First of all, thank you to the organisers, sorry, for having accepted my contribution to this session and I'm very happy to be here. I only have 15 minutes so I'm going to be as fast as possible. I'm going to start from a little bit far away and precisely from the Sa'ul landmarks, so the Australian and New Guinea landmarks that experienced very early people. Recently, in 2017, there's a publication on Nature, very interesting, that even brings back the date to an incredible 65, around 65,000 BP. And to do that, the modern human, anatomically modern human needed to cross quite big sea parts, which was more than 100 km. And this is just one slide. I go back to our topic very fast because if we go in comparison with what happened in the Mediterranean, which is much smaller sea, much less dangerous even than the Pacific. Ocean, of course in prehistoric times, there is a lot of activity already certified, for example, from 11,000 BP. This is the obsidian from Melos, we found it all around the place. There is also for sure a sea crossing of about 100 km in the early Neolithic between Sicily and Malta, but for example in the Balearic island, there is no tracks of any Neolithic activity. This is just to say that, of course, we are talking about the establishment of regular navigation routes, of course. So it's something that can prove the fact that the Mediterranean was really used as a famous definition of liquid ague. But what happened before the establishment of these regular navigation routes? This is something that I'm going to talk about focusing mainly, of course, on the Sicilian route, and this is my topic for the day. I just want to mention, and I did also, by talking with a colleague one second ago, that at the moment the most plausible and first human occupation of an island in the western part of the Mediterranean is the Sardinian and Corsica sites. There are two actually, they are both discussed in the literature of course, but of course Fontananova, I will talk about that in the second part of my presentation. So now I want to very briefly discuss about what can we try to know about the people of an island without having clear archaeological remains, and there is a very wonderful publication, I think it's a crucial publication from Lepid, a fellow from Cambridge University in 2014. He used the possibility of analyzing a final turnover as a proof of a human people. This is, of course, a proxy for the arrival of hunter-gatherers in a closed environment like an island, maybe, as a possibility to prove the presence of human occupation. This is something that, of course, I will limit, as I said before, only to Cicili and also to the late phase of the Upper Paleolithic. I don't want to talk about Lower Paleolithic or Middle Paleolithic because of course this would eventually take too much time to edit outside the scope of this presentation. So at the last session maximum, around the last session maximum, we have actually, in Cicili, a final turnover. So this might be exactly the case for proving the arrival of humans or human occupation, stable human occupation. There is, though, a problem which is the peculiarity of Sicilian geography. As you well know, of course many of you are actually coming from the island, not all of you, but there is a small strait separating Sicily from the European landmass. It's a so-called Messino strait which in the narrowest point is a little bit more than three kilometers wide. And in that publication that I mentioned one second ago, Lepard actually refuses to discuss about Sicily because he described it as a quasi-insular. So he says like, I'm not talking about Sicily because it's almost not even an island. It was quite right because the publication from 2014 by Antonio and colleagues established, in my opinion, without any doubt, that at least for 1.5 thousand years at the last session maximum Sicily was not an island. So there was a land bridge and so it's true that there was this geographical condition that connected the link bridge, connected Sicily with the Italian landmass. And these are the consequences on our, of course, on the environment. And these consequences have been very precisely investigated also before the land bridge was clearly approved when there is a publication in 2008 from Massime and colleagues. And I will write very briefly to read this sentence. It's going to take too much time. In isolated system no apparent correlation occurs between climatic oscillation and changes of final diversity. On the other hand, and this is our case, if an island is close to the continent and separated by a rather shallow sea corridor, our case, the combined effect of climatically forced dispersal and glacial, austatic controlled formation of land bridges may cause dramatic effects on final diversity and composition. So if we go back to that final turnover that I was mentioning before, as also Massime and colleagues know this, we might justify it more easily by the existence of the land bridge than by the, so to say, responsibility of undergathers. Of course we cannot be sure that undergathers did not play a role in this final turnover, at least there is a second explanation that does not involve human occupation of CC. And we have to take it this into account. So before I go to the second part of the presentation, which as I said before is going to be focused on Fontana Nouvelle, I just wanted to make a small sum up wrap up of what I've been saying so far. So Western and Central Mediterranean seafar and sea crossing activity has been proven to be very slow during the Pleistocene. It's very limited to a few cases, and some of these few cases are actually also doubtful. CC has been proven not to be an island for at least 1.5,000 year around the LGM. This is a very important point for discussing any possibility of a population that involved or not involved the seafar and sea crossing activity. And then this is a direct consequence of the previous point. Around the LGM CC experienced a clear final turnover that has been established by Leopard among others, might be a mark for the stable human occupation. But in this case, as I already said before, there might be also another explanation. So far, I've been talking about Last Glacier Maximum, so around 22,000, 21,000 before present. And I'm sure that many among the audience will be asking like, OK, what about Ribeiro di Fontana Nouvelle? That's a good point. Ribeiro di Fontana Nouvelle has been presented in the literature until a very recent time. Ribeiro di Fontana Nouvelle is the first and most important example of human peopling of an island in the western Mediterranean before the Last Glacier Maximum. I will bring here this very brief example from this best-selling wonderful book by Brodben from 2013, The Making of the Middle Sea, in which he mentioned the site we are talking about, Ribeiro di Fontana Nouvelle, it's very important, unquestionably wider importance, and it does possess one advantage over earlier claims of island occupation in the Mediterranean. It indisputably happened. Even the most recent literature, take it as granted that Fontana Nouvelle was, and still is, a proof of a pre-LGM population of an island in the Mediterranean. Why so important? First of all, because it will be the southernmost Mediterranean site in Europe. Second, because it's going to prove human presence in Sicily before the LGM, this is something that for what I've said so far would be very striking, and then of course will prove an early sea crossing, sea firing in the Mediterranean. I will go kind of fast on that because I don't want to consume all the time that I have. The history of research of this site has been quite peculiar. There has been a first unsystematic excavation conducted by an amateur archaeologist or local novelman. Actually, the findings have been reburied by this man, at least the human and fellow remains, and then they've been excavated in 1949 by the top attendant for the antiquities. This is the remains, and in 1964 this is a very important point for our discussion. Laplace placed the elite industry and attributed it to the Aurignacian before the LGM. So we start with this first attribution. There has been confirmed also in publication during the Hades, and I've been also placed in doubt by some scholars during the 90s, in this case of Parma Nishas. No, of course, that correctly finds the Aurignacian attribution highly problematic, mainly because of the attribution of Aurignacian science in Italy, but also because of the very peculiar characteristic of the litic assemblage. I'm not going to talk about that during this presentation. The turning point somehow when the attribution to the Aurignacian has been this publication from 1996, which added to the interpretation of the litic also another element that has to do with the final composition. Particularly, it's the absence of the ecosystem that might have been read as a proof of a pre-LGM origin of the deposit. The last point in this history of studies is that about ten years ago, is that