers At Akamai At the address structure And on the order of billions of IPv6 Addresses that were traversing The Akamai network And the conclusion that they came to Is basically there's a lot Of structure in these addresses And so the graph that you see up here In the top left-hand corner That's actually mapping entropy by bits Of the IPv6 addresses that were analyzed And so you see on the right-hand side You have very high entropy That makes sense, those are the ranges That are being iterated over In the middle, you have very high entropy So that's the slash 64 boundary So you would expect there to be a lot of Networks provision there, but everywhere else There seems to be a fairly low amount of entropy So you're like, okay, I feel like We're at least at it in the right direction What can we do to solve this problem And we do what we're really good at We got really dumb about it So here's what we did Because we basically just needed Something, anything that works And then the address scans for them Takes addresses back, feeds them back in And then continues in this loop So we came up with this very simple scheme Where we take an address And we break it down into its 32 Constituent nibbles A nibble being four bits And then we count The occurrences of Nibble pairs So we say, okay, in position zero When the current value is OX2 The next value that we see Is OX8 one more time Okay, in position one When the current value is OX8 The next value is OX0 one more time And we do this for every nibble Of every IP address that we have in our data set And we end up with a probability distribution On a per nibble basis For predicting what the next nibble will be Based on the value of the current nibble And with this To actually predict an IP address We would start with OX2 And we would say, okay What is the probability distribution For all of the nibbles after OX2 In position zero that we've seen before We would get all those probabilities We would create a weighted die And we would roll that die And whatever comes up Is what we would go with for the next value So now we have a value for position one We would do the same for position two Position three, so on and so forth And we get an IP address out of it And so we do this And another word of warning Whenever you're doing research And the result seems too good to be true It's probably too good to be true So we generate 10 million addresses In this way And we do an ICMP scan Across all of them And 50,000 of them respond We're just like, wow We're really good at this We're pretty good I can't believe that worked I guess we're just really good at this False So this is when we learned about These things called alias networks And what an alias network range is And to this day we still don't know Why these things exist But it's where every single IP address In an IPv6 network range Is mapped to a single host So there might be two to the 96 Two to the power of 96 hosts In an address range And every single one of them Will respond to an ICMP Pink scan A probabilistic model and a feedback loop That scans and then takes the live addresses And feeds them back in And then scans some more You very quickly come up with a completely useless tool Because it's just really good At finding these sorts of ranges Because they have such a significant representation In the dataset So we had to figure out how to detect These alias network ranges And so here's how we did that So we take that address It responded to a pink scan And we say, okay I'm gonna wrap you in a slash 96 network And then I'm gonna generate Eight addresses at random In that network And then I'm gonna Pink scan all eight of those So the idea being that, okay We think that this address might be in an alias network range We're gonna take a network range around it Generate a bunch of random addresses In it because if it isn't an alias network range Then these are going to respond And the likelihood that we guess Four out of 4.5 billion Live hosts at random Is pretty small So we ICMP scan And if 50% of the addresses respond We know that that slash 96 Is an alias network range But the network range might be bigger Than a slash 96 So now we need to find the boundary Of where that network range ends So we take this address We map it to its bits And we know that the right most 32 bits Are within the alias network range And the other 96 bits We don't know So we're going to do a binary search We're gonna take the right half of the bits That we don't know about And flip them And then we're gonna scan that The idea being that, look Every single address in an alias network range Is going to respond So if all of those bits are in the alias network range Then this address will respond too So one of two things happens then Either we don't get a response And in that case The left bits That we didn't test Are not in the network range And the boundary exists Within the bits that we did flip And in the case where we get a response It's the opposite So the bits that we flipped Are clear within the alias network range And then the bits to the left of it Are the ones that we don't know about And then we rinse and repeat We do this five or six times And you actually find the exact barrier Or boundary for where the alias network range Ends And then we blacklist that network range And remove any addresses that are in our dataset That are from it And so that is where Our first kind of iteration on this project Ended So we would generate these addresses Scan for them And then the ones that responded To the alias network detection Remove the ones that were in alias networks Take the results, put them back in the model And keep going And it works reasonably well So we could find one new Novel IPv6 address That we hadn't seen before Once every 15 seconds So for a minute Not great, but at the same time That's better than guessing Out of two to the power of 128 So this is actually the fourth time On this topic, and we don't like Giving the same talk twice So every time we give a talk We add a little bit more to it We improve it a little bit And one of the more recent updates That we did was about getting less Dumber, hard for us to do But we tried And we wanted to focus on having A better address discovery rate And when we're looking around We found this paper called 6Gen Which is made by these folks It's