this site might not be in the final epigraphic etym, and it's Martini and colleagues, they try to give another chronological attribution, which is the epigraphic etym, which is much more likely because in Sicily we have a lot of epigraphic etym. In this case, it would be the first phase of the epigraphic etym. Very good. So as you can see, based on the litic typology and the final remains, this site has been really attributed to a very huge time span with dramatic consequences because if this site is Aurignacian, this means that it is a scenario-changing site. Very good. I had the opportunity together with colleagues to sample the final and human remains at the archaeological museum in Syracuse, and our dates gave us a different scenario, a completely different scenario. We have ten dates that you can see there, both C14 and also calibrated with 95.4% of confidence, so double sigma, and all the dates except one are very compact. It's at 800 years time span, and it's late Mezzolini. So between 9.9 and 9.1 calibrated BP. So for people who are confident, they know the chronology, and it's easy with, for example, Liar F-16-18 in Uzzo, or Molara, individual one, or Oriente in Favignana. So there are some consequences of this chronology. First of all, I have to notice that, and I'm going toward the end, that it's an extraordinary fact that the site with such a peculiar history of research that was already recognized, for example, by Palma di Ciasnola, has been trusted as a solid ground and a paradigm shifter picture. This is a little bit, somehow, too much confidence in this site. So we have to conclude that there is no proof at the moment of our renaissance of people crossing the Pestina Strait and reaching such a southern latitude. There is no proof of Sicily being populated before the LGM. We have one old date, which actually is also a little bit far from the LGM, which is Riparo di Castello, close to Palermo. And then this is something that does not really have much to do with the chronology now, but it's very important as a methodological suggestion that using only typological method of analysis for litty complexes as a dating method might be dangerous, especially in a context like Sicily, where we have all the excavated sites, and most important litty collection have been often subject of a selective process. So this means that, really, this statistical basis might be mined, undermined. So I think I can wrap up what I said so far in these two parts of this presentation. First of all, we cannot be sure that no people in happened and so on. There was no co-passion before the LGM, of course. In the publication of Leopard that I mentioned before, the author makes a very interesting distinction about different types of co-passion, and some of them might also very well not be or have any, how can I say, any remaining in the archeological in the archeological record. So, for example, ephemeral kind of co-passion. But with the data actually in our process, everything points toward a very late colonization of Sicily. What remains as an open question for me at the moment is that did it happen during the LGM when the land bridge was present, which means there was no sea crossing, seafaring involved, or based on the dates actually available, which are much later, did it happen in a moment in which the land bridge was not there, which means, once again, post the question of sea crossing when not even seafaring. Thank you very much.


Next at Lockston Agtech Field Days, we've got John. Where are you from and what's your business? My name's John Pargetta. I was a grower of 500 acres down at Langone Creek So similar sort of pain points coming off the off the river I'm now with the Swan Systems. Swan Systems is a software company We're hardware independent But I guess especially as we heard in the tent next door is dragging together all of that siloed information and data sets. So we bring in weather data irrigation controller data, so moisture probes some leaf sensors So all the different siloed things that the grower has issues bringing together and looking at different platforms So we bring it into the one platform. Okay, and how do you use it from there? It then has As Peter mentioned on a slide there. It's it can be very easily One look at a dashboard and you can see whether the blocks you've got are in the green zone, which is obviously the good zone If it was blue it was in the you know, it's over watered if it was yellow it's it's under water But when you drill down further You're able to program seven days out we our algorithms look at the the forward weather conditions and We're able to then put a suggested irrigation out for seven days We have one irrigation controller that we currently have it fully integrated so we can push the that seven-day program into the irrigation controller and we're working on the other two major ones as in towelgill dream that's here and Also the mo-tech ICC pro so the two major ag Controllers, but there will be galcon and mate and those come along as well So there's a level of automation going on here as well. Correct. Yeah, and it's yeah It gives the grower that you know that one-stop shop, I guess all that solid information is able to look in the one place We also integrate imagery from a different number of different sources whether it be drone satellite We can we can bring that in as well. Excellent John. Thanks so much


My name is Jeff Kitson. I'm a Securities Researcher with Spider Labs Trustwave. My presentation today is trainwreck. Today is not only my first time at DEF CON, but it's also my first presentation of this type. So I think we'll do all right. If I have to take a couple of breaths, bear with me. So what I want to talk to you about today is the device that, of course, we're focusing on how I found this device, how it sort of entered my realm of knowledge, the vulnerability that I found, how we got the vendor to fix it, and then the tools that I'm going to distribute to you guys so that you guys can actually test these yourself and keep the pressure on this manufacturer to make sure that they stay up on their security stamps. So how all this got started? It's a pretty personal story. On December 29th, my furnace failed. I'm a first time homeowner. It was a pretty big experience to have my furnace fail in the middle of a Michigan winter. I don't know how many of you are familiar with Michigan or just winter at all, but it sucks when your furnace fails. And it can be pretty dangerous, especially to the water pipes in your house. So I couldn't really delay on getting it fixed.  The problem that I actually had at the furnace was my heat exchanger failed and started developing cracks. And that's how you get carbon oxide in your house. So I'm actually kind of lucky I didn't die from this. Yeah. You can see it about two pipes. Well, not on the monitor, but later you'll be able to see them. So I had to get a new furnace. I felt a lot like this kid here in the photo. I called up the local dealer that had worked on my unit in my house before and they came out and really acknowledged that it wasn't safe to operate how it was failing. So by law they pretty much had to turn it off and I had to buy a new one. Now the model that I selected was a little bit more efficient than the last furnace because when you're looking at replacing a furnace or replacing a heat exchanger it's about a whole day's worth of labor to get the exchanger replaced or you can buy a new furnace which is more efficient and it's going to get you a couple rebates, better power bills, better gas bills so it was worth it to get the new furnace. The furnace that I chose was a trained furnace because this dealer was a trained dealer and it came with a smart IoT thermostat. It wasn't really an option. It came with it by default. They say, oh, you want one of our new furnaces. Well, our new packages come with smart IoT thermostats. So you get it because it's required for the device. And it's called an XL850. So what exactly did I buy? To be honest, the day of I wasn't really sure because it just sort of pushed on you. You're in an emergency situation where you have to buy a new furnace. You think you're making the best choice. One of the reasons that I made this decision also was because I knew it was an IoT device and that kind of whetted my chops a little bit and I didn't go for the model above this because on that one, this smart device actually modulates the gas valve. I didn't quite feel comfortable playing with that so I stuck in the area where I was comfortable. So if we want to get technical and we do, because this is DEF CON, the device is the ComfortLink 2 XL850. And this is one of about three or four models that Train pushes out with their different units. And you can see the manufacturer's page here and a couple of links that'll be pretty relevant. One of the things you'll notice on this page is that there is a download for software update. This manufacturer allows not only over-the-air updates but you can download it yourself, load it to USB, hook it into the device and then it'll evaluate it, see if it's valid, and boot the new image. Now if you go to that page today, you won't see that link there anymore. Apparently they decided the best way to deal with this notice when they got it was to quickly remove the ability for people to upload their own software. But the links still happen. So the features this thing has, it's got a lot of features, particularly it's got lots of internet. It speaks Z-Wave, so it works as a Z-Wave controller. This thing is meant to go out and touch the other things in your house and interact with your whole Z-Wave environment that you have working. It has an integrated Nexia bridge, so a Nexia bridge on its own is something that's meant to control a lot of different devices in your house and provide a lot of functionality. You can remotely set your heat schedules and your cooling schedules either from a phone, your web interface, or the Nexia admins can do it on their own if they really wanted to. It can also send notices, so let's say your furnace starts failing in a really bad way, like I had with my first one. It can dial out to Nexia and say, hey, there's a problem. It'll fire up an alarm on your device.  