basically a further iteration Of the entropy IP paper Really interesting stuff But the coolest thing That really resonated with us Was their notion of an IPv6 address cluster So in our previous probabilistic model We only could have causality Between two adjacent nibbles Because we're only checking to see What is the probability distribution Of the next nibble every time That we're looking at it And there's basically more causality Between nibbles that aren't adjacent They can be on almost completely Other sides of the address So these guys define an IPv6 address cluster As an IP address And a set of wildcard nibble indices And I'll explain more about What that means in a second When they're evaluating How good a cluster is They consider two things One of which is the capacity That's how many possible IPv6 addresses Are there in this cluster And then density Of all of those IPv6 addresses How many of them are in your input data set So let's walk through What one of these clusters looks like So we have the same address from before And we say, okay We're gonna create a cluster of size one With no wildcard indices And that's it It's fairly uninteresting Because it's just a cluster of size one It can only have one address in it And we say, okay, you know what I want to upgrade this cluster To contain this other IP address So when we're upgrading a cluster To contain another IP address We break down both IP addresses The one that the cluster is based off of And the one we want to add And we say which nibbles are the same And which ones are different And in this example There's only one nibble that is different It's right there in the first index And so we say, okay In order to upgrade this cluster So that it contains both of these addresses We have to add a wildcard index In that position Because the wildcard matches any nibble The rest of the nibbles are the same So now this is the cluster that we would have If we upgrade it to contain both And in this case Because there's only one wildcard index And there's 16 possible values for a nibble The capacity here is 16 There's 16 possible IP addresses in it There's only two data points That we use to feed into it Our data set is of size two Which gives us a density of 12.5% And just to drive this home This is all of the IP addresses That exist within that cluster So the original algorithm I'm gonna skip over a bit But another note on research projects If you're ever reading a paper And the paper has one section That says algorithm And then the next section says Optimizations for how you can get this algorithm To run on your computer It's probably an expensive algorithm It's probably not gonna work in your tool all that well This is that case One thing to note It's quite expensive But we had Basically we based our work on this So without this work Without what they put together We would not be standing here in front of you Able to say that we accomplished what we did Here's the idea behind how we use these clusters We take our Initial data set And for every IP address in our data set We create a cluster of size one So we have as many clusters as IP addresses when we start And then for every single one of those clusters We were asking the question Hey, what would the best Wildcard index to add to this cluster be? So we say, okay for this cluster What if I put a wildcard index at index zero How good would that cluster be? What's its density? Okay, how about index one? How about index two? How about index three? So we end up with For every cluster that we start with Here are the, here's the best upgrades For every single one of them And then in some cases There's no good upgrades And that kind of means that this IP address is just Hanging out there in the ether Without any really adjacent neighbors There's nothing near it And we take those clusters That have no adjacent neighbors So with those to the side We have our set of clusters We have our set of potential upgrades We sort the upgrades by density We want to take the best upgrades first And then we take the upgrade off the top Put it into our cluster set And then recalculate what its next Best upgrade would be And put it back on the list of upgrade candidates So we take one off the top Figure out what its next step would be Put it back on the list of potential upgrades Rinse and repeat We have a scoring system For our cluster set And basically we recalculate the score Every time we bring a new candidate Over into the cluster set And what we see is when we start The score goes up, up, up, up And then it hits a peak And then it starts coming down We want to find the model when it's at that peak So we just watch the score And once the score starts decreasing We say this is the best possible cluster set That we can build That describes our data set With hopefully high density And the green here shows that it's a better algorithm Than the previous one So once we have that data How do we turn that into IP addresses? Well, when we want to generate an IP address We take a cluster at random From our data set And then for every one of the 32 nibbles We flip a coin If the coin comes up heads We generate from the cluster If the coin comes up tails From a probability distribution Built from all of the addresses That we did not include in our clusters Those ones that we put to the side When we said these don't really have any neighbors So in the case we were generating from the cluster It's fairly simple If the nibble at this index is a wildcard index Then we just pick a random nibble Equally weighted If it's not a wildcard index Then it's the value of the IP address At that nibble from that cluster And if we generate from all the addresses From the cluster model Then it's just a probability distribution Of what are the values of the nibble In this position that we've seen In all the rest of the data And so that's how we make better progress On generating the candidate addresses That we want to scan And now Mark's going to talk a bit About how we improve upon fanning out from them So as Chris mentioned With the improved 666 gen algorithm We're able to improve our scanning coverage And generate a good set of addresses In the probabilistic model And now we want to use these newly discovered addresses As landing points and fan out from there And what we mean by that is Once we've discovered