The service that you pay for, it's about $10 a month to get all access to all these Nexia features. And one of the main ones that you see on the device is you get a cool weather map and local weather updates. And those are all actually pulled from weather underground. And they don't really control the requests that just goes right out to weather underground. And one of the more interesting features for us is the device will do over-the-air updates. So it does request to Nexia to see if it's got, or to train, to see if it's got a new update package and it will download it and load it if it validates against all their checks. And then, like I mentioned before, you can download or you're supposed to. I think they intend to keep this feature. They say the new link is coming soon. But you can download the software package, load it onto USB, and when you plug that in, it pretty much does a quick evaluation and will boot it. And it's worth $4 a sign, whatever that means. I still to this day don't really know how much it costs because it comes as a bundle deal and you can't buy them separately on the Internet. I think roughly it's about 300 bucks, so I was hoping not to break it within my research, also because I just got the furnace replaced. So the first day that I have this, I poke around on it constantly. And the first thing I see is a RubyGems license in the about page. Thank you, open source. This let me know that I had some ground to work with because I'm a Ruby guy. Most of my daily work is done in like Ruby, Python, things of that type. And having this type of disclosure of the gems, awesome. And you can see there's about 187 pages of open source software licenses that are included on this about page on the device. That was awesome. I was really excited to see that. Now, I know this thing has code that I can work with if I can get into it, and I want to do a basic smell test to see what's available on the device. And there's a ton of ports open on this thing. Way more than you would expect if this thing had a good security policy. One of them in particular came back as Napster, according to Nmap. Well, the thermostat isn't running Napster. I wouldn't be surprised if it was based on the research that I found. But this port 9999 stood out to me as really the most interesting one of the ports that I was able to scan. So I start poking these things. We're just using basic NCAT commands and attacking these ports, and you can see there's two of them that just take command prompts. They say, hey, give me a command. You've connected. This is fantastic. Those aren't even included in this presentation. But there's lots of opportunity for it. But we go back to port 9999, and this thing is obviously issuing an authentication challenge. It's giving us a couple of random numbers and wants something back from us. All right. You still have my interest. So now this is the focus of my research, and I want to see if I can break into this code to find out how this port actually uses commands. So that tarball that I mentioned earlier, that you're supposed to be able to download from the manufacturer's website, but you can't right now, unless you get to the proper link, it's got a couple of cryptic files, no extensions on them. They're trying to hide this from basic people with no knowledge of files or security or anything like that. The number is pretty much a build number, and you can see the 850 there in the beginning of the number. That's the platform number, and that's pretty predictable based on what thermostat you're working with. We run the file commands to see what this actually contains, and we see a couple of things. One is the image, and a couple of ASCII text files. Well, the first thing that I did was I opened up this other tarball, and what it contained was a utility folder with all the verification checks for the software image. They come shipped with the new image in this folder. It could just be me, but I don't think that's a good way to package verification checks with the new image. It seems like you could really just as very least they give you good insight onto how they do the verification for the software. So it would be pretty easy to reverse those and try and boot your own image. Here's the manifest file. It's got a couple of things in here that are worth noting. At the bottom you'll notice it's got a switch for the boot message that says am I trained or American standard? Well, I was focused on this device being my device. Mine is a trained unit, you can see the check sums. It's really just sizes and a couple easy things that are pretty quick to pick out from the verification checks noticed in the other files. So this makes it really easy to understand how the software is packaged and how to build a new one. And like I said, it takes over there updates and USB uploads. My main focus turned toward the actual UBI image. There's a number of ways to mount it here to interact with it, but I was able to find this tool and if you guys know this guy or if he's here, I'd like to buy him a couple of beers at home. It made it really easy to do a point and click tool, tear out the file system, and then I had a folder containing all the entire file system.  So I had a file system exposed and this makes it pretty easy to search through it and look for key strings and vulnerable issues. I searched for things that you would think of right away. Passwords, users, enrollment, alarms, registrations.  These weren't things that I tried. These are things that are very common in the source code.  You see a lot of calls for constants, the schedules, alarm histories, registration call out. This really lets you know how vulnerable these calls are to reverse engineering just by searching for these particular strings. You also find a lot of samples in passwords. Particularly they even have old commented out passwords. I don't know if this is some guy's dev password, or if this is a password still used on a production machine, but it seems like this is sort of a pretty common approach for how they would handle issues. I'm going to guess that this is probably their patch for a previous security problem. And hard coded passwords are obviously always a bad idea. And they definitely are. The command up there at the top, you'll notice is actually a sample command for how to set the heat. You can change it a little bit, so it's not copy and paste in order to be able to update the thermostat temperature or something like that, but it gives you a really good idea on where to start. Now like I said, this thing was written in Ruby. That means it comes with gems. Gems come with specs. Specs tell you what everything does. So in most of the instances, I could change into the director of the gem, do bundle install, and I was able to download all the production gems that they had on their basis. I can actually kick up those specs and recreate the protocols and all the faceplate messages. Anything that this did, and they wanted to check, it was included in these gems and it was reproducible simply by running specs. That's a good password, right? Now, their entire GitHub repository was pretty much open. They had a bunch of production repos on Nexia that were for ESX servers, production backbone servers that dealt with the faceplates and the different thermostats. These were all easily downloadable and they were wide open.  The first response we got was, no, we intended that.  