a new address We can assume that there are potentially other addresses That might be live that follow a similar structure To that address And we can also look for neighboring networks And neighboring hosts depending on the specific addresses We found So for the nibble adjacent fan out Which is how we look for addresses With similar structure but different addresses At a times of 4 bits at a time For the discovered address So in this example we have a target network Of 2000 slash 4 The slash 4 tells us that the first nibble The first 4 bits is fixed So the 2 is always going to be the same And then for the other 15 nibbles We generate 15 addresses each For the 15 values that are not present In this address So what that looks like is we take the last nibble In this case it starts with a value of 1 So we generate an address Of 223 and so forth Until we've generated 15 new IPv6 Addresses from that initial address By varying that 1 nibble And we go down and we do this for each of the 31 nibbles that are not fixed in that Target network And in this case we have 31 nibbles 15 new addresses each We've generated 465 new candidate addresses From that one input address And we like to do this because scanning is Very very cheap, it's very inexpensive Computationally to scan addresses So once we've found an address we want to say Okay, are there other addresses that are Similar to this but have basically the same Structure? Then we also do a sequential fan out Looking for both neighboring networks And neighboring hosts And one of our observations is that networking Equipment, especially consumer premises Equipment like cable and DSL modems Will frequently be assigned an IP address Of a slash 64 colon colon 1 And so you'll have a router which has A slash 64 and the first address Right 64 bits is the router address So when you find one of these colon colon 1s We then look for incrementing And decrementing neighboring slash 64 Networks, so we take those Lower 64 bits and we count up And we count down monotonically And the idea here is that if I'm an ISP And I'm allocating addresses to my customers I am likely to do This kind of sequential address assignment And then we do something similar for neighboring hosts So we have a colon colon 1 address On a slash 64, this is common To see in a modem which will then Assign DHCP leases to clients Monotonically increasing from there So when we see the colon colon 1 We then generate the list of addresses Of colon colon 2, 3, 4 and so forth And this allows us to find potentially Neighboring addresses from this initial input set And with this we've been able to Really answer this question of is us Any smarter, have we gotten any less Dumber, and how much have we Actually improved our scanning algorithm And it turns out that combining the Data sets we've been looking at Is worlds better than our previous implementation So with version 0.2 Which our first real good attempt We were pretty happy with this We were finding around 60,000 addresses Over the course of eight days These were 80% of them were distinct Not in previously seen public data sets And this was pretty cool But then we got this version 0.3 rolled out And this was a huge improvement So now we're able to find In this case 1.57 million addresses Of an hour, 78% of them were Not in the previous public data sets This is a 503,000% improvement Over v0.2 And so we're pretty happy with these results And so we decided to take a sample set Of 100,000 addresses from these Discovered lists and we did TCP connect Scans on a number of common ports And the objective here was to see Are these live hosts, is there Some false positive situation going on And we had a lot of open TCP ports Which tells us that these were Live hosts We've seen lots of networking equipment Both infrastructure and consumer premises Lots of no-off MongoDB instances Ancient SSH, ancient telnet And so this tells us that we're getting closer To being able to look at this hypothesis We started with that the IPv6 World is potentially More security risky than IPv4 And we've been working on this project For a year and a half and we started With this one objective in mind And it's taken us a year and a half To get to the point where we can Get to you, so it's pretty exciting That we're at this point now and we're looking Forward to continuing this work And now Chris is going to take you to the cloud To the cloud, up and away So as I said before, this is the fourth Time that we're speaking on this topic We don't like to give the same talk twice And every time we talk We put something new into the code base So last time, last iteration We made a much better scanning algorithm And scanning process and it was pretty cool We found 50,000 addresses And then we're watching this run It just found 150,000 in like Five minutes, that's amazing And so we did a little bit more analysis And it looks as though this can Scale out horizontally pretty well So we can run two instances of it And they will find fairly unique And independent addresses from one another So that puts us in an interesting situation Where this is really good data To enable folks to kind of like Get the data on their own And then potentially aggregate it with us And so we put functionality into the tool Where when you run it the first time It prompts you and says Are you okay sharing the IP addresses that you find And if you say yes, it just uploads the addresses As you find them and it puts them on our web portal Which the link is not up there right now But it was up there before It's ipv6.exposed And so the whole point here is To basically aggregate this data set Across anyone who is comfortable running it And sharing data with us And then enable users of this web portal To query the data so they don't even have to Run the tool on their own to kind of make use Of the data that we're collecting So if this sounds interesting to you Please take a look at our tool Try running it, take a look at our data set We'd love to see what you think And so kind of to close things out for me This is where you can get our tool If you have Golang 1.11 or higher installed Just do go git and then that github URL My handle is lava lamp I'm not fast enough to get just lava lamp As my username anywhere So I put a dash after it for my github account You can find it there Also if you feel like contributing We'd love more contributors And hopefully you guys like it There's a handful of slides here You can find out the various utilities So you can discover new addresses You can scan to see if a network is alias You can generate addresses with the model that we have You can take a set of input data And generate your own model You can generate a blacklist You can clean a list based on the blacklist That's packaged with the tool And then you can convert the file to various IPv6 file formats This is a personal blog Again, a link to the tool And Mark's going to bring things home Talking about the reason we got into this project As an offshoot of our Comcast research And interest in IPv6 We looked at how it's really difficult to actually Scan the IPv6 address base Due to this huge number of addresses We talked about our very, very Failed attempts at doing honeypotting Our slightly improved attempts With doing probabilistic modeling And then our big improvements With the 6.6 gen algorithm We looked at our results where we can do 10 million newly discovered addresses We talked about our cloud persistence Service where we can actually Crowd source this dataset of global IPv6 addresses We looked at our tool IPv666 Which is available for you to use And we encourage you to do so And I just want to say that We've been working on this project for a year and a half And we've gone through a lot of failures We've learned a lot of lessons And we hope that you're able to use the fruits Of our effort and contribute this To your own research And we're happy to be here at DEF CON China 1.0 To the community. These are some links Of papers and projects that have inspired us We recommend you take a look if you're interested In this space. And now we have Just a few minutes for Q&A. Thank you. Cool. Well, if there are no questions If you see us, please stop us And talk to us for going to be around the con Most of the day. And yes, thank you all. Thank you.


Welkom back to this channel, once again a greetings to all of you wherever you may be, I don't know what time you're watching this video, it's a good morning, it's a good afternoon, thank you so much for coming back to this channel, remember it's mixed from the mixed creation, always giving the updates. In today's video, there's a question that I was asking about the freelance visa, yes remember when you're on a freelance visa you will need to have your ID, you need to pay up for your ID, you need to do up your medical, but the question was for how long is it going to take for me to take to get my residence permit or what we call the cut ID. Normally something that I need to let you, let it be under company, let it be under, let it be freelancer, let it be under company, normally what happens is that for you to get your ID, you first need to go and take what you call the medical fitness test, I told you what about the medical fitness test, I told you what they normally test for the, normally test for those kind of diseases or they normally test whatever they have to test, what you call under the medical fitness test. And once you pass what you call the medical fitness test, the next step that you will be called is you will be called to go and do what you call the finger prints, you will definitely go to do what you call the finger prints.  Meaning that when you pass the medical, when you definitely pass the medical you are eligible to work in the country. Normally some companies you see that you get to understand that some companies do it even in one month, some companies even in three weeks, some companies even in one week definitely that is done depending on how many people, depending on how many employees that company has then definitely that's where the service will be a little bit much quicker at the end of it all. And definitely when you look at a freelancer I think a freelancer you're only one person and this one now the dealing is between you and your sponsor because your sponsor has to be the signatory on that request for you to do what you call the medicals and for you to do what you call the finger prints at the end of it all. So it depends on how flexible is the person who sponsored you or the sponsor, how flexible it may be a company that sponsored you with that free visa, it is that person how flexible it is. If it's very fast then definitely you can have your ID very fast without even the time that we may think and turn. Definitely you still also have to take the medical, you still have to take the medical fitness test and you still have to take the fitness test. So the period that we estimate the period according to the law it's supposed to be two to four days. Out of the two to four days you definitely know that you have your kata ID or your residence permit will be ready. But normally what I need to let you know that is why normally your residence permit the notification that your residence permit or your ID is ready will definitely be sent to the person who applied for your ID. And normally sometime it's your sponsor they will send them the notification that your ID is ready for collection and if it's going to be delivered by the post normally what happens is that the q post here, the kata post will deliver those IDs or that ID to his residential or his box number or his residential address at that time. So it will just be your initiative or it will be your initiative at you to go and ask him to give you your ID or he will call you to give you your ID so that you can start using the ID. But some people, some visa sponsors may not want to give you the ID as early as possible. I don't know for what matter depending on what kind of obligation you have if you do not clear up all the money then or if you have some payment charges that you need to pay you may not give you the ID. But for all that one it comes back to what you call the personal people, personal understanding between you and that person the sponsor of your visa. But normally it takes 2 to 4 days to print that ID after taking what you call your fingerprints. Hope I've tried to answer you well and hope I've tried to give you that in code. Thank you so much for coming back to the channel and thank you so much for supporting this channel. The new subscribers and the old subscribers thank you so much. It's next from the next creation TV.