And then they actually pulled down a lot of the repositories and these are the ones that are actually still up there today. Not the ones that they pulled down. So we've got a good idea of what this thing does and all the features that we can probably get out of it. We know everything Nexia can do. We've had a good look at the source code. We found a lot of valuable information from the source code that we've been able to examine and it all sort of comes back to this language called smile or perhaps smell. I'm not too sure. I found examples of it in documentation on the internet. They loosely fit with how Nexia actually implements this protocol or this system. And it was the best correlation I could find, but as far as we're concerned for train and Nexia, they really use it in a way that we could consider proprietary. There's not too much correlation with outside sources that I found, so it's pretty loose correlation. Again, I'm not exactly sure what the next or what the acronym other than this stands for. I assume that this is the best correlation. It's the synchronized multimedia integration language. The RFCs in documentation I was able to find online point to XML files with really customizable nose and I found a few of those that actually have an inventory of all the features and models contained within this device. So what does it do? Everything. Everything this device can do, and that includes not just the stuff the user can do, but anything the remote administrators from Nexia can do is available from this protocol. And that's a lot. It was actually a bit disturbing to see how much other features were included in this device that weren't even visible from the user interface. And as a user, you would never know that it just sends analytic data no matter what. So this is one of their regex expressions for evaluating this plain text protocol that we saw in the challenge issued earlier. This is theirs, not mine. If it passes this test, the device will start evaluating it. That doesn't mean you're going to be able to necessarily fire a command simply by bypassing this check, but it will consider it and it will start considering it valid data and it will compare the information you give it to the models contained in the device. I would expect a little bit better checks than that. The constants file that they use, and they use constants everywhere, it's not just a pattern of having hard-coded passwords, hard-coded server endpoints. You can see here they have things for the alarm sessions, chat sessions, registration and enrollment. These are all the core features of this thermostat.  So let's log in already. We know a lot about the port. We know a lot about the file system. We have a good idea of all the features we can do. Remember, you can remotely administrate everything on this from an app, from a website. You can change your temperature, change your schedules. If we can log in and start playing with this, we should be able to gain a lot of control over the device. So to get past the challenge that you saw earlier, it was actually pretty simple. Command up at the top is how Nexia manufactures the authentication command that it sends the device. So we do a SHA-1 hex digest of a couple of the values that we get back from that initial challenge, spit it back to the device and re-authenticate. It's hard-coded passwords done with a SHA-1.  So this is the same for every single one of these thermostats running this version of the software. Hard-coded credentials always come back to bite you. And when you authenticate and you issue a basic command, you get flooded with data. You can see here that there's a number of different model IDs that we get back. There's a lot of different type of data. Some of it's plain text, some of it's wrapped in protocol buffers, and it's a little bit difficult to understand. Subscribe, true. This floored me. When I ran this command, of course, I was able to authenticate with the device. I know the basic model structure of how the IDs work and the type of commands that it expects, so I start from the bottom. I give it a 1, I give it subscribe, which I know is a valid command, and I put in true. I noticed a couple switches in the logic that seemed to evaluate whether or not true was the entire payload. What I found out was that if you give it true, it will dump every recursive element in every child node or the ID you give it. So this thing has sort of like a domain structure, so it'll be like 1, 1.2, you know, it goes on from there. So when you give it 1 subscribe, too, you see the type of mess that you saw on the last slide. It gives you everything. That includes all the plain text information about the device, sensor readings, dealer diagnostic data, alarm history, everything. I don't know why I would actually enable this on a device, other than simply for ease of use of their own use, but it was horrible. I was flooded with data after I actually fired this command, and when you do subscribe, you stay connected. So as far as this thing was concerned, I was now an authenticated valid server, and I was properly requesting all the information this thing had, and it was just constantly spitting it out to me. So I'm flooded with data. It's a good understanding of how these model IDs actually work. So what I did is I built a script, and I let it run for about a day or two, and I played with my thermostat, and I swallowed up every single payload that I got from this socket, and saved it to a Redis database, breaking apart with the Regex matches that I saw in their code. So now I have an overtime inventory of all the different permutations of the device IDs, at least a report from this port, and also the command payload. So I can go back and do analysis on how frequently a certain ID occurred, what type of commands are the most popular, and what type of payload structures are the most popular, or perhaps the most powerful. Because remember, we've got different levels of things we can access, like alarms, the temperature, chat history, also authenticated callouts. So the things that I, of course, tracked were the authentication IDs. Every time you connect with this device, you get a new auth ID. So those were worth tracking to see if they were predictable. The command IDs themselves, so that domain system that I mentioned earlier, that will recursively dump all of its elements. We tracked those as well. And then the command payloads. We want to know how these things are built, and this made it super easy. I mean, this really took a lot of the research out of it, simply by being able to interact with the device over a couple of days to get all that data as an inventory. And this is how we process that. This is really it all it takes to probe this socket, this 9999 socket, and get back intelligible data. So this is the Regex, and the method that I use to actually interact with the socket, get back the data, and save out the stuff that I got so that I could analyze it later. And I didn't really have to change it at all when I changed this to an active script, because it was so spot on and useful. This is what everyone wants, right? We're dealing with an IoT thermostat. We want to know if we can change the temperature, heat point, cold point. And if, like I mentioned earlier, I'm in Michigan. So if someone plays with my thermostat and sets off my heat to zero in the middle of winter, I'm screwed. When your pipe's free, it's a really expensive problem. And when your house burns down, it's a more expensive problem. And we saw earlier with how my pass furnace the heat exchanger failed. It could even be a deadly problem before your house burns down. If someone keeps your burner going and it's constantly working on the heat exchanger, that might fail and start pumping carbon oxide into the house. And if you have controls over the alarms that set off on this device, you could prevent it from actually raising an error or dialing out to back home. You guys probably remember this command that we saw earlier, this sample. It's a good indication that we can set the type of IDs that we've been talking about already and then the set hold command. And I was able to track this down to the models included in the XML file that I referenced earlier and start analyzing their structure in order to recreate this command. This command here at the bottom is the one that I actually used to set the heat and the cold. And it works. Every single function on this device is set up in this file. Anything that's can possibly do is set up in this file. And there's a couple of interesting things that illustrate why the Redis script that stored all that data was relevant. You notice the N here in the model ID. They use dynamic IDs for a number of elements in this device. So you can't just really copy and paste. You have to have intelligence on what you're actually working with. And to be able to process the data you get back, identify certain parameters and then you can use that to actually set these update commands. So to get this command to work, you actually have to query for the zone that you want to update. You can't just say, set the heat. You have to say, well, what do you even have? Do you have one zone? Do you have two? Because these things are definitely in a bunch of homes, private homes, which is pretty scary. But they're also in a lot of commercial buildings, transportation hubs. Pretty much everywhere you wouldn't want them to be. And this is the code that actually does that. So you can see we have the set points code and then we have a couple of other methods as well. We have the derail and the re-rail. One of the functions that we have on this device is we can set and remove authenticated servers. An authenticated server is Nexia. This thing has backbone. It will dial home and set off alarms, for support, all this. And it stores its trusted server as Nexia as one of these values. So you can get in there and you can actually pluck out Nexia. And this is all using the same structure that we've already used. And you can put in your own persistent connection. So let's see it in action. Hopefully you can see it well. We get the challenge. We smash it together with the default credentials. And then we start issuing a set hold command for the native zone that we got back every second. This thing doesn't have rate limiting. It has a fire and forget model. So whatever the most recent command was takes precedent. And as you can see, it doesn't matter if you're standing in front of it hitting the button, you're less important than the command that's receiving.  