It really is a copycat league, right? Cause I guess the Titans were like, oh, Jaguars. Y'all want to make a blockbuster move? Watch this. So, as y'all know, we've been on DeAndre Hopkins watch for a long time. Ever since it started coming out and rumors started surfacing that he could possibly be traded from the Arizona Cardinals. And then the Cardinals ended all those rumors by releasing DeAndre Hopkins. We've been waiting to see where he was gonna land next. It's been some teams that they said could be interested, should be interested, but the only two that showed significant interest because they actually brought DeAndre Hopkins out were first the Tennessee Titans and then the New England Patriots. Tennessee Titans, they brought him out on his first visit. They flew him out on a private jet. They let him go to the country concert and they just, they showed him love. They showed him a whole lot of love. And then the New England Patriots were like, hold up. Well, anything you can do, well, I don't know if we can do it better right now, but we gonna try. So they brought DeAndre Hopkins out as well and both teams were said to have had great visits and really love what they saw from DeAndre Hopkins. So then it was said that both teams were interested in signing him and then things got quiet. Things that got quiet for a couple of weeks and we were like, okay, what's gonna happen? Me, I was thinking, all right, DeAndre Hopkins, he not going to either one of those teams. He just using those teams for now and using them to drive up his interest, but then somebody else gonna come flying in and then he'll go sign with them. But boy was I wrong, completely wrong because DeAndre Hopkins is officially signing with the Tennessee Titans on a two year deal worth up to $32 million deal with a base of a 26 mil. Now, when we look at the contract, it says that it's a base of 12 mil with incentives to get to 15 mil for the first year. Now, so he's getting paid less than Odell Birkin Jr. But anyway, he is gonna be going back to the AFC South again for the second time with joining the Tennessee Titans. And he'll get to see the Texans at least two times a year. I know there's no bad blood between him and the Texans or anything like that.  So ain't no bad blood, but he'll get to play them at least two times a year. Now, I'm not sure if the Cardinals are on the Titan schedule, but I guess we'll see. Now, with that being said, DeAndre Hopkins, I just hope that this for Tennessee's sake, except when they played the Ravens in week six in London, minus that game, but all the other games do what you wanna do. But I hope for Tennessee's sake that this doesn't end up like Randy Moss with the Titans. Or like Julio Jones with the Titans. And what I mean when I say that is I hope that we don't see that version of DeAndre Hopkins with the Titans. Receivers who were once or at least one point in time in their career, they were the best receiver in the game. Julio Jones was multiple times. And then Randy, of course, Randy Moss definitely was, but I just hope we don't see that version of DeAndre Hopkins. I don't think we will because the thing about DeAndre Hopkins, the thing that he's shown us already is that no matter who's throwing him, literally no matter who's throwing him the ball, he gonna ball out. He gonna show out. He gonna make plays. He gonna come through. This is why I would have loved if my team, my Ravens got DeAndre Hopkins, what? And then I remember when the reports were coming out, the first thing they said, LeMoss, he asked about both Odell Beckham Jr. and DeAndre Hopkins. I'm like, man, LeMoss, I love that thinking. Ask for both of them, let's go. Then reports came out that said that the Ravens were actually close on the deal with DeAndre Hopkins. And that was right before the draft. And then I remember when they drafted Zay Flowers. Again, it was a bittersweet thing for me because I was like, all right, Zay Flowers, cool. Especially he from South Florida. But then I was like, oh, but that's, it's probably the end of DeAndre Hopkins officially. And it was. So, but it's cool. I'm excited to see what the Baltimore Ravens and their receivers do this season. But this video is not about them. This is about the Titans. But again, hopefully for the Titans' sake and DeAndre Hopkins' sake, he can go out there and continue to do his thing. Now we know he is technically past his prime, but that don't mean he can't play. That don't mean he can't play. Just cause he may not be the best. And I mean, who even knows? Cause last year he missed a chunk of time due to suspension. And he missed, I think he missed like a tiny, tiny bit of time with an injury. But the time he missed last year was just majority suspension. DeAndre Hopkins is somebody who primarily been pretty healthy his entire career and just been so consistent. I think he tweeted out, was it like last week or thing? He said, oh, when I'm not a thousand yard receiver, I retire. So, I want to hit the Titans. They sit on their playbook and he's like, yikes, how am I gonna get a thousand yards receiving from this? As then maybe he's thinking about retire.  DeAndre Hopkins play for the Titans. Well, I hope that it's fun. I hope that it's fun, but it should be.  He was still out there doing his thing. He was still out there making plays even the last couple of years for the Cardinals. So whether his quarterback is Ryan Tannehill, whether it's quarterback is Will Leviss, whether it's quarterback is Malik, whoever that quarterback is gonna be when they get that situation, the way that I think it's gonna go, I think it's gonna be Ryan Tannehill first. And then if he struggles, then they'll bring in Will Leviss and get that experiment started. Now, remember in his interview that he did with Brandon Marshall and Ashley Nicole Marshall, I am athlete, it really sounded like DeAndre Hopkins, he wanted a team that was like Super Bowl ready that he felt was Super Bowl ready that he felt like were true contenders right here right now. Cause he ain't got much time in his career left to be wasting time. So I just felt like he would go to like a short thing and the teams that I thought that he was gonna go to, I thought he's gonna go to either the Chiefs or the Beals. Those are the two teams where I felt like, all right, DeAndre Hopkins, he got to go to one of them. But no, and I could have understand if he would, if I could have understood if he would have went to one of those teams cause they've been consistent playoff contenders, the Beals have, the Chiefs have been Super Bowl contenders and Super Bowl winners, literally, they keep playing in the Super Bowl, they keep playing in like every AFC championship, they are the definition of winners. And they even like, he called him a dynasty. I mean, they're like the Golden State Warriors of the NFL right now, they really are. So, but anyway, he, some of the stuff that he said in that interview, it just, it didn't scream Titans to me. And I appreciate my sports update listed though, some of those things he said, stable management. I think then the Titans just get rid of that GM recently. They got a new GM, but even besides that, they got Mike Raebel. Mike Raebel has been a good head coach for them. He's been a, I mean, almost great head coach for them, but he's been really good, especially having dealt with so many injuries over the years, but still having them with good record, still having them fighting, still having them right there in the thick of things. It said, a QB who loves the game. Now, I don't know, Tanner Hill personally, but I think that he does love the game. Reason being because he used to be a wide receiver. Used to be like, he used to play wide receiver. But then he made the switch to quarterback. He went to the dolphins, got paid from them, went to the Titans, got paid from them. So I would definitely think that with all the money that he's made throughout his career, Ryan Tanner Hill been around for a while too. He been around for a while. Ryan Tanner Hill got a like a sneaky long career, man. So I would think that he loves the game. And Will Levitz, now he get the opportunity. He got, he finally got drafted. He had to sit through the whole first round and nothing happened, but then he got drafted in what, the second round, I believe. So I mean, I'm sure he loves the game too. And then Malik Willis, even though all these reports, we keep hearing reports about him that are bad, all these reports saying you're not looking good, that he's probably gonna get cut, this, that and the third. We'll see what happens. I'm not sure he loves the game as well. But with all those reports saying all that stuff about him, that's what training camp's for. So we'll see when we get there. But so yeah, I guess he got a quarterback who loves the game. A quarterback who loved the game for different reasons. But anyway, and it also said a great defense because defense wins championships. So defense, yeah, Titans got that. Titans definitely got that. So now he will take some pressure off of Traylon Burks. That'll help him a lot, but more so off of Derrick Henry. See the thing about Derrick Henry, he is such a great running back to me. Even if over the last year or two, he lost a step or whatnot, I feel like he's still a great running back. Reason being, for me, a great player, an extra great player is somebody who is the focal point of your team. The opposing teams know that this person is going to get the ball.  