It doesn't care. It's pretty much vulnerable out of the box. This is bit frightening. And again, it doesn't matter how many buttons you click or what functions you try to enable from the device interface, you will never be more powerful than the command that it's receiving. Because as far as this thing is concerned, the administrative that it commands that it gets remotely are the end all be all. We'll let it finish up. I think eventually the furnace itself will hold on. My burner is building up with gas or something like that. But it will always go back to heat mode. And you can set it to 90 degrees. You can set it to pretty much have the heat shut off and these are both like life-threatening problems depending on where you live in the world. If you live in Las Vegas and I set your heat to 90 degrees, that's a problem, right? If you live in Michigan and I turn off your heat, that's a bigger problem. Okay. So this method of issuing commands works for everything, like I said. And it works for all the different models that are included in the device. And that includes sensitive information. So, yeah, I can update your heat.  But I can also find out what your heating schedule is, so when you leave for work, when you get back from work, what the authenticated IDs for your device are, your serial numbers, you can check up on you as Mr. Bad Guy and see if my commands are actually doing what I expect them to do. And then, of course, active trusted connections and active trusted servers. So we can query this thing for read-only data and find out all the sensitive information. And it's pretty scary. And that includes chat logs, too. So you have the ability to actually chat with an exe rep, I believe, over this device to remotely provide service and control. They can actually enable SSH, if they want to, to get in your device and see what's going on. And that's all accessible. So we can read chat logs, the platform information, everything we need. And this one particular element, the AUID, that's a privileged ID that they generate off of the device's MAC address and a couple other factors is encrypted with this ID. And this ID is queryable from this port that uses a plain text protocol. Okay, well, clearly I've been able to write a couple of scripts for this and I want to make sure that people are able to audit these devices and have the ability to see if a device is vulnerable. So, building the new tool. Building a point-and-click tool after all this research was pretty easy. Obviously, the research itself was pretty much building these tools with this protocol. Mess with it, set the heat. Set your own server as a trusted server so that it never contacts Nexia. This is all available within the couple tools that I was able to build.  And I still know when you guys are away from the building or at work, but I didn't change your heat. I didn't, you know, disconnect you permanently from Nexia. But we've proven that you're vulnerable. It's called trainwreck. The GitHub repository was opened up about an hour or two ago. So these tools are publicly available right now for you. And trainwreck is a Ruby script. And I included a gem file. So even if you're not a Ruby guy and you don't have Ruby installed in your system, it's pretty easy. You install Ruby. Second step is you do a bundle install. You'll have to install maybe a gem or two. And then after that, you're good to use command line scripts to execute these functions against the device. And these things, a lot of them are publicly available. Remember, these are ports that are used to communicate with the back end service. So I didn't just find this one on my own home network, but they're available throughout the country. This is how you use the more safe script, the one that just pulls queryable information. This will let you know that a device is vulnerable without threatening your house or your business or your client. And I think it's probably the one that most people will use. It's really, really easy. I should explain the stay command. So you just give it a target IP and then you can set it to stay subscribed. We have the subscribe command that will constantly feed us data. So this will connect to a device, parse out all the information that I listed before, and then if you want it to stay subscribed, you can maintain that connection and either, I don't know, output it to a file if you want or send it to a Redis database, at that point it's really up to you. But you can do additional research simply by having all this extra data. And then derailer is the script that's a bit more fun. And I say fun, I should say dangerous. The functions that are included in this, you can set the heat point, you can set the cold point, and you can actually derail or re-rail which means you can remove Nexia as a trusted server from the device. So this thing essentially goes dark from the backbone servers that are meant to control it from Nexia and train. So this thing will never set off an alarm to the home server. It will never call and raise a problem. You'll never be able to get tech support if it's disconnected from this server because it will have no knowledge of it. And I was able to set one of my computers at home as a trusted server. And this thing just started spitting data to it. Now, that's bad. And you can actually set different parameters for whether or not you want the data connection to be encrypted with that idea I mentioned earlier or not. Not that that's the best level of encryption, but you have that ability. And I preface this. This is a pretty dangerous one. Of course, you only want to use the sign devices you own or that you have the permission to test simply because you're using default login credentials as a part of this script and that's something to be considering or something to consider. So the scope of the problem and more problems. Why do we really care? Well, there's a number of things that are really bad about this. First, you can pretty much set the heat and cold for somebody's private house or a corporate building. That's bad. I mean, that's bad enough. That's a lot of people's worst nightmare. In addition to that, you get the privileged information of when your family's gone from their house or when the corporate building is empty. And there's a couple of other things that are cause for concern. This is also shipped with private keys for the backbone server. So the package that you download from train, this thing actually calls back to train and says, hey, here's my port. How to communicate with me? It will SSH back to their corporate server. It will then execute a shell script giving it a port number and then it will dial back and try and connect through that port number. So there's private keys hidden in this software package and that's a problem. And there's a lot of social engineering stuff that comes with having access to really specific privileged information like the hardware serial numbers and I don't mean just the device. You can also get information on the electronic relays and the furnace. You can update the functionality like I said. So it would be really easy to silence the device from the corporate server, make your server, your authenticated server, change it so that it's not operating correctly, silence the alarms and then you can show up as helpful Mr. Handyman and say, hey, what's this? And your temperature is out of whack? I'm here to fix it for you. Because that's a feature that this is supposed to have. You're supposed to be able to fax or dial out to the people that actually installed your furnace and that information is available in the scripts also. So you could just show up and mimic these people. In addition to that, we're all familiar with ransomware, right?  We now have the ability to cut this off from the corporate network. We can set the heat and we can actually set messages, remember the banner in the top. We can set our own alarms. So you really could say, all right, you're no longer connected to Nexia.  