But that person, despite that, despite other teams knowing that, despite other coaching staffs or the players knowing that that person's going to get the ball, they still ball out. They still make place. That is a great player to me. So Derrick Henry has been a great player to me for a long time. This alleviates pressure off of him. It really does. And then with the Titans, they can really establish your running game. I know it sounds so cliche. Oh, if they can run the ball, they can pass the ball. You can play action, but you can, especially with a Derrick Henry. Because if Derrick Henry started running the ball good, everybody started loading the box because you need extra bodies to tackle Derrick Henry. And then the Andre Hopkins will be like, hey, I'm one on one. And look, I ain't even got to have much separation. Just throw it up. The 50-50 ball is the Andre Hopkins thing. So he ain't got to burn pass nobody.   So that's going to be nice for Tanner Hill or Leavis or whoever his quarterback is, it's going to be nice for them. But he could just be, hey, just throw it up to me and I got you. And he's somebody that you can trust. He doesn't drop the ball. He just makes plays, man. He is the definition of no matter who's throwing me the ball, I'm going to make plays happen. We've literally seen that with the Andre Hopkins. We saw him make plays with, especially on the Texans, we've seen him make plays with so many different quarterbacks throughout the years. And it was no coincidence that the Andre Hopkins best seasons came when he had his best quarterback that being the Sean Watson. So it correlated that. That's why I'm just really surprised that the Andre Hopkins went to Tennessee because there ain't no offense to Tennessee and I'm like that. But I just, I did not envision him going to play. I thought, cause he also talked about he wanted to play in an elite quarterback. He also mentioned that. So Ryan Tannehill is not bad. Is he elite? No, he's solid elite. I wouldn't say elite, but I just didn't envision him going there. I really didn't. Just in my opinion, I don't feel like the Titans are a Super Bowl ready, especially like, think about this. If the Titans were truly a Super Bowl ready team, would they be drafting a quarterback in the second round? If they were Super Bowl ready team, I feel like they would already have their quarterback, right? That's just my opinion though. But I feel like they would already have their quarterback. I feel like they wouldn't need to be picking a quarterback so high if they already had that guy. But I don't know. But anyway, the Andre Hopkins, he's there. He's there. So he got a decent amount of money. We mentioned in the previous video that I felt like the Andre Hopkins, he had already made the most money that he was gonna make on a contract in previous contracts before. I didn't feel like he was ever going to top or even match the money that he's made before. And this contract proved that to be true. And that's not a knock on the Andre Hopkins at all. It's not. But I just didn't see him getting the money that he got once before. So, but yeah. Anyway, Team Keeping Clean appreciate y'all. I love y'all. This, the Andre Hopkins watch, it ended a lot different than I thought it would. Because again, I did not see him going to Tennessee. I really didn't. Like I said earlier, I really thought that the Andre Hopkins was, yeah, Tennessee was interested in them. They brought him out there, but I just really thought that he was gonna be like, oh, nah, I ain't interested in them. But just used him to drive up his market, then the Patriots came along, then used him to drive up his market. And I was just waiting for a team to come out of nowhere and swoop in, but nobody ever did. Now I wonder, because we usually do with these type of things, I wonder if we're gonna hear a story maybe in a couple of days or something, talking about, oh, this team over here, they were interested, but they didn't cough up enough money. Cause that's usually how these things go. We usually hear about that. So anyway, Team Keeping Clean, I love y'all. I appreciate y'all. Make sure you leave a like on the video, subscribe to the channel. So you do not miss anything in the NFL. You don't miss anything going on with the NFL. You don't miss any news, any breaking updates, anything. Cause I want y'all to stay on point. I love y'all so much. I appreciate y'all so much. Thank you for everything. Shout out to all the Team Keeping Clean channel members. Thank you for supporting the channel extra. Shout out to all the Team Keeping Clean patrons. Appreciate y'all as well. If you wanna become a Team Keeping Clean patron, you can go to patreon.com slash engraving vids. And if you don't, that's fine too. I appreciate all y'all showing up. I appreciate all y'all being here. Thank you. I love you all no matter what team you rock with, no matter who's your favorite player, no matter who or whatever, I love y'all, everybody. Y'all deserve to be happy. Y'all deserve to be just treated the right way by everybody. I appreciate y'all. I appreciate how y'all are. I appreciate everything about everything that y'all do. So thank you. Team Keeping Clean, we out.