So now we've taken ransomware into actual physical implementation. It's pretty scary. Now the vendor claims that this was patched. We did disclose this to the vendor. It's been a good process. I had some help from good folks at work like Carl and they claim everything that's connected to their backbone system is patched. But remember the passwords that we saw commented out earlier? What we heard was that they simply disabled this port and we've evaluated that there's a lot of problems with this device. So knowing that these things are everywhere and that they've patched it, probably how they have patched other problems in the past doesn't really give me much much comfort at all. And remember with the basic insecure structure of this device or the lack of a good security bedrock in their approach, every other feature listed here is ripe for exploit. So you've got software updates that can be pushed over the wire and you can also do DNS spoofing. It pulls from servers that aren't really under the control of Nexia or train like weather underground. So you have third party servers that could be exploited or compromised and then they represent a way into the device. Like I said it ships with private keys for corporate servers. That's usually a very bad thing. And then the Nexia backbone itself touches a lot. So Nexia's service or Nexia's business is being in your business. They want to touch and integrate with as many things as they can so their backbone servers are meant to interface with door locks, light switches, cameras, thermostats. So if there's devices shipped with things that make it easier to compromise those systems it has a ripple effect that could affect a lot more devices. There's more every day. So this is a quick search from Shodan a little while ago when I first started the research. And it's pretty easy to find these things. What we got? Those show up really easy on Shodan. And you find these things like I said really everywhere you wouldn't want them to be. So private homes is scary enough but they're also in corporate buildings transportation areas probably utility areas it's pretty frightening and they're really easy to locate. So a bad guy could just walk around poke on Shodan and look for a target and they've been getting noisy. So when I first started the research it wasn't this bad. You weren't getting massive data dumps output of JSON data on a different port but it seems like since the patch has arrived or been deployed that these things are really just dumping the data out. So this poor guy we can read what his temperature is set at if he's enrolled in Nexia a bunch of other pieces of information that we should not have access to available online. It shouldn't be. At the very least it seems like encrypting this information would go a long way. There's a lot of other problems in the device that are problems in themselves but protecting your customers data is really key especially when everyone's paying 10 bucks a month for features that they never really asked for. Like I said there's a lot more opportunity. The problem is that these things are really everywhere and the people that have built this package with an idea of what can we do rather than how can we do it properly and have our customers ask for this they touch a lot of other devices Schlag door locks thermostats lighting modules security sensors, alarms and then train itself is owned by a parent company Ingersoll RAN which owns Thermo King a lot of air conditioning services golf carts for X-Play and like I mentioned before these insecure devices are shipped with things that could make it possible to compromise the corporate structures that administer these devices So we might have a vulnerable thermostat but that could end up at a compromised backbone and the backbone interfaces with all these devices So when I started googling for some of these hardware numbers that I found when querying information from the device I found that actually their secure area is directory indexed on Google and by the way I found this pretty innocent because I found the hardware numbers for the tools in use on my actual device and I started googling them looking for simply what they were and all these PDFs from the secure area started popping up and I realized that their entire directories were indexed and that represents a pretty bad security posture and it's another example of how some part of the company can have a bad problem of security and that will affect the rest of the company Remember we had Nexia they had open GitHub repositories with database salts, database passwords it was bad you have all these different companies in play and working with each other because everyone wants to integrate and you really have the weakest link of the chain is where it's going to break So here's the GitHub repository for the tools I hope you guys make use of them for everyone to use in their audits check out your own home thermostats that's why I made this safe one so that people can actually look at their own thermostat and see if it's vulnerable without risking their home or their furnace and then so you guys can contact me here's my Twitter I'm also on Keybase so if you have any feedback any ideas or if you get to test these in the wild on your own devices or ones you have permission to use I would love to hear how they work if you have any features or pull requests from anyone who submits them and that's it so if anybody has any questions I can try to answer them now so first off great talk you saw a lot of logic type problems inside the Ruby scripts did you find any other secure methods like eval being used any other ways to get access to devices besides just probing the temperature in that case I used a couple tools to try and evaluate it like Flay and some other syntax evaluators but I didn't find anything that it raised really as a red flag if you have some idea of particularly things we should look for I would love to hear that and we can definitely go back and take a look so you managed to derail the thermostat from makeshift backbone what about the other way can you authenticate yourself to the backbone and the impersonate another thermostat is that reasonable though I didn't in my research I didn't take the step to spoof information or really go far into the backbone servers because that was sort of territory I wasn't really comfortable with but given what I saw I have no reason to believe that wouldn't be possible because really you're using a private key and a hard coded user to authenticate with the backbone server and you're really just providing commands all available right there in the code so there's no reason why you couldn't have the server dialed to your port expecting to connect to a thermostat and getting something else instead yep I would expect that to be possible certainly I saw that there was some work done on a different software package on the XL950 that dealt with a buffer overflow but we were really focused on exploiting the heating, cooling, and the actual functions of the thermostat itself but I did notice that I noticed that some of these default passwords were included in a blog post from a number of years ago but I did take knowledge of that I just tried to take a different route so we could get additional research the device is wirelessly connected and some of them have the ability to be connected to the Ethernet cord so when you get this the first thing the installer will do is ask for your wifi password they'll put it in and hook this thing up to your network if you don't want to do that you either have to have it signed up on your own so there's a whole network interface on the device and you can select which wifi network to attach it to or you could really take the thing off the wall and hook it in with an Ethernet cord and I think some of them from what I read are built more to work often Ethernet cord exclusively but pretty much everything seems to have wifi capability as well neither one of them I expect to really protect this feature I didn't have time to finish that part of the research but everything I've seen makes me think that that's really possible you could force your own package on it yep and like I said the validation scripts are shipped with the package and you can also hot plug it via USB so even if someone has a strict security posture where this isn't even hooked up to the internet and it's air gapped you could walk in and hook up a USB and if you had the right checks it would validate and upload yeah I had a question was there any built in thresholds for the temperatures like what if I wanted to set an arbitrary value of 800 degrees yeah so 90 degrees was the heat threshold and uh I think it was probably around 50 I'm not exactly sure for the low one but yeah 90 degrees was definitely the highest that you can set it at but that's still on a hot day something I would consider like a failing temperature if you're set to a constant hold of 90 degrees sorry just a little follow up on that did you try if you said like something like 800 degrees would it just truncate it to 90 or just flat out reject it it rejects it or it labels it as like a dead band so if you send it invalid parameters it'll actually say like I'm gonna be running the air conditioning and the heating at the same time this doesn't make sense so it has some attempts to validate the temperatures you send in but the ranges given natural environments are still pretty dangerous the vendors response it took them a while to actually take us seriously so we uh Carl Sigler, a guy that I work with reached out to them and let them know hey we've got a security researcher who found a vulnerability in this so I'm going to work with you on fixing it the first responses we got back include our research and development department is so big there's no possible way that you found a vulnerability in our thermostat after that and we started sending them things like that video we got their attention pretty quickly they still haven't provided me the patch to test although they say that they've patched 100% of the devices that they have access to which itself means that not all of the devices are patched it was a struggle to get a good relationship with them in order to get the thing fixed and to this day I'm still not confident this completely addressed and that's part of the reason that I put tools out to help and apply pressure to make sure that research on this continues so you mentioned they fixed part of it or potentially fixed part of it but don't have much confidence considering some of the bad comments and so forth is this in your opinion ultimately fixable or I mean is it so riddled that it's just right from scratch that's a good question I saw a number, I mean we went over a number of problems that this thing has and these all developed from really thinking first about what you can do instead of thinking about security it would definitely be much more of a nightmare going back and retrofitting this to a secure position today rather than it'd probably be cheaper to start from scratch and have this thing written as a secure code but it may be possible, I'd never say never I started reverse engineering the code and looking into these ports as soon as I got the thermostat and as soon as I got the furnace back in December but to be honest considering I just replaced one furnace and it was still the middle of winter in Michigan I waited a while before trying to exploit the actual set heat commands I didn't want to have to call up people to just install new furnace and say hey I broke it, come give me a new one Can we read my answers? After watching that show after I started this research and I was thrilled to see that episode So those ports are clearly a different service and it's not included in this research but it does have validation so these are these are ports that are wrapped up in the busybox binary that they're not included in the general source code package and they have validation on them so they will definitely kick back commands and say no that's not valid In fact everything that I tried fuzzing it was like no, no, no I didn't try a straight out buffer overflow I was trying to actually get within their proprietary protocols and such but having a plain text port that says enter command is just asking for trouble Disconnect from the network Do you lose enough functionality that it's no longer worth the premium price or whatever and does that ultimately keep you kind of secure well even if you disconnect from the backbone server this port and the service will still be available because it's available either locally or remotely depending on your network configuration you probably won't lose every service on the device though because like I said it calls out to third-party servers that aren't affiliated with Nexity at all If you never configured it to work with your wi-fi in the first place there wouldn't really be as much opportunity to exploit it anyways The only opportunity to exploit the thermostat at that point would be to hot plug a USB with a poison package simply because these ports aren't available Would you then lose so much functionality that it's kind of not worth having that If you were able to lower your own software package, yeah, we can assume you lose everything Anyone else? Most real world appliances with just constant areas wherever the installers are actually instructed to connect it as part of the installation process but you could totally request that hey, don't connect this to the internet Everything about this is intended to basically force you to connect the device though You really are required to use this device to have the furnace work correctly and every feature on it is expecting that you're hooked up to the internet It won't even give you the weather from a weather underground or your local temperature which isn't from Nexia until you sign up for their $10 month service So every chance they get they want you to sign up for their integration Anyone else? Alright, thanks guys


I know the sigh thing is like a meme, but it is funny how whenever you sit down to do a somewhat serious video, you do take a really deep breath to start it. Uh, that said, I don't really know where to start making this video. I, um, I want to say thank you, uh, for a lot. I feel like this has been a long time coming for the channel, but, um, there's some specific things I wanted to talk about. Uh, last weekend was very overwhelming for a lot of reasons emotionally and physically. But what I meant by a long time coming is, um, I try really hard these days on my channel.  And, uh, I, I don't really leave room anymore for the real videos for the updates. I've, I've, I've hated doing updates and this isn't an update video, but the kind of video where it's just me talking to you guys and I feel like that gets lost a lot and I, I don't, I don't want you guys to forget, um, that there is someone behind all of this content that still loves you guys and, uh, and wants to talk to you. I just, there's not, there's not much time with the content I'm creating to sit down and just talk anymore. Um, so first and foremost, I just want to say thank you for everything that you have given me and everything that you do for me and watching my content and supporting my content in general, no matter who you are. It's something that I haven't said in a real way in a, in a real long time because there just isn't time for that anymore when you're creating content. So, yeah, first up, no matter who you are, thank you. Um, but now to be a little bit more specific, there's a few things I wanted to talk about. Um, I went to a convention last weekend, there was too many games in Philly and before I went on the Friday, I rushed before my flight to upload a video about the Switch OLED and revealing that new, uh, Satisfy grip. Um, an insanely overwhelming response to that. I, I was, you could tell in the video, but I was honestly extremely nervous and worried that I had taken a year of this company's time and we were going to put out something with my name on it and it just wasn't going to sell. I had all these fears. I was worried that people wouldn't want to buy it in general. I was worried because, you know, we've sold Satisfy grips before on my channel. So now I'm asking people that may have bought one before to buy one again. I loved the color scheme, but it is yellow. So you have to love yellow even though I think it's super fresh. Um, but I had a lot of hesitations. I was like, maybe this just won't do well. And I showed you guys the grips, all the, all the prototypes that were sent, but I only showed you half. I showed you what was in this bucket, but there's a whole box filled with more. I have like a hundred of these prototypes, uh, that have been sent to me. And, um, it was just a lot of, of a lot and I was worried. Um, and I put it up, I put the video up right before I caught my flight. And the funny thing is the, the main guy Philip behind Satisfy, who I work with, who I've become friends with pretty much, was flying to the con to meet me and Bob and some other friends that he had made through collaborating with this grip. Like we've all become pretty close. So I landed and I was like, how is it going? And I was so scared to ask, I was like, how, how are the numbers?  It was absolutely insane. It was well past what we expected. And, um, this isn't everything I want to talk about in the video, but I, I do want to thank everyone that has supported it so far. I didn't say in the last video, but it's limited edition because it is actually limited. I mean, we didn't know how many to make or we should make. So we, we picked a number and we're getting close to selling out in the pre-orders. And that, that was something that I thought would happen after like maybe several promotions and slamming it in videos. And I was, I was going to do my best to make it worth it for this company to sell these things. And one video and we're over halfway, well over halfway to being sold out. And it just hit me that people connect with my brand so much that there was an excitement there of people wanting to have my, my brand, my logo on something they play with every day, you know, the switch. It's, but I built my whole channel around it, you know, and it's, I feel so connected with my switch, but the switch and through you guys, I feel connected to the switch and you. So the fact that there are people out there that are wanting to sit there and play the games that maybe I've recommended while using a grip with my name and signature on it. It, it was like another level of something that's just not happened to me before ever, but on this platform and with my channel. And it was, it was just this like little thing of like, thank you. I don't know. It, it, it blew me away. And everyone, my reaction to it was insane. Like everyone, even if they weren't buying, if you guys weren't buying at the comment section was that looks sick. I'm so happy for you. But all of those so many comments immediately of people saying bought it, bought it, bought it, bought it, bought it, bought it. And, and then tweets, people showing me pictures. There was a tweet a couple of nights ago. Someone said they asked their girlfriend to buy it for them for their birthday and they got, they showed the pre-order that their girlfriend gave them for their birthday. Like they wanted it that bad. It was their birthday present. My God, I may have teared up a little bit. Like so many wholesome, it's just so sweet. It's so overwhelming. And to be at this convention where people were coming up to meet me saying like congrats on the grip. I bought the, like so many people at the con were saying I bought it. And just to be there with Phillip and see the reaction to it, be there with Bob too. Bob was very jealous. If mine does well. Yeah, it was a lot and thank you. Thank you so much. Yeah, I don't know what else to say about that. They are limited and they're selling. Anyway, thank you. And as far as the convention itself, it really reminded me who's watching, I guess, and the impact my videos can have. Which is why I wanted to sit down again. And just say thank you. No matter who you are, thank you for everything. I met so many people, both days, both Saturday and Sunday. I was swamped with meeting people. Like it was nonstop. Saturday I didn't even, I walked onto the convention floor. And I stood in one spot and people kept coming up to meet me. I didn't have a table or anything. I didn't think I would need one. We just, everyone formed a waiting line around me. It was bananas. I mean I haven't done a con in a couple of years. A million subs before all of that. As I was blowing up, I guess, was the last time I really did a con. So this is the first time going to one in a couple of years with over a million subs. And it was insane. It was like from zero to 100 for me. And it was super overwhelming. But weirdly it was euphoric. It was nice. It melted me in a great way. And out of all the hundreds of people I met, 50% of them I swear would tell me that I helped them with their mental health issues. That they connected with me through my content and my stories. And it made them feel better because they could relate and they didn't feel alone. And that was incredible. I mean it reminded me of what my content can do for people. It reminded me exactly what I'm doing here. I mean I'm not just screaming into a void about switch accessories. Creating things that help people, that entertain people. And being real and having these moments of hey, I suffer through things like mental health and we all have our problems. And you're never alone. Having those moments of down-to-earth realness is what helps people. And I feel like I don't take much time for that anymore. Which is why I wanted to do this again. Because it's important. And I want you guys to know that I love you. And it's like I go to that con and half the people tell me that story. Then statistically speaking I have to imagine that half the people watching this can connect and relate to this message too. And I just, I love you all. And thank you for everything. And I feel like the response to that's going to be no thank you would, but no thank you. Because I would just be screaming into a void if you weren't there watching and relating. So, if you came to see me, thank you. And if you wanted to see me, but didn't, I'm sorry. But I will be at Retropollusa, Texas, if you live in Texas, later this month. People were coming up and giving me little gifts too for my birthday. Someone made me this, which I really loved. And then someone gave me this little happy birthday baggie. And gave me this little guy that they made. So adorable. Oh, and I got the best badge from the con signed by Bob Wolf himself. So this is going to be very valuable. Why would it be very valuable? Later should be as valuable now unless I'm implying something horrible. Actually speaking about Bob and Miss Click and Jordan Fringe and E and Scootish. And my Lord, who do I even, where do I stop before I start running out of people? Spawn Wave, Max. Everyone that I hung out with on the weekend, that was really wholesome too. I think that was probably the best con I've ever been to for just hanging out with friends. And I want to thank them too, because they were all so welcoming and so kind. So many of them I was meeting for the first time, like Miss Click. And I want to say Bob, but we did technically meet once. We had a photo from like three years ago, but I don't remember taking it. I didn't learn who he was until after. But it felt like even though I was meeting so many of those people for the first time, it felt like we'd all been family for years. I mean, Spawn and I and Max hitting the gym Saturday and Sunday morning to work out and going out to dinner with everyone and just hanging out. And I went to birthday dinner with Bob and E and Scootish and Bob's girlfriend and Bob paid by the way. I don't know. I didn't expect that. He just said happy birthday. I don't know. It was a good weekend and I'm exhausted actually. It's Thursday now. I left on Friday last week, so I feel like I haven't done anything for a week. I managed to finish Metroid Dread last night finally and been playing some Far Cry with my high school friend. But I got to get back into work. I have sponsors. It's halfway through the month and I only managed to get one done before I left. So I got to get to work making some new videos. So yeah, you'll probably see a lot before the end of the month. I just wanted to thank you all so much. I have some more stories from the convention.  We're going to tell that on my podcast on Sunday if you want to check in on that. Links below to the podcast. I just went to start editing this and I realized there was one thing that I wanted to say. Kim, the whole week, Kim's next to me. Yeah, she's waving. She's not makeup. She's not makeup ready. In her words, not mine. I think she looks beautiful. On top of everyone coming up to see me, almost every single person said hi to you too and was excited to see you. There was two stories that stood out to me. I don't know if you want to save them for the podcast on the weekend, but one was the very first person that came up to us, loved us both, Ashley. She had one of your little bare pins that you make on Etsy. And that was really sweet. And then there was someone else that made us both cry. And I don't want to tell Kim's story, so I'll keep it really quick, but essentially he has a daughter who watches one of Kim's videos on a repeat, always wants to watch that video. And I'll leave the details for Kim to tell on the podcast, but it was so sweet. And yeah, just everyone coming up to meet you as well was, I'm sure, overwhelming for you. It was really cool. No, it's not in a bad way. There's no way they can hear you. Sorry. Well, tell it on the podcast if you don't want to be close to the mic, because you got to like do this to this thing. Okay, well, that's it. Okay, back to the video. Other than that, yeah, I just wanted to say thank you. I just wanted to remind you all that you're not alone and that I appreciate all of those that share those experiences with me and connect with my content in some way. I love you all very much and thank you all very much for supporting me and everything I do on this platform. I would be nothing without all of you. And until next year, when I make another one of these kinds of videos, I hope you enjoy all the stupid content and breaking of switches. I'll try not to break my OLED and whatever weird stuff I do from here on out on this platform. You guys are amazing. Thank you. And yeah, we're running out of the grips. So if you want one, grab one. I think we've got something special planned for if they do sell out. I mean, I have things I want to do. So if they're realistic, we have some really special things planned for if they do sell out and everyone can benefit from them. So yeah. All right. I love you all. See